Cracking private key with last 2 mnemonic words absent (18 bits of entropy at play)

crack.js

const HDWallet = require('ethereum-hdwallet')
const bip39 = require('bip39');

const fs = require('fs')

const seedStart = 'program deny train foot scrap marble anxiety oblige hybrid clean'

const words = fs.readFileSync('./words.txt').toString('utf-8').split('\r\n')

for(let x = 0; x < words.length; x++){
  for(let y = 0; y < words.length; y++){
    const mnemonic = seedStart + ' ' + words[x] + ' ' + words[y]
    const valid = bip39.validateMnemonic(mnemonic)

    if(valid){
      const wallet = HDWallet.fromMnemonic(mnemonic)
      const address = wallet.derive(`m/44'/60'/0'/0/0`).getAddress().toString('hex')

      if(address.toLowerCase() === 'caC8E5397C09d1b1503Ab45A5fc7F8428BCf6DE5'.toLowerCase()) {
        console.log(mnemonic)
        process.exit()
      }
    }
  }
  console.log(x + ' of ' + words.length)
}

Sauce: https://medium.com/@kanewallmann_71759/recovering-assets-from-a-hacked-account-with-flashbots-bfe920435fb6