Two Password Attempts From 7,002 BTC: The Stefan Thomas IronKey Story

7,002 bitcoin. One IronKey flash drive. Ten password guesses, and eight were already gone. It is the true story of Stefan Thomas, a German-born programmer who made worldwide headlines in January 2021: a fortune worth hundreds of millions sat inches away, behind a password he could no longer remember.

A video that earned 7,002 bitcoin

The story begins in 2011, when Bitcoin was still a fringe experiment known only to a small online community, and a single coin cost almost nothing. The early community needed a film explaining Bitcoin to ordinary people, and the job went to Thomas, a German-born programmer who by 2021 was chief technology officer of payments company Ripple.

He made the explainer video, titled "What is Bitcoin?", and was paid in bitcoin — 7,002 coins in all. In 2011 it looked like little more than a token payment for his work. A decade later, it may be the most famous paycheck in crypto history.

The key, locked inside an IronKey

Like many early holders, Thomas did not leave the coins on an exchange. He stored the wallet's private key on an IronKey, an encrypted USB flash drive designed for strong security.

That security comes with a brutal catch. After ten consecutive wrong passwords, the IronKey encrypts itself permanently and the data becomes unrecoverable. There is no back door, no "forgot password" link, and no support line to call. Designed to keep thieves out, it was about to lock out its owner instead.

Ten guesses — why only two were left

The problem was as ordinary as it gets: Thomas forgot the password. He tried every candidate he could think of and watched the counter tick down. By January 2021, when The New York Times interviewed him, he had used eight of his ten attempts, with just two left.

He tried everything, including hypnosis, hoping to dredge the characters from his subconscious. He dared not type guesses casually; a tenth failure would be final, with no one able to undo it. At bitcoin's high prices then, the stash was worth more than $280 million. Retold worldwide, the tale of a fortune two password attempts away became the strangest footnote of that roaring bitcoin bull market.

His state of mind, and what came after

On camera, Thomas was not the broken man audiences expected. Later, he said he had made his peace with the locked-up fortune: the harder he stared, the more elusive the password grew, so he accepted it and moved on. The story, he said, was never really about losing money, but about memory and backups.

His case is often paired with James Howells, the other famous bitcoin unfortunate, but the two differ fundamentally. Howells accidentally threw away the hard drive holding his keys; it ended up buried in a landfill. Thomas's device still works and the coins were never lost or stolen; only a passage in his own memory stood between him and the money.

The lesson: never let one password guard everything

Every crypto holder gets a free masterclass in backups from this story. A seed phrase or private key that exists in only one place, on one medium, anchored by one memory, is a single point of failure waiting to happen. Sound practice looks like this:

• Keep several physical copies of your seed phrase, stored in separate locations;
• use durable media such as metal seed-phrase plates that resist fire, water, and corrosion;
• store only hints you would understand in a password manager — never the plain-text phrase;
• don't put every asset on one encrypted device or let one password be the only door in.

For a step-by-step approach, this seed phrase and private key backup guide covers the basics. An afternoon spent on backups beats a lifetime staring at a drive that will never open again.

Frequently asked questions

Did he ever unlock the IronKey?

No confirmed unlock exists in the public record. When The New York Times reported the story in January 2021, two attempts remained, and Thomas never publicly confirmed recovering the password.

How many bitcoin were on the drive?

The key controls a wallet holding 7,002 bitcoin, his payment for the 2011 "What is Bitcoin?" video. At bitcoin's high prices at the time, the stash was worth over $280 million.

Why can't anyone simply brute-force it?

The IronKey allows only ten attempts and then locks the data forever, nowhere near enough guesses for brute-forcing. Its built-in encryption also defeats hardware tricks such as removing the chip or bypassing verification.

How is this different from James Howells's lost hard drive?

Howells physically lost his drive in a landfill. Thomas still has his, fully working, and the bitcoin was never lost. One man can't find his keys; the other can't get past his own front door.

Risk warning

In crypto, no help desk can reset your password. A forgotten passphrase, a lost seed phrase, or a broken device can leave assets permanently inaccessible, with no appeal or reversal.

Risk warning: Control of cryptocurrency, and responsibility for safeguarding it, rests entirely with the holder. If a private key or seed phrase is lost, destroyed, or forgotten, the assets usually cannot be recovered. This article is a historical retrospective and does not constitute investment advice; the facts are based on public reporting, including The New York Times.