My seed phrase was exposed: what to do in the next hour

If someone has seen your recovery phrase, your funds are at risk right now. Start here, and read everything else later. This emergency guide is part of our section on crypto threats and scams.

Step 1: Do not engage

Stop any chat, call or remote session. Do not tell the scammer that you noticed. Close the site.

Step 2: Use a clean device

If you typed your phrase on a computer or phone, assume that device might be infected. Use another device, ideally a hardware wallet. If you have none, use a different phone or computer that you trust, and upgrade later.

Step 3: Create a new wallet

Generate a brand new phrase. Do not restore the old one, and do not reuse it. Write the new words on paper, following our guide. Keep the paper offline.

Step 4: Move your funds, in order

1. The most valuable coin that can be moved at once.
2. Other coins and tokens.
3. Assets on other networks, and in other accounts.
4. Anything staked or locked, as soon as you can.
5. Wallets opened with a passphrase. If your passphrase is safe, they may still be safe, but move those too if there is doubt.

Check the address on the device's screen, and send a small amount first only if time allows.

Step 5: Stop using the old phrase

Treat it as dead. Do not send anything to it. Remove old wallets from your apps and browser.

Step 6: Work out how it happened

If you do not know the cause, assume that your device is unsafe.

Step 7: Report it

Report to your local police and your national fraud agency. In the US, use IC3. Tell any exchange that received your funds. Recovery is unlikely, but a report helps.

Step 8: Beware of the second scam

Scammers target victims. Anyone offering to recover your funds, for a fee, is very likely to be lying. See recovery services.

Check your other accounts

If you stored the phrase in your email or a cloud service, that account may be compromised. Review it, using the signs of a hacked account.