phantom_pwn - Phantom Vault Extractor & Decryptor

[ar7s]

hey there, where can i dm you

[cyclone]

@ar7s DM sent.

[rickyc2024]

@cyclone I wanted to speak with you about your vault decryptors. I am currently working on a vault decryptor for solflare wallet but I have had some issues with decrypting the vault data with secretbox as it dosen't seem to be encrypted with the wallet password. Can we speak in dms?

[rickyc2024]

I also noticed that the structure of solflare vault data is almost identical to the structure of phantom but it doesn't seem to be using the wallet password.

[cyclone]

@rickyc2024 DM sent.

[shinexyz]

Hi! thank you so much for this. I am super beginner, only started code with the help of claude recently...

I am trying to crack my own phantom wallet that I forgot the password (didn't write down the seed phrases... ). I have some clue on certain words that the password may contain (not sure either, but trying)

do I need both decryptor and extractor or just decryptor?

I managed to install GO and created exe file for windows (go build?) but when I tried with Key.txt (extracted from wallet), it didn't work..
(I tested on the phantom wallet which I know the password of, and used a random word list with the actual pass word inside) Any idea why this would be the case? Thanks so much!

[cyclone]

@shinexyz You'll need to first run phantom_extractor to extract the vault hash, then run phantom_decryptor with that hash and wordlist containing password candidates. Try cracking the example hash first to verify you've got everything figured out and working.

[pavmojer]

Hi I saw this post from github
@cyclone , could you tell me about this project?
Can I recover my seed or password?

[cyclone]

@pavmojer
Phantom crypto wallet passwords recoverable with my phantom_pwn toolset. The seed phrase is also recoverable once the password has been recovered, but is a multi-step process as described on my GitHub writeup.

Read through this GitHub issue (walkthrough) and DM me if you run into any snags.
https://github.com/cyclone-github/phantom_pwn/issues/14#issuecomment-2613081472

[immolatje]

@cyclone Hello!, I'm trying to regain access to my Phantom wallet after reinstalling Windows and forgetting to save my seed phrase. Using the Windows.old files and your guide, I’ve walked through the process up to the decryption step. What should I do next to recover the seed phrase? Thank you.

[cyclone]

@immolatje Make sure to read through these posts as I've posted a complete walk-through on github. On Phantom wallets, recovering the wallet password is the 1st step of a multi-step process.
https://forum.hashpwn.net/post/601

Phantom crypto wallet passwords recoverable with my phantom_pwn toolset. The seed phrase is also recoverable once the password has been recovered, but is a multi-step process as described on my GitHub writeup.

Read through this GitHub issue (walkthrough) and DM me if you run into any snags.
https://github.com/cyclone-github/phantom_pwn/issues/14#issuecomment-2613081472

[John]

@immolatje To extract the mnemonic from the hash, you also need a hash to decrypt the second level of encryption. In your screenshot, only level 1 has been completed. You can simply import the Phantom files into your browser and log in with a password to access the seed phrase in your wallet.

[cyclone]

New release: phantom_pwn v1.0.0
https://github.com/cyclone-github/phantom_pwn/releases

[gangstermate]

Hi. I have a question, is it possible to automatically export the private key of the wallet we unlocked using your tool? Or the mnemonic by any chance.

I cannot send @cyclone a DM because my reputation is too low.

[blacktest]

What should be the format of teh password as i can see my password is helloWorld but when i decrypt same in python all same metho itt doesn't decrypt that for phantom

[cyclone]

@blacktest
This toolkit is written in Go, so I'm not sure what Python you're referring to.
The info you're requesting is in the GitHub README and first post of this topic. Upon successful decryption, the tool will print out a string with "{json}:{password}".

 ----------------------------------------------- 
|       Cyclone's Phantom Vault Decryptor       |
| https://github.com/cyclone-github/phantom_pwn |
 ----------------------------------------------- 
...
2025/10/22 14:11:35 Working...
{"encryptedKey":{"digest":"sha256","encrypted":"5pLvA3bCjNGYBbSjjFY3mdPknwFfp3cz9dCBv6izyyrqEhYCBkKwo3zZUzBP44KtY3","iterations":10000,"kdf":"pbkdf2","nonce":"NZT6kw5Cd5VeZu5yJGJcFcP24tnmg4xsR","salt":"A43vTZnm9c5CiQ6FLTdV9v"},"version":1}:password
2025/10/22 14:11:39 Decrypted: 1/1 6181.36 h/s 00h:00m:03s
...

[kayso]

Hi cylone your tool was absolutely helpful the issue im having though is my phantom had other passwords and the password i have only lets me into 1 of the many wallets i have. is there a way for me to find the passwords for the other vaults as ive tried all variations and nothing cracks?

[kayso]

also one last thing, i am almost certain the pass variations im using are correct so is there anyway for it to still not decrypt despite having the right passwords ?

[cyclone]

@kayso
Phantom only has one password per wallet vault (similar to MetaMask), so if some wallets aren’t unlocking with your password, they’re likely from a different vault / browser profile, etc, and the password is not the issue.

Also answered on Github:
https://github.com/cyclone-github/phantom_pwn/issues/24

[kayso]

yes i know its multiple vaults. I have 6 vaults in total and only 1 vault will unlock with wordlist. is there perhaps something wrong with the vault itself ect and is there any way to resolve this issue (the wordlist contains all possible passwords so password is not the issue)