phantom_pwn - Phantom Vault Extractor & Decryptor

[immolatje]

@cyclone Hello!, I'm trying to regain access to my Phantom wallet after reinstalling Windows and forgetting to save my seed phrase. Using the Windows.old files and your guide, I’ve walked through the process up to the decryption step. What should I do next to recover the seed phrase? Thank you.

[cyclone]

@immolatje Make sure to read through these posts as I've posted a complete walk-through on github. On Phantom wallets, recovering the wallet password is the 1st step of a multi-step process.
https://forum.hashpwn.net/post/601

Phantom crypto wallet passwords recoverable with my phantom_pwn toolset. The seed phrase is also recoverable once the password has been recovered, but is a multi-step process as described on my GitHub writeup.

Read through this GitHub issue (walkthrough) and DM me if you run into any snags.
https://github.com/cyclone-github/phantom_pwn/issues/14#issuecomment-2613081472

[John]

@immolatje To extract the mnemonic from the hash, you also need a hash to decrypt the second level of encryption. In your screenshot, only level 1 has been completed. You can simply import the Phantom files into your browser and log in with a password to access the seed phrase in your wallet.

[cyclone]

New release: phantom_pwn v1.0.0
https://github.com/cyclone-github/phantom_pwn/releases

[gangstermate]

Hi. I have a question, is it possible to automatically export the private key of the wallet we unlocked using your tool? Or the mnemonic by any chance.

I cannot send @cyclone a DM because my reputation is too low.

[blacktest]

What should be the format of teh password as i can see my password is helloWorld but when i decrypt same in python all same metho itt doesn't decrypt that for phantom

[cyclone]

@blacktest
This toolkit is written in Go, so I'm not sure what Python you're referring to.
The info you're requesting is in the GitHub README and first post of this topic. Upon successful decryption, the tool will print out a string with "{json}:{password}".

 ----------------------------------------------- 
|       Cyclone's Phantom Vault Decryptor       |
| https://github.com/cyclone-github/phantom_pwn |
 ----------------------------------------------- 
...
2025/10/22 14:11:35 Working...
{"encryptedKey":{"digest":"sha256","encrypted":"5pLvA3bCjNGYBbSjjFY3mdPknwFfp3cz9dCBv6izyyrqEhYCBkKwo3zZUzBP44KtY3","iterations":10000,"kdf":"pbkdf2","nonce":"NZT6kw5Cd5VeZu5yJGJcFcP24tnmg4xsR","salt":"A43vTZnm9c5CiQ6FLTdV9v"},"version":1}:password
2025/10/22 14:11:39 Decrypted: 1/1 6181.36 h/s 00h:00m:03s
...

[kayso]

Hi cylone your tool was absolutely helpful the issue im having though is my phantom had other passwords and the password i have only lets me into 1 of the many wallets i have. is there a way for me to find the passwords for the other vaults as ive tried all variations and nothing cracks?

[kayso]

also one last thing, i am almost certain the pass variations im using are correct so is there anyway for it to still not decrypt despite having the right passwords ?

[cyclone]

@kayso
Phantom only has one password per wallet vault (similar to MetaMask), so if some wallets aren’t unlocking with your password, they’re likely from a different vault / browser profile, etc, and the password is not the issue.

Also answered on Github:
https://github.com/cyclone-github/phantom_pwn/issues/24

[kayso]

yes i know its multiple vaults. I have 6 vaults in total and only 1 vault will unlock with wordlist. is there perhaps something wrong with the vault itself ect and is there any way to resolve this issue (the wordlist contains all possible passwords so password is not the issue)