Is My Seed Phrase Compromised? Signs and What to Do Next

Your seed phrase is compromised if anyone other than you could have seen or copied it: you entered it on a phishing page or in a fake app, read it out to “support”, a photo or cloud copy of it exists, it came pre-filled with a device, or it was generated by software later found to be flawed. The clearest sign is a transaction you did not make, but by then the funds are usually gone, because automated “sweepers” often move coins within minutes. So act on exposure, not on proof. Trezor’s guide to moving crypto to a new wallet backup puts it the same way: if you suspect your backup has been compromised, assume it has and move your funds.

Warning Signs at a Glance

How Do Seed Phrases Leak?

Attackers rarely break the cryptography. They get the words from you, from a copy of them, or from the way the phrase was made.

• You entered the words somewhere. Fake support agents, fake wallet apps and “validate your wallet” pages exist to collect phrases; seed phrase scams describes the common ones and phishing protection covers approval tricks that don’t need the phrase at all.
• A digital copy leaked. Electrum’s malware documentation is blunt: taking a photo of your seed, and above all uploading it to cloud storage, is asking for trouble. Anyone who gets into that account, phone or computer gets the phrase.
• Malware on the wallet’s device. The same page describes malicious clones of wallet apps that upload the seed words or send out all the coins, and malware that reads the wallet file or memory. A hot wallet’s keys are only as safe as the device (how hot wallets work).
• Someone had the backup or the device in hand. A flatmate who finds the paper is enough. Hardware can be attacked too: in January 2020, Kraken Security Labs showed that voltage glitching could extract the encrypted seed from a Trezor One or Model T with about 15 minutes of physical access, and recommended a BIP39 passphrase, which is not stored on the device.
• The phrase was weak from the start. In the Milk Sad case (CVE-2023-39910), the bx seed command of Libbitcoin Explorer 3.x drew its entropy from a generator with only 32 bits of seed, so attackers could recompute the phrases; the researchers estimate that more than $900,000 was taken in the 2023 thefts. Their write-up ties it to a near-identical flaw in Trust Wallet’s browser extension (CVE-2023-31290), disclosed in April 2023. Words you pick yourself are weak in the same way (why you should never create your own seed phrase).

How to Check Your Wallet and Its History

1. Look at the history of every account. Open each address or account in your wallet or a block explorer and look for outgoing transactions you don’t recognize, especially one that moves everything to an unknown address.
2. Check every network the phrase controls. One phrase can hold Bitcoin, Ethereum and other coins at once, each under its own derivation path. A thief may empty one network first and come back for the rest.
3. Review token approvals on Ethereum and other EVM chains, and revoke any you don’t remember signing (how to review and revoke approvals).
4. Check where the app came from. If you installed the wallet from a search ad or a link in a message, assume the phrase you entered into it is exposed.
5. List everywhere the phrase has been. Every place you wrote, typed, photographed or read it out counts, including old phones and laptops.

A thief who restores your phrase leaves no trace on the blockchain until they spend, and some wait: in a counterfeit hardware wallet case covered in seed phrase scams, the thieves waited about a month before moving the funds. A clean history proves nothing if one of the exposure signs applies.

False Alarms: Signs That Don’t Mean Your Phrase Is Compromised

• A zero balance after restoring in another app. Usually the new wallet is looking at a different address type, derivation path or passphrase, not at stolen funds. A block explorer shows whether the coins actually moved; restoring a wallet from a seed phrase explains how to find them.
• Tiny payments or unknown tokens arriving. Unsolicited dust transactions and airdropped tokens are used to track addresses, poison your history with lookalike addresses or lure you to a scam site. They need no access to your wallet; just don’t interact with them.
• “Invalid seed phrase” when restoring. That points to a wrong or misspelled word, not to theft (how to fix an invalid seed phrase).
• An email or text saying your wallet is compromised. Self-custody wallet makers cannot see your phrase, so they cannot know whether it leaked. The message is most likely the phishing attempt.

What to Do If Your Seed Phrase Is Compromised

1. Create a new wallet with a new phrase on a device you trust, ideally a hardware wallet bought from the manufacturer. Accounts added under the old phrase share its exposed seed, so they don’t count.
2. Move the funds now, the most valuable first, on every network the old phrase controls, after checking the receiving address on the new wallet’s screen. Speed matters: in a study of Bitcoin “brain wallets”, keys anyone could guess, all but 21 of 884 wallets were drained, usually within 24 hours and often within minutes (Vasek et al., Financial Cryptography 2016).
3. Mind the fee coin. Tokens need the network’s own coin for fees, and a sweeper watching the address may grab any coin you send to cover them; seed phrase scams explains how to order the transfers.
4. Revoke approvals the old addresses gave to contracts you no longer trust.
5. Move passphrase wallets too. If your BIP39 passphrase was not exposed, those funds now rest on it alone.
6. Clean up the device and the copies. Remove unknown apps and extensions, scan for malware, and delete photos, notes and backups of the old phrase from devices and cloud accounts.
7. Report the theft to the police, in the US to the IC3, and to any exchange the coins reached. Telling the exchanges matters: in A Fistful of Bitcoins (IMC 2013), researchers who followed funds from notable thefts concluded that because so much money passes through a few large services, exchanges above all, an agency with subpoena power is well placed to identify who is paying whom. Ignore anyone who offers to recover the funds for a fee.

How to Keep the New Phrase Safe

• Let your wallet or hardware device generate the phrase, and never use words that came on a card in the box or that someone else gave you.
• Write it on paper or metal, with no photos, screenshots or cloud copies, and keep it away from the device (how to store a seed phrase).
• Never give it to anyone. No support team, exchange or wallet maker needs it, and a page that asks for it to “verify” or “sync” your wallet is a scam.
• For large amounts, add a passphrase or spread the keys across a multisig wallet, so that one exposed backup is no longer enough to take the funds.
• Test your own setup the way an attacker would: cracking your own wallet walks through a safe self-audit, and the seed phrase security guides cover the other common attacks.

Frequently Asked Questions

Will I be notified if someone restores my seed phrase?

No. Restoring a wallet only reads the blockchain and leaves no record. You see nothing until the thief sends a transaction.

Does changing the wallet password help?

No. The password protects only the copy of the keys on your device. Anyone with the phrase can restore the wallet elsewhere and choose their own password.

Can I keep using a phrase that might be exposed?

No. A seed phrase cannot be changed; it is the wallet. The only fix is a new wallet with a new phrase and moving everything to it.