Seed Phrase Scams: How Thieves Get Your Recovery Words
A seed phrase scam is any trick that puts your recovery words in someone else’s hands: you type them into a fake app or form, read them out to fake “support”, or start using a phrase that a thief already knows. Whoever holds the words controls the wallet, and a blockchain transfer cannot be reversed. This guide covers nine such scams, each with how it works, a documented case or official warning and the signs that give it away, then a red-flag checklist and what to do if you have already entered your words. New to the topic? Start with what a seed phrase is and how it works.
Two rules stop most of them: never give your phrase to anyone, and never use a phrase that someone else made or saw.
The Scams at a Glance
| Scam | What it wants |
|---|---|
| Fake support in replies and DMs | Your phrase |
| Fake wallet app or extension | Your phrase |
| ”Validate” or “sync” site | Your phrase |
| Airdrop or claim page | Your phrase or a signature |
| Phishing after a data leak | Your phrase |
| Pre-filled card or tampered device | Your deposits |
| Honeypot wallet | Your fee coin |
| Fake recovery service | Fees and personal data |
| Online seed generator | Your deposits |
How Each Scam Works
Fake Support on Discord, Telegram and X
You ask for help in a Discord server, a Telegram group or on X, and “support” replies or sends a direct message. The account borrows a real company’s name and logo, then asks for your phrase to “sync” or “restore” the wallet, or links to a form that does. The FBI’s Internet Crime Complaint Center (IC3) has warned that fake exchange support or security staff cold-contact crypto owners by call, text or email, tell them their wallet has a security problem and talk them into handing over access or moving their funds (IC3, March 2022). Ledger’s list of ongoing phishing campaigns describes fake support and staff accounts that answer people’s posts and pull them into direct messages.
How to spot it: the contact starts with them, and the fix needs your words. Ledger says it never sends direct messages on social media, and even a reply that looks like real support can be a lure: in June 2025, Trezor said attackers had abused its contact form to send scam emails that appeared to be legitimate Trezor support replies.
Fake Wallet Apps and Browser Extensions
A clone of a popular wallet turns up in an app store, an extension store or a sponsored search result, then asks you to “import” your phrase or shows an error that only the phrase can fix. Ledger’s phishing page describes fake Ledger Wallet apps and websites whose buttons, such as “Verify Now” and “Secure My Account Now”, lead to a page that asks for the 24 words. In May 2025, Mozilla said it had uncovered hundreds of scam crypto wallet extensions in its add-ons store over the previous few years.
How to spot it: install a wallet only through the link on its developer’s website. Ledger tells you never to type the phrase into Ledger Wallet or any other software: on a Ledger, the words go into the device itself.
”Validate, Sync or Rectify” Wallet Sites
A link in a message, an email or a search ad leads to a page saying your wallet must be validated, synchronized, rectified or upgraded, often by a deadline, and offering to fix it once you enter your phrase. MetaMask says that any platform or person asking you to complete KYC, click a link or button (usually in an email), or “verify” or “upgrade” your account in order to use your MetaMask wallet is running a scam (MetaMask Support).
How to spot it: a self-custody wallet has no account to verify and nothing to synchronize with a website. Typing your real words into a “seed validator” or balance checker carries the same risk, whoever runs it.
Airdrop and Claim Pages
Free tokens or NFTs land in your wallet, or a post announces an airdrop, with a link to a “claim” page that asks you to sign a transaction or simply asks for the phrase. In June 2025 the FBI warned that criminals were sending NFT airdrops to Hedera wallet users with a link in the memo field, and that connecting on the linked site often required security details, seed phrases included (IC3, June 2025).
How to spot it: a genuine airdrop never needs your phrase. Ignore tokens you did not expect, and read how approval and signature phishing works before you sign anything on a claim page.
Phishing After Customer-Data Leaks
A leaked customer list tells scammers who owns a wallet and lets them address you by name. In July 2020, Ledger disclosed that an attacker had reached its e-commerce and marketing database through a third party’s API key. On December 20, 2020, the full databases appeared on a forum: about 272,000 customer records with names, postal addresses and phone numbers, plus more than a million email addresses (Ledger).
Ledger’s phishing page, as archived in June 2021, lists the campaigns of the following months: emails asking customers to “update” their 24 words, and parcels holding a fake letter and a tampered Ledger whose instructions led to a fake Ledger Live app that asked for the words. In April 2025, Ledger confirmed on X that a paper letter asking its recipient to “upgrade” was a scam; it did not say where the sender got the address. Its current phishing page shows more letters that lead through a QR code or a website to a request for the 24 words.
How to spot it: your name, address and order history prove nothing after a leak. Ledger and Trezor both tell you to treat any message in their name that arrives by text, WhatsApp, Telegram, phone call or postal letter as phishing.
Pre-Filled Recovery Cards and Tampered Hardware Wallets
A new hardware wallet generates its phrase during setup and shows it on its own screen; whoever wrote words on a card in advance kept a copy. The archived Ledger page records a buyer whose Nano S, bought on Amazon, had been initialized by a malicious seller and came with the recovery sheet already filled in.
A tampered device needs no card. In a May 2023 case study, Kaspersky described a counterfeit Trezor Model T bought through a classifieds site: its firmware swapped the random phrase for one of 20 phrases stored in advance, and the thieves waited about a month after the first deposit before moving the funds (Kaspersky). Coinbase, warning of phishing emails in March 2025, put the rule simply: never enter a recovery phrase given to you by someone else.
How to spot it: buy from the manufacturer or an authorized reseller, reject any device that arrives already set up or with words written down, and run the maker’s authenticity check where one exists, in the maker’s official app rather than one supplied by the seller. See how hardware wallets work.
”Leaked Seed Phrase” Honeypot Wallets
A stranger posts a seed phrase in a comment or a chat, often as a beginner asking how to move their USDT. The wallet holds real tokens but little or none of the coin that pays network fees. As MetaMask describes the trap, a sweeper script moves out the coin you send for the fee at once, so the tokens never leave (MetaMask Support). In a TRON version spread through YouTube comments, which Kaspersky described in December 2024, the wallet was multisignature, so the phrase could not move the USDT at all.
How to spot it: a funded phrase posted in public, with a story attached, is bait rather than luck. Never send coins to such a wallet: every phrase published online, the examples on this site included, belongs to everyone who has seen it.
Fake Recovery Services
After a loss, “recovery experts” and law firms reach you through ads, social media and messaging apps, promise to recover the funds and ask for fees up front. In August 2025, the FBI described fake law firms that claim government ties, cite regulators that do not exist, know the dates and amounts of the victim’s earlier transfers and want payment in cryptocurrency or gift cards. It notes that the US government does not charge for law enforcement services (IC3, August 2025).
How to spot it: the offer is unsolicited, the fee comes first and the result is promised. A helper who asks for the phrase of a drained wallet gets the thief’s access to anything you send there later.
Online Seed Generators That Keep Copies
A website that generates a phrase for you can save it and wait for a deposit. In January 2019, Europol announced the arrest in Oxford of a suspect in the theft of about €10 million in IOTA from more than 85 victims since January 2018. The case centered on iotaseed.io, a generator of IOTA’s 81-character seeds that, according to Europol, stored the seeds it created in the background (Europol).
How to spot it: you cannot audit what a web page does with the words it shows you, so let a hardware wallet or your wallet app create the phrase. The generator on this site runs in your browser and is built for learning and testing, not for a wallet that will hold funds. Inventing the words yourself is no safer: see why you should never create your own seed phrase.
Red-Flag Checklist
- Someone asks for your words, whoever they claim to be.
- Someone gives you words, on a card, in an email or in a comment.
- The contact starts with them: a DM, a reply, a call, a text or a letter.
- A deadline or a threat, such as “mandatory” or “deactivated”.
- Account chores for a self-custody wallet sent by message or link: validation, sync, KYC, an “upgrade” or a claim. Real firmware and app updates show up in the official app.
- Free money with a catch: an unexpected airdrop or a stranger’s funded wallet.
- A promise to recover stolen funds, above all for a fee up front.
- A QR code in unsolicited mail, even with your real name on it.
- A download link from anywhere but the developer’s website.
If You Already Entered Your Phrase
Assume a thief has the phrase, even if nothing has moved yet: in the counterfeit Trezor case, the thieves waited about a month.
- Create a new wallet with a new phrase on a device you trust, ideally a hardware wallet bought from the manufacturer or an authorized reseller; accounts added under the old phrase share its exposed seed. Write the new words on paper or metal (how to store a seed phrase).
- Move the most valuable assets first, on every network and account the old phrase controls, after checking the receiving address on the new wallet’s screen.
- Keep the fee coin for last. Fees are paid in the network’s own coin, such as ETH on Ethereum or TRX on TRON, so move tokens while the old address still holds some, then send the rest of the coin. If it holds none, topping it up is risky: a sweeper script watching an exposed address can take the coin as soon as it arrives. MetaMask’s support site describes an Ethereum workaround, a Flashbots bundle in which a second account sends the ETH for gas and the tokens move out in the same bundle; it calls for significant technical know-how, and a stranger who offers to do it for you may be running another scam.
- Move passphrase wallets too. If your BIP39 passphrase was not exposed, those funds now rest on it alone.
- Clean the device where you typed the words: remove unknown apps and extensions and run a malware scan.
- Report it. In the US, file a complaint at ic3.gov; elsewhere, contact the police or your national fraud center. Keep letters, screenshots and transaction IDs, and ignore offers to get the money back. Spotting a seed phrase compromise covers the signs to watch for next.
Frequently Asked Questions
Will a wallet company ever ask for my seed phrase?
No. Ledger, Trezor, MetaMask and Trust Wallet all state that they never ask for it, and no exchange or support team needs it. You type it only to restore a wallet yourself.
Is it safe to test my phrase on a “seed checker” website?
Not with a real phrase. A site that receives your words can keep them, and even a page that checks them inside your browser shares it with extensions and other scripts. Use your hardware wallet’s own check, such as Check backup in Trezor Suite or Ledger’s Recovery Check app.
Someone posted a seed phrase with money in it. Can I move the funds?
No. Treat it as bait: the coin you send for fees gets taken, or the phrase cannot move the tokens at all.
Can stolen crypto be recovered?
Rarely. Confirmed transactions cannot be reversed. Report the theft quickly to the police, to IC3 in the US and to any exchange the coins reached, and treat anyone who promises recovery for an up-front fee as the next scam.
Does a hardware wallet protect me from these scams?
Partly. It keeps the keys off your computer, but it cannot stop you from typing the words into a fake app, and a tampered or pre-filled device defeats it from the start.