Micro Soldering Supply

Blog | Micro Soldering & Component Level Board Repair Tips

Recovering a Mycelium BTC wallet from a dead Android Phone

Published / by Jason / 9 Comments on Recovering a Mycelium BTC wallet from a dead Android Phone
Rusted screws.

This is an old school LG G3 that was sent in completely dead. The screws on the back of the phone show significant rust indicating that it was dropped into water at some point. Definitely explains why it won’t turn on!

Phone disassembled.

I have gone ahead and removed the motherboard from the phone. I will be using the chip off method to access the data and recover the wallet.

The EMMC chip is surrounded by potting epoxy.

On the back of the motherboard is the EMMC chip where all the data is stored. It’s encased in a special black potting epoxy all around it to protect it. The epoxy has to be removed first before the chip can be desoldered from the motherboard, so here I have begun to scrape away at it from the sides.

Tools being used to remove the EMMC chip.

To remove the potting epoxy and desolder the EMMC chip so it can be read from I have a setup with a microscope, hot air soldering station, and other assorted soldering irons.

Desoldered the EMMC chip from the motherboard. Lots of potting epoxy underneath it.

The EMMC chip has been desoldered from the motherboard now. Here you can see a better view of the black potting epoxy that has been used to encase the chip. The silver pads beneath where the chip used to go are the pads on the motherboard that connect to the chip.

Cleaning up the EMMC chip for reading.

I put the chip into a vise so I can begin cleaning it up and removing any left over potting epoxy and solder. Unfortunately I didn’t get any photos of this stage but it was pretty messy anyways.

EMMC chip on top of a US dime.

Here it is all cleaned up and ready for reading. You can see it is barely the size of a dime!

The EMMC reader.

The EMMC chip then goes into this EMMC reader to read the data directly from the EMMC chip.

Beginning the actual data recovery process.

Now we can plug the reader into the computer and begin exploring the filesystem.

Locating the Mycelium wallet in the filesystem.

Android apps typically store data in the /data/com.myApp location, not accessible to the user unless they have root access. Within the app’s storage there is a databases folder that contains some SQLite databases with the data the app stores. Here I have gotten access to the Android filesystem using UFS Explorer and located the com.Mycelium.wallet folder and the databases within it.

A Moto G4 that was lying around the shop. Perfect for my needs!

The tricky part will be getting the data from the app’s database into something I can use, like a private key. I quickly opened up the databases in an SQLite database GUI but did not find anything that immediately indicated a private key of sorts. However, I decided that in the unlikely chance that Mycelium does not encrypt the private keys (more on this later), I could simply copy the database onto a working device and see if Mycelium would open it for me instead of having to parse through the database and search for the private keys manually.

Unlocking the bootloader, made easy thanks to Motorola.

Since the app’s folder and databases are hidden from normal users in the Android filesystem, I would have to get root access in order to copy the recovered databases over to the working phone. Luckily though there was a Moto G4 running Marshmallow at the shop, so unlocking the bootloader and rooting the device was about as simple and straightforward as it could get.

Getting root access with TWRP and SuperSU!

One swipe later and I was officially a super user! I copied over the recovered database folder to a microSD and put it into the phone.

Copying over the recovered Mycelium wallet database.

And then downloaded Mycelium wallet and Solid Explorer from the Play store. Once they were installed I created a new wallet in Mycelium and then navigated to the /data/com.Mycelium.wallet folder in Solid Explorer.

Placing the recovered databases into the Mycelium app folder.

Then the recovered databases can be pasted into the folder. Now, will Mycelium open them?

It works! Crypto lives on 🙂

YES! The wallet has been recovered! I now have full access to the private keys and can transfer them to cold storage or another wallet. That .5157 BTC wasn’t worth more than a few hundred dollars when the LG G3 was first released in 2014, but it certainly makes for a worthy recovery job today!

For better or for worse, I suspect the main reason why I was able to recover the wallet relatively easily once I had access to the old filesystem was due to: a) That Mycelium does not encrypt the private keys even when a PIN is set, or b) The decryption keys are stored with the private keys.

While it is less of a problem now that Android encypts the filesystem by default since Nougat, if a root exploit was to be released today then it would be extremely easy to extract the database from a victim’s device and copy it over to an attacker’s device, even with a PIN set in the app. Therefore I would caution all Mycelium wallet users to keep their devices up to date with security patches and don’t root them either.

BTC donations: 14YEMTwwbp1ELHqrxgRzt6uV1cE8pQZoFq

ETH donations: 0xb3de582ac74d3b08f1b667b165e71cbc0290f415

LTC donations: LcVoYM2EdbTCVNmMaBrSQBstZdkPVudaWr

XMR donations: 45StJrEa47G2UAXJi2DsvJMzMy9QZsjD89RKFZfWNuY2CaFWog4ixnwBBkxZKJVLcqggsyd1euYW56wV4QXn8zWRSbJVBFV


  1. Truly remarkable post, Jason. Albeit a few minor differences, your research nearly 100% covers my exact circumstances, which after months of pouring over any mention of the issue in so-so attempts to compile a similar outline myself, suddenly discovering it all here, in one place, was definitely a real breath of fresh air.

    Thank you! I’ll certainly donate to you guys upon successfully recovering my BTC.

    The wallet I’ve been trying to recover is located on my Moto G4 Play (XT1607, Harpia), which unfortunately has a locked bootloader, and thus is not rooted either. I did however find local data recovery specialists who managed to pull the relevant application data from the device, but I too didn’t ultimately find anything seemingly useful upon browsing the sqlite databases. So yeah long story short, a potential solution to my current situation, in theory, would be to unlock/root the device, and then transfer the extracted data as per your description above?

    Thanks again!

    1. Jeff, if it is a mycelium wallet then yes you should be able to copy it to a working device with the app installed.

  2. The security by obscurity principle was a joke in days of Windows 95. Mycelium has cost me about $1K with this crap and I am not amused. Plus both Apple and Samsung play in this game with backups that only record the data they wish to sell to advertisers. If you root “your machine” (ie the one you have paid for but signed away the rights to ) then you are screwed, (hey almost as though somebody had panned it ) and if you don’t root it, your files are gone, along with your Mycelium key. Thanks Big Brother!

  3. I have a question.
    I don’t know much about bitcoins ..
    But my husband has a wallet through mycelium
    And he has lost his pin and he misplaced his words to be able to recover his wallet.
    He currently has the downloaded app open on his android phone.. is there a way to obtain the keywords or pin?
    Would you be able to help out?

  4. Very creative solution!

    I’m hoping you can point me in the right direction. I have a Samsung Note 4 that died, taking precious images, my contacts, conversations, and app data. No viable backup it turns out. I replaced the mobo in it, phone works fine, but of course all of my content is in the system memory on the failed board.

    Perhaps the replacement board could be used as a “donor” if I knew how to diagnose which component(s) went bad, and had SMD gear for reworking, but I have neither. Ideally I’d like to recover the drive image and install on another phone.

    Any ideas? I’ve tried “repair” shops, even Samsung, they all say no way to get my data back, just want to replace the mobo.


Leave a Reply

Your email address will not be published. Required fields are marked *