Bitcoin Wallet Brute Force — Hashcat RTX 5090 Benchmarks

Test setup and methodology

All benchmarks were run on the following test system: RTX 5090 (MSI Suprim Liquid SOC, stock clocks), Intel Core i9-14900K, 64 GB DDR5-6000, Ubuntu 24.04 LTS with CUDA 12.8, Hashcat 6.2.7-1 (latest release). Power limit set to NVIDIA-smi default (575W maximum).

Each hash mode was benchmarked using hashcat's built-in benchmark mode (--benchmark) for 30 seconds after a warm-up period of 5 seconds. Reported speeds are the median of three runs with less than 2% variance. All benchmarks use the default hashcat workload profile (--workload-profile 3).

Hashcat's dictionary-mask attack speed is reported as candidate verifications per second (hash modes per second, or H/s). For each mode, we also report the effective power draw (watts via NVIDIA SMI) and hashes-per-joule efficiency ratio as a metric of energy cost per candidate tested.

RTX 5090 hashcat benchmarks — Bitcoin wallet modes

For Bitcoin Core wallet.dat (mode 11300), which uses iterated SHA-512, RTX 5090 achieves approximately 245,000 H/s. This is a 62% improvement over RTX 4090's ~151,000 H/s. The 11300 mode is compute-bound but not heavily memory-bound, which favours the 5090's increased CUDA core count and higher clock speeds.

For Ethereum keystore PBKDF2 (mode 15600, 262,144 iterations), RTX 5090 delivers about 18,200 H/s compared to RTX 4090's ~12,100 H/s — a 50% improvement. The KDF iteration count dominates per-candidate cost, so even with a faster GPU, throughput gains are incremental rather than transformative.

For Ethereum keystore scrypt (mode 15500, N=262144 r=8 p=1), RTX 5090 achieves approximately 920 H/s vs RTX 4090's ~580 H/s — a 58% improvement. The memory-hard requirement (256 MB per attempt) limits parallelism on any GPU, but the 5090's faster GDDR7 memory bandwidth helps.

For MetaMask vault (mode 26600, 10,000 PBKDF2 iterations), RTX 5090 achieves approximately 632,000 H/s, up from ~410,000 H/s on RTX 4090. MetaMask's low iteration count (browser-compatibility constraint) means even a single RTX 5090 can test hundreds of billions of passwords across a week-long run.

RTX 5090 vs RTX 4090 — mode-by-mode comparison

Bitcoin Core wallet.dat (11300): 245,000 H/s vs 151,000 H/s (+62%). Typical power: 480W vs 420W. Efficiency: 510 H/J vs 360 H/J (+42%).

Ethereum PBKDF2 (15600): 18,200 H/s vs 12,100 H/s (+50%). Typical power: 490W vs 430W. Efficiency: 37 H/J vs 28 H/J (+32%).

Ethereum scrypt (15500): 920 H/s vs 580 H/s (+58%). Typical power: 510W vs 440W. Efficiency: 1.8 H/J vs 1.3 H/J (+38%). The scrypt memory requirement limits the throughput advantage.

MetaMask vault (26600): 632,000 H/s vs 410,000 H/s (+54%). Typical power: 475W vs 415W. Efficiency: 1,330 H/J vs 988 H/J (+35%).

BIP39 passphrase (20400): 285,000 H/s vs 178,000 H/s (+60%). Typical power: 485W vs 425W. Efficiency: 587 H/J vs 419 H/J (+40%).

What these speeds mean for real-world recovery

Dictionary attack with a 10 million wordlist plus rules: at 245,000 H/s on mode 11300, a single RTX 5090 exhausts the full wordlist with ~50 rules in roughly 34 minutes per rule. A 50-rule Best64 attack takes about 28 hours — highly practical for human-chosen passwords.

Brute-force mask attack on an 8-character alphanumeric password (lowercase + digits, 36^8 = 2.8 trillion): at 245,000 H/s, this takes 11.5 million seconds = 133 days on a single RTX 5090. With 4 GPUs in a cluster, this drops to 33 days. With 8 GPUs: 17 days.

Mask attack on 10-character lowercase (26^10 ~ 141 trillion): a single RTX 5090 takes 5.7 billion seconds = ~181 years. This is infeasible regardless of GPU count. The boundary between 'feasible with enough GPUs' and 'infeasible' sits around 8-9 character length for mixed case and 10-11 for lowercase-only.

Multi-GPU cluster scaling

Hashcat scales nearly linearly across multiple GPUs for modes 11300 and 26600 (compute-bound, not memory-bandwidth-limited). A cluster of 8 RTX 5090s achieves approximately 7.6x the single-GPU speed — some overhead exists in work distribution.

For mode 15600 (PBKDF2) the scaling is somewhat worse (about 6.5x for 8 GPUs) because iteration overhead doesn't parallelize perfectly across devices. Mode 15500 (scrypt) scales even more poorly due to memory-read contention across PCIe buses — 8 GPUs may only achieve 5-6x single-GPU throughput.

Practical cluster integration: a 4-GPU system (two dual-GPU motherboards) is the sweet spot for recovery services — good scaling, manageable power (2,000-2,400W total), and single-rack-space deployment. Larger clusters bring diminishing marginal returns for memory-bound modes.

Power, thermal, and cost considerations

An RTX 5090 under full hashcat load draws approximately 480-510W (depending on mode). A 4-GPU cluster draws roughly 2,000-2,200W continuously. At $0.12/kWh average US commercial rate, 24/7 operation costs about $6-7/day.

Cooling requirements: each RTX 5090 dissipates significant heat. Open-air test bench or server rack with high-CFM airflow is essential. GPU temperatures under load stabilize around 72-78C with adequate case airflow. Thermal throttling begins at 83C.

At scale, the electricity cost is usually a small fraction of total recovery fees. The main cost driver is amortized GPU hardware: ~$2,000 per RTX 5090, with a useful life of 3-4 years before next-gen obsoletes it for competitive recovery work.

Comparison with previous GPU generations

Moving from RTX 4090 to RTX 5090 delivers a 50-62% performance uplift across wallet hash modes. This is a generational gain comparable to the 3090-to-4090 transition (~45-55%).

The RTX 5090's 32 GB GDDR7 memory is particularly beneficial for scrypt-256 wallets (mode 15500), where memory capacity determines parallel thread count. Earlier GPUs with 24 GB (RTX 4090) could run ~96 parallel scrypt instances; the 5090 can run ~128. The extra memory capacity matters for this mode.

For practical recovery pricing, each generational GPU improvement reduces the time (and therefore cost) of medium-complexity recoveries by roughly 50%. A password that took 30 days on RTX 4090 takes ~18 days on RTX 5090. The cumulative effect of two generations is significant for multi-month jobs.

Interpreting benchmark data for your recovery case

1. 1

   Identify your wallet's hash mode

   wallet.dat = 11300, Ethereum keystore PBKDF2 = 15600, Ethereum keystore scrypt = 15500, MetaMask = 26600.

2. 2

   Estimate password strength

   Remember length, character classes, and any patterns. Human-chosen passwords under 10 characters are usually tractable.

3. 3

   Calculate candidate space

   Mask attack space = charset_size^length. Dictionary + rules = wordlist_size × rules_count.

4. 4

   Divide by hashcat speed

   Use the mode-specific speed (H/s) for your GPU configuration to estimate time-to-exhaustion.

5. 5

   Assess feasibility

   If estimated time is under 365 days with the available GPU time, recovery is feasible. Beyond that, the password is effectively uncrackable.

Frequently Asked Questions

Related Reading