Seed-phrase phishing: the five-second mistake that empties a wallet

When people imagine crypto theft, they picture hackers breaking into exchanges. In the cases I traced, the most common loss was quieter: someone typed their recovery phrase into a page that asked for it. It takes about five seconds, and it is almost always irreversible.

A recovery phrase (often called a seed phrase) is the twelve or twenty-four words a wallet shows you once, at setup. Those words are not a password to your wallet. They are your wallet. Anyone who has them can recreate every key, on any device, anywhere, without your knowledge.

How the phish arrives

Fake support. You post about a stuck transaction on a forum or social network. Within minutes, a "support agent" replies with a link to a "wallet validation" or "sync" page that asks for your phrase.

Fake apps and browser extensions. Copycat wallet extensions and apps, sometimes promoted through paid search ads, look identical to the real thing. The first screen asks you to "restore" your wallet by entering your phrase.

Urgent security notices. An email or text claims your wallet has been compromised or must be "upgraded" before a deadline, and links to a page that asks for the phrase to "secure" it.

Airdrops and giveaways. A free token claim requires "connecting" by typing your phrase.

No legitimate wallet, exchange or support team will ever ask for your recovery phrase. Not once, not for any reason.

Why it works

These scams don't defeat the cryptography. They move the secret to where the attacker can read it. The phrase is designed to be portable and human-readable so you can recover from a lost device, and that same property is what makes it dangerous to type anywhere. Once it has been entered on a hostile page, the funds are typically swept to the attacker within minutes, often by automated scripts.

Habits that prevent it

Never type the phrase into anything except a wallet you are deliberately restoring, on a device you control, from an app you installed from the official source.

Keep it offline. Write it on paper or stamp it in metal. Don't photograph it, store it in notes apps, email it to yourself or keep it in cloud drives.

Use a hardware wallet for meaningful balances. The phrase stays on the device, and transactions are confirmed on its own screen.

Treat unsolicited help as hostile. Real support teams don't direct-message you first.

Split hot and cold. Keep spending money in a hot wallet and savings somewhere the phrase is never exposed day to day.

If you already entered it

Assume the wallet is compromised. From a clean device, create a new wallet with a new phrase and move any remaining funds immediately. Revoke token approvals from the old address if you can. Report the theft to the FBI's Internet Crime Complaint Center (ic3.gov) or your national equivalent, and to any exchange the funds were sent to, with the transaction hashes. And be wary of anyone who then promises guaranteed recovery for an upfront fee: that is usually the second scam.