phantom_pwn - Phantom Vault Extractor & Decryptor

[cyclone]

Title: phantom_pwn
Author: cyclone
URL: https://github.com/cyclone-github/phantom_pwn
Description: Toolset to recover, extract and decrypt Phantom crypto vaults/wallets.

Phantom Vault Extractor & Decryptor

POC tools to recover, extract and decrypt Phantom vaults

This toolset is proudly the first publicly released Phantom Vault Extractor and Decryptor

• Contact me at https://forum.hashpwn.net/user/cyclone if you need help recovering your Phantom wallet password or seed phrase

Writeup of my process of decrypting Phantom Wallets and recovering the seed phrase

• https://github.com/cyclone-github/writeups/blob/main/Pwning Phantom Wallets.pdf

Phantom vault location for Chrome extensions:

• Linux: /home/$USER/.config/google-chrome/Default/Local\ Extension\ Settings/bfnaelmomeimhlpmgjnjophhpkkoljpa/
• Mac: Library>Application Support>Google>Chrome>Default>Local Extension Settings>bfnaelmomeimhlpmgjnjophhpkkoljpa
• Windows: C:\Users\$USER\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\

Extractor usage example on test vault: (plaintext is password)

• Old pbkdf2 KDF

./phantom_extractor.bin bfnaelmomeimhlpmgjnjophhpkkoljpa/
 ----------------------------------------------------- 
|        Cyclone's Phantom Vault Hash Extractor       |
|        Use Phantom Vault Decryptor to decrypt       |
|    https://github.com/cyclone-github/phantom_pwn    |
 ----------------------------------------------------- 
{"encryptedKey":{"digest":"sha256","encrypted":"5pLvA3bCjNGYBbSjjFY3mdPknwFfp3cz9dCBv6izyyrqEhYCBkKwo3zZUzBP44KtY3","iterations":10000,"kdf":"pbkdf2","nonce":"NZT6kw5Cd5VeZu5yJGJcFcP24tnmg4xsR","salt":"A43vTZnm9c5CiQ6FLTdV9v"},"version":1}
 ----------------------------------------------------- 
|          hashcat -m 30010 hash (pbkdf2 kdf)         |
 ----------------------------------------------------- 
$phantom$SU9HoVMjb1ieOEv18nz3FQ==$7H29InVRWVbHS4WcBJdTay0ONb4mLX9Q$g0vJAbflhH4jJJDvuv7Ar5THgzBmJ8tt6oajsQZd/dSXNNjcY5/0eGeF5c1NW1WU
 ----------------------------------------------------- 
|          hashcat -m 26651 hash (pbkdf2 kdf)         |
 ----------------------------------------------------- 
PHANTOM:10000:SU9HoVMjb1ieOEv18nz3FQ==:7H29InVRWVbHS4WcBJdTay0ONb4mLX9Q:g0vJAbflhH4jJJDvuv7Ar5THgzBmJ8tt6oajsQZd/dSXNNjcY5/0eGeF5c1NW1WU

• New scrypt KDF

./phantom_extractor.bin bfnaelmomeimhlpmgjnjophhpkkoljpa/
 ----------------------------------------------------- 
|        Cyclone's Phantom Vault Hash Extractor       |
|        Use Phantom Vault Decryptor to decrypt       |
|    https://github.com/cyclone-github/phantom_pwn    |
 ----------------------------------------------------- 
{"encryptedKey":{"digest":"sha256","encrypted":"37fJoKsB9vwnKEzPgc2AHtYVsPTTzrXdTGacbgWxLxbiS7Ri3P3iNnf8csaKwJ4wpk","iterations":10000,"kdf":"scrypt","nonce":"49aomus4HiKLyg7F66pSinR4tpuUuJDHX","salt":"M1PMFn4p4gdCxZDzf8qX71"},"version":1}
 ----------------------------------------------------- 
|          hashcat -m 26650 hash (scrypt kdf)         |
 ----------------------------------------------------- 
PHANTOM:4096:8:1:ogSL4J4xP/wNbAjiA8Q4hA==:Iofs3VYyyaYFzHVkcMsnpkrjGQ2+Kni2:OacHaTJAM8dD7XJIj5bGMU3cM8QW3u92n+ngYjXsgRSR20FDnkMLQHTgPxJDefOx

Decryptor usage example:

 ----------------------------------------------- 
|       Cyclone's Phantom Vault Decryptor       |
| https://github.com/cyclone-github/phantom_pwn |
 ----------------------------------------------- 

Vault file:     hash.txt
Valid Vaults:   1
CPU Threads:    16
Wordlist:       wordlist.txt
2024/11/30 14:11:35 Working...
{"encryptedKey":{"digest":"sha256","encrypted":"5pLvA3bCjNGYBbSjjFY3mdPknwFfp3cz9dCBv6izyyrqEhYCBkKwo3zZUzBP44KtY3","iterations":10000,"kdf":"pbkdf2","nonce":"NZT6kw5Cd5VeZu5yJGJcFcP24tnmg4xsR","salt":"A43vTZnm9c5CiQ6FLTdV9v"},"version":1}:password
2024/11/30 14:11:39 Decrypted: 1/1 6181.36 h/s 00h:00m:03s

2024/11/30 14:11:39 Finished

Decryptor supported options:

-w {wordlist} (omit -w to read from stdin)
-h {phantom_wallet_hash}
-o {output} (omit -o to write to stdout)
-t {cpu threads}
-s {print status every nth sec}

-version (version info)
-help (usage instructions)

./phantom_decryptor.bin -h {phantom_wallet_hash} -w {wordlist} -o {output} -t {cpu threads} -s {print status every nth sec}

./phantom_decryptor.bin -h phantom.txt -w wordlist.txt -o cracked.txt -t 16 -s 10

cat wordlist | ./phantom_decryptor.bin -h phantom.txt

./phantom_decryptor.bin -h phantom.txt -w wordlist.txt -o output.txt

Decryptor credits:

• Shoutout to blandyuk for his help with research - https://github.com/blandyuk
• https://github.com/renfeee/spl-token-wallet/blob/master/src/utils/wallet-seed.js

Compile from source:

• This assumes you have Go and Git installed
  • git clone https://github.com/cyclone-github/phantom_pwn.git
  • phantom_extractor
  • cd phantom_pwn/phantom_extractor
  • go mod init phantom_extractor
  • go mod tidy
  • go build -ldflags="-s -w" .
  • phantom_decryptor
  • cd phantom_pwn/phantom_decryptor
  • go mod init phantom_decryptor
  • go mod tidy
  • go build -ldflags="-s -w" .
• Compile from source code how-to:
  • https://github.com/cyclone-github/scripts/blob/main/intro_to_go.txt

[freeordead]

Hi, first of all thank you for creating this tool - i've been trying to get into a phantom wallet I had on an old desktop hard drive all year with different methods to no avail. I'm not a coder/developer so all this stuff is a little foreign to me and after spending the evening watching different tutorials i've hit an impasse. when i try to run phantom_extractor.go in visual studio code, I receive: Error: Phantom vault directory is required I'm using windows and know the directory is "C:\Users$USER\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa" but i'm not sure where to define or include that in the .go file

if anyone can point me towards a solution or a more cohesive tutorial for beginners to this stuff i would be forever greatful. thanks!

[cyclone]

Make sure you read through all the information in the GitHub repo as it gives specific details on how to compile and run the toolset. The .go file is the source code which only needs compiled and run.
https://github.com/cyclone-github/phantom_pwn

Double check you have the wallet location in your command.
ex:

phantom_extractor.exe "path_to_your_wallet\bfnaelmomeimhlpmgjnjophhpkkoljpa"

[freeordead]

thanks for this, i've managed to get the extractor compiled but based on the readme/github writeup i'm not sure what my next steps would be, it looks like an .exe file was created in the phantom_pwn directory. here's what i see right now: https://imgur.com/a/51OXTuw

i might be in over my head on this, hate to be a bother but any direction would mean the world, i really have tried to decipher the writeups and i'm just not sure what commands i'm looking for.

[cyclone]

DM sent.

[cyclone]

Fixed issue with Windows new line control characters, plus added several performance optimizations.
Source code:
https://github.com/cyclone-github/phantom_pwn/tree/main/phantom_decryptor
Release:
https://github.com/cyclone-github/phantom_pwn/releases/tag/v0.1.5
Issue Resolved:
https://github.com/cyclone-github/phantom_pwn/issues/6

[freeordead]

shoutout to @cyclone !! he spent a good chunk of time and helped me recover the seed phrase for a wallet i've been trying to recover over the past year - true professional, much love g

[billyjon123]

Hi @cyclone its billy from before can you help me recover seed phrase for a phantom wallet?

[cyclone]

@billyjon123 I recognize your username from GitHub. DM sent.

[cryptuhstonks]

Hi Cyclone,

Thanks for creating this tool. It looks like I've almost got it but not quite. I get "Error opening Vault" but It did spit out a hash and I manged to get the hash into a txt document. The only problem is it can't decrypt. I'm assuming there is something I'm doing wrong or the vault I'm trying to access is corrupted. I also tried with your test hash and wasn't able to decrypt that either. I'm on macos. Sequoia. Once again thank you for your time, any help would be appreciated.

[cyclone]

@cryptuhstonks Read through this GitHub issue and DM me if you run into any snags.
https://github.com/cyclone-github/phantom_pwn/issues/14#issuecomment-2613081472

[cyclone]

Updated source code of phantom_extractor v0.3.3-2025-02-04 has been uploaded which now supports hashcat modes 30010, 26650 and 26651. While those hashcat kernels are not publicly released, the tool can be used to extract Phantom wallets for them.

[John]

@cyclone said in phantom_pwn - Phantom Vault Extractor & Decryptor:

30010, 26650 and 26651

Without these cores the program won't work? I understand it works in conjunction with hashcat?

[cyclone]

@John phantom_extractor extracts the Phantom wallet vault into compatible hashes for either phantom_decryptor or hashcat modes 30010, 26650, 26651. Keep in mind, I do not own those hashcat kernels, so if you need them, you'll have to purchase them directly from the developers.

[ar7s]

Hey my ffriend! thanks for that tool, you are awesome. Can you please help me a little bit? i have done almost everything but im not sure if i need to know my password in order to unlock the wallet or to recover the seed phrse.

thanks in advance

[ar7s]

hey there, where can i dm you

[cyclone]

@ar7s DM sent.

[rickyc2024]

@cyclone I wanted to speak with you about your vault decryptors. I am currently working on a vault decryptor for solflare wallet but I have had some issues with decrypting the vault data with secretbox as it dosen't seem to be encrypted with the wallet password. Can we speak in dms?

[rickyc2024]

I also noticed that the structure of solflare vault data is almost identical to the structure of phantom but it doesn't seem to be using the wallet password.

[cyclone]

@rickyc2024 DM sent.