You found the file. Maybe it was on a hard drive you haven’t plugged in since 2016, in a folder you almost deleted, or in a cloud backup you’d forgotten about. A .wallet or .wallet.aes file and possibly Bitcoin attached to it.
Finding the file is actually the hardest part for most people. What comes next is more predictable: extracting the private key, and moving the funds to a wallet you control today. This guide focuses on exactly getting from file to swept funds without rehashing every possible recovery scenario from scratch.
Before You Do Anything Else: Make Two Copies
This is the only rule that matters more than the steps that follow. Copy the file to two separate locations: a USB drive and a cloud folder, or two different drives before running any tool against it. Recovery attempts, especially decryption scripts, should always operate on a copy.
If the original file is on a drive that’s been sitting in a drawer for years, check whether it mounts correctly first. Old spinning drives sometimes fail on the second or third read, not the first. Clone it immediately if you have any doubt about its reliability. On Windows, Macrium Reflect Free does this without requiring a paid licence. On Linux, ddrescue handles failing drives better than most other tools because it retries bad sectors systematically rather than aborting.
Once you have two copies stored safely, you can proceed without the risk of an irreversible mistake.
Identify What You’re Working With
The file extension tells you which version of MultiBit created it, and that determines everything about what comes next.
• A .wallet file (no additional extension) is a MultiBit Classic wallet. It contains one or more private keys stored directly in Google’s Protocol Buffer format. If you set a password at the time, those keys are AES-256 encrypted inside the file.
• A .wallet.aes file is a MultiBit HD wallet. The entire file is encrypted. If you have the password, you can decrypt it and access the seed phrase inside. If you don’t, but you have the seed phrase written down somewhere, you can bypass the file entirely.
If you’re not sure which you have: Classic files are typically found as standalone .wallet files in a MultiBit folder. HD wallets are usually inside a folder with a name starting with ‘mbhd-‘ followed by a long string of characters that folder contains the .wallet.aes file along with supporting files. Keep the whole folder if you find one.
Recovering a MultiBit Classic .wallet File
Classic MultiBit wallets store private keys in Protocol Buffer format. If the wallet was not password-protected, the keys can be extracted directly. If it was password-protected, you need the original password first there is no other way in.
Unencrypted Classic wallet
An unencrypted .wallet file can be read with tools that understand the Protocol Buffer format. The most commonly used approach is to run the file through a Python script that parses the protobuf structure and outputs the private keys in WIF (Wallet Import Format) the format that modern wallets accept for imports.
Do this on an offline machine. Once you have the WIF key, import it into Electrum (downloaded only from electrum.org) using the ‘Import Bitcoin addresses or private keys’ option when creating a new wallet. Electrum will scan the blockchain and show you the associated balance.
Password-protected Classic wallet
If the wallet was encrypted, you need the password before any key can be extracted. The decryption is AES-256 without the correct password, the file contents are inaccessible. There is no workaround.
Write down everything you remember about the password before running anything: structure, length, capitalisation habits, numbers or years you used at the time, any words that were important to you. A partial memory is far more useful than an exhaustive random search. BTCRecover is the standard open-source tool for this, it runs locally and tests candidate combinations against the file. The MultiBit wallet recovery guide explains how to configure it correctly.
How to Sweep a MultiBit Private Key
Importing a private key and sweeping it are different operations, and for old MultiBit wallets, sweeping is the right choice. An import keeps the original key active in your wallet, which means it can be exposed again if that wallet is ever compromised. A sweep moves all funds from the old key to a fresh address in your new wallet the old key is effectively retired.
Step-by-step sweep in Electrum
- Download Electrum from electrum.org only. Verify the GPG signature if you know how. Create a new standard wallet with a fresh seed phrase. Write the seed phrase down on paper and store it separately.
- Once the new wallet is set up, go to Wallet → Private Keys → Sweep.
- Paste the WIF private key from your Classic wallet into the field provided.
- Electrum will show the balance associated with that key. Review it before proceeding.
- Set a fee. Check the current recommended fee rate at mempool.space fees have changed significantly since MultiBit was in use, and underpaying can leave a transaction stuck for days.
- Broadcast. The funds will arrive in your new wallet once the transaction confirms.
The sweep transaction is irreversible once broadcast. Confirm the destination address and fee before clicking send.
What to do if the balance shows zero after import
A zero balance after importing a private key almost always means one of two things: the key belongs to an address that was never funded, or Electrum is looking at the wrong address format. Classic MultiBit used legacy Bitcoin addresses (starting with 1). If Electrum is configured to show native SegWit addresses, it may not display the balance until you switch the address format in the settings.
If the address format is correct and the balance is still zero, check the address on a blockchain explorer like mempool.space to confirm whether funds ever arrived there and whether they’ve already been moved.
Recovering a MultiBit HD Wallet With Your Seed Phrase
If you have your 12 or 18-word seed phrase from a MultiBit HD wallet, you can potentially recover funds without touching the .wallet.aes file at all but there is a complication that catches almost everyone.
MultiBit HD used a non-standard derivation path. Most modern wallets, including Electrum with default settings, will generate different addresses from the same seed phrase and show a zero balance not because the phrase is wrong, but because they’re looking in the wrong place on the blockchain.
The correct derivation path for MultiBit HD
In Electrum, when importing your seed phrase, click Options on the seed entry screen and check the BIP39 box. If the balance still shows zero, go to Wallet → Information and manually set the derivation path to m/0’/0. This is the path MultiBit HD used, and it’s the most common reason a correct phrase returns nothing in a default import.
Check each word carefully before concluding the phrase is wrong. A single character difference, a typo, a word from the wrong line on a piece of paper makes the entire phrase invalid. The BIP39 word list only contains 2,048 words, so if a word in your phrase doesn’t appear on that list, it’s either misspelled or from a different wordlist entirely.
If the seed phrase is incomplete
Missing one or two words from a 12-word BIP39 phrase is a solvable problem in most cases the checksum built into the seed format eliminates most candidate combinations before you test them. The what-is/bip39-wordlist page has more detail on how the checksum works and what it means for partial recovery.
Dealing with a seed phrase where something’s off wrong balance, missing words, unclear derivation path? Crypto Recovers has worked through these scenarios across hundreds of MultiBit HD wallets. Request a free assessment and get a clear picture of what’s recoverable before you spend time on approaches that won’t work.
Recovering a Deleted MultiBit Wallet File
Deleting a file doesn’t erase its contents immediately; it marks the disk space as available for reuse. If the drive hasn’t been written to heavily since the deletion, the data is likely still there. The window for recovery narrows the more the drive has been used afterwards.
Stop using the drive now. Every write operation risks overwriting the sectors that contain your wallet file. If the drive is a system drive that’s actively in use, the chances of recovery drop with every minute it stays running.
Clone the drive before scanning
Before running any file recovery tool, clone the drive to an image file. This gives you a preserved copy of the disk state to work from, and means you can retry the scan if something goes wrong. On Windows, use Macrium Reflect Free. On Linux or macOS, ddrescue is the better option, it handles read errors on degraded drives more gracefully and logs which sectors it couldn’t read, which matters for older hardware.
Run all subsequent steps against the cloned image, not the original drive.
Scanning for .wallet files
Recuva (Windows) and PhotoRec (cross-platform, free) are both capable of finding .wallet files by extension and file signature. Configure the scan to look specifically for .wallet and .wallet.aes extensions, and direct the output to a different drive than the one you’re scanning.
If the scan returns the file, verify its size before doing anything with it. A .wallet file that’s only a few bytes has likely been partially overwritten and may not be usable. A file at a plausible size typically several kilobytes to a few hundred kilobytes is worth attempting to open.
If the file is damaged or partially overwritten
A partially recovered .wallet file may not open cleanly. Some corruption is sometimes repairable depending on which part of the file was damaged, the header region matters more than trailing data for Classic wallets. This is territory where the tooling required goes beyond what’s available in standard recovery software, and where professional data recovery specialists are likely to be more effective than additional DIY attempts.
What Not to Do With an Old MultiBit Wallet File
A few mistakes are common enough to be worth stating directly.
- Don’t download MultiBit from anywhere other than an archived, verified source. Unofficial MultiBit downloads found through search engines frequently contain malware designed to capture wallet files and passwords silently. The original software is no longer distributed by its developers.
- Don’t enter your private key or seed phrase into any website. There is no legitimate online tool that needs your private key to help you recover funds. Any site asking for it is designed to steal them.
- Don’t run recovery tools on the original file. Always work on a copy. This applies to decryption scripts, file repair tools, and anything else that touches the wallet data.
- Don’t broadcast a sweep transaction without checking the fee. Bitcoin network fees in are not what they were in 2015 or 2016. An underpaid transaction can sit unconfirmed indefinitely.
Frequently asked questions
Technically possible in some cases, but not recommended. The original MultiBit software is no longer maintained, its download links are gone from the official site, and many versions found through search results have been modified to steal wallet data. Extracting keys through a Protocol Buffer parser or using BTCRecover for password recovery is safer than running the original application.
It may be, but not necessarily beyond use. Start by checking the file size. A file under 1 KB is probably incomplete. A file at a normal size that won’t parse may have a damaged header this is sometimes repairable, depending on which bytes were affected. A completely overwritten file is a different problem and generally not recoverable through software tools alone.
Under normal network conditions, a Bitcoin transaction with an adequate fee confirms within one to three blocks roughly 10 to 30 minutes. If you set a low fee, the transaction may take hours or days to confirm, or may never confirm if fees rise significantly after broadcast. Use mempool.space to check current recommended fee rates before broadcasting.
The format hasn’t changed, so the age of the file doesn’t affect whether it can be parsed. What it does affect is the address format. Very early MultiBit Classic wallets used compressed and uncompressed public keys, which produce different Bitcoin addresses from the same private key. If you import a key and see a zero balance, try the alternative address format. Both should be checked before concluding the wallet is empty.
If you’ve found the file but the steps above haven’t resolved things wrong balance, decryption failing, partial data Crypto Recovers offers a free initial assessment. No Cure No Pay.
