**TL;DR** — A trader recovered $400k of Bitcoin by handing his old files to Claude. The headline is "Claude tried 3.5 trillion passwords." The actual breakthrough was much smaller and much more interesting: Claude found a bug in the brute-force tool everyone else was already using. That tells you a lot more about where AI agents earn their keep right now than the trillion-password number does. ## The story, briefly An X user named [@cprkrn dumped his old college hard drive into Claude](https://www.tomshardware.com/tech-industry/cryptocurrency/bitcoin-trader-recovers-usd400-000-using-claude-ai-after-losing-wallet-password-11-years-ago-bot-tried-3-5-trillion-passwords-before-decrypting-an-old-wallet-backup) after burning eleven years and a lot of `btcrecover` runs trying to remember the password to a 5 BTC wallet — a wallet he had locked himself out of, drunk, in 2014. `btcrecover` is the standard open-source brute-force tool for exactly this. People have been running it on lost wallets for a decade. He had been running it on his wallet. It didn't work. Two things actually unlocked the 5 BTC: 1. Claude noticed there was an older backup wallet file from December 2019 — pre-dating the password change — sitting in the folder. 2. Claude noticed that `btcrecover`, the tool the trader had been running for years, had a bug in how it combined shared keys with candidate passwords. After Claude patched that bug, the brute force finally produced a decrypt. The 3.5-trillion-passwords number happened *after* the bug fix. Before the fix, no amount of compute was going to crack it. ## Why the headline number is misleading If you read only the title, the takeaway is "AI is now powerful enough to try trillions of things until something works." That framing makes this story sound like a hardware story — faster brute force, cheaper compute, scale wins. It isn't. The actual workflow was much smaller-shaped: - **Read this folder.** Eleven years of forgotten files. - **Notice anything weird.** An older wallet backup. Curious. - **Read this tool.** `btcrecover`, ~10k lines of Python the user didn't write. - **Notice anything weird.** The shared-key + candidate-password combination is off. - **Fix it.** Patch. Re-run. That sequence — *read a directory you didn't create, then read a tool you didn't write, then notice the load-bearing inconsistency between them* — is the modal agent task in 2026. It's not "search a trillion-element space." It's "find the one wrong assumption nobody has tested in years." ## The substitution that's actually happening I keep seeing people frame AI agents as a substitute for engineering effort. That framing is too coarse. What's actually being substituted is something narrower: **the cost of reading code you don't own**. For years, the rational thing to do when a community tool didn't work was to file an issue, wait, switch tools, or give up. Reading ~10k unfamiliar Python lines, building a mental model, and finding a subtle bug used to cost more (in hours and frustration) than the expected value of fixing it, *unless* the tool was core to your work. That math is now broken. The cost of "let an agent read this entire codebase and tell me where it's wrong" has collapsed by an order of magnitude. The expected value of fixing a one-line bug in someone else's tool — when the payoff is on the order of a forgotten Bitcoin wallet, or a stuck production deploy, or a slow ETL — is wildly higher than the cost of looking. The 5 BTC didn't get recovered because Claude is smart. The 5 BTC got recovered because reading `btcrecover` cost almost nothing. ## What this means for the work I'm actually doing I've been building MCP servers and agent-driven plumbing for the last year. The pattern in this story is the one I see in my own dogfooding constantly. The high-leverage agent tasks aren't the demo-friendly ones: - It's not "write me a new ETL pipeline." It's "read this 3,000-line legacy SQL view and tell me why the daily numbers drifted last Tuesday." - It's not "build me a brute-forcer." It's "read `btcrecover` and tell me why my specific wallet won't yield." - It's not "design my schema." It's "look at the 14 migration files in this repo and tell me which one introduced the FK that's now blocking my insert." Every one of those is a "read someone else's artifact, find the one wrong assumption" task. The agent isn't out-thinking a human; it's reading at human-impossible speed. That has a practical consequence for how I scope my own contract work. Clients who come to me with "build us this new thing" are interesting. But the higher-value calls so far have been the opposite shape: "we have this thing, it works most of the time, find the part that's quietly wrong." Those took weeks of human investigation in 2023. They're often half a day of agent + human-review in 2026. ## Why this matters The Bitcoin story is fun precisely *because* the number is so big. Three and a half trillion passwords. Eleven years of locked money. Four hundred thousand dollars unlocked by a chatbot. But the takeaway isn't about brute force. It's about the cost of curiosity dropping to roughly zero. The economically interesting agent work right now is reading the code, configs, and artifacts already sitting in your filesystem that nobody has had the time or patience to fully audit. That's not a sci-fi superpower. It's a clerical superpower, applied at a scale that used to be unaffordable. And those two framings produce very different bets about what to build next.