Overwritten Crypto Wallet Key Recovered
Device:
MacBook Air
Asset:
Self-custody crypto wallet (NEO/Neon wallet)
Estimated Value at Risk:
Approximately £72,000 in cryptocurrency
Problem:
Private key was overwritten during editing/copy/paste
Key Location:
Apple Notes (stored as text)
A customer suddenly lost access to a cryptocurrency wallet containing approximately £72,000 after updating a note on their computer. They had been keeping wallet credentials inside the Notes app. During an edit, which was likely a copy-and-paste operation, the private key was accidentally overwritten.
The customer reported minimal use of the device after the mistake and had not attempted to use DIY recovery tools, which helped preserve the best possible chance of crypto recovery.
Crypto keys don’t allow for “close enough.” A single incorrect, missing, or extra character can prevent access entirely.
In this case, the customer overwrote the original private key in Notes with a similar but truncated version, so the visible note could no longer be trusted. The best chance of success was to look beneath the Notes interface and into the artifacts created by the app’s underlying database, where prior versions of edited text can sometimes remain.
The engineering team examined relevant Notes artifacts at a low level and searched for candidate strings consistent with the expected private-key pattern. In this way, the team located multiple instances of a candidate key that fit the expected structure and appeared to be an earlier, uncorrupted version.
In crypto recovery, validation is everything. A key is only “recovered” when it can be proven correct.
The customer regained access to their wallet and confirmed the recovered key worked as expected.
I had to get creative and perform a raw hex analysis of the drive to locate previous versions of the Notes database entries. After identifying possible private key fragments in unallocated space, I validated them against the customer’s known public key and unlocked the wallet.
– Will DeLisi
DriveSavers Data Recovery Engineer
When a key is overwritten, it may be gone from the “front end” view. But apps like Notes often rely on databases that generate working files and recent-change artifacts. Even if the final, visible note is wrong, traces of earlier text can sometimes persist underneath—especially when the device hasn’t been heavily used afterward.
If you’re curious why this isn’t as simple as searching for a text file or document:
If you suspect you overwrote or corrupted a private key:
Stop Using the Device: New activity can overwrite residual artifacts that may still contain earlier text.
Do Not Make Further Edits: Repeated copy/paste or “fixing” the key can destroy what remains of the prior version.
Preserve Verification Details: If you have the public key/address recorded elsewhere, keep it—it can help confirm that the correct private key is found.
Next Step: Preserve the device in its current state and collect any remaining wallet identifiers (public key/address, wallet app name/version, where the key was stored). Then call DriveSavers. Data Recovery Advisors are available 24/7.
English (United States) 
English (Australia) 
French (France) 
English (UK) 
French (Canada) 
English (Canada) 
Spanish (Mexico) 
German 
Dutch 
Italian 
Finnish 
Polish 
Norwegian 
Swedish 
Danish 
Spanish (Spain) 
Chinese 
Japanese 
German (Austria)