Should I ever type my seed phrase into a website or app? How does seed phrase phishing work?
Published · Updated
Short answer: No. Outside of setting up or restoring a wallet yourself, no legitimate website, app or support agent will ever ask for your seed phrase. Anyone who gets those 12 or 24 words controls the wallet, and that cannot be undone. If you already typed it somewhere, move your funds to a new wallet now. (MetaMask; Revoke.cash)
Key facts
- Ledger: "You should never enter your 24 words anywhere other than directly into your device." (Ledger)
- MetaMask says the only legitimate times to enter your phrase are when you first create the wallet and when you restore it or reset your password. (MetaMask)
- A leaked seed phrase controls every address derived from it, on every chain, and there is no way to revoke it. (Revoke.cash)
- Phishing and spoofing complaints involving crypto reached 7,164 in 2025, with $111 million in reported losses. (FBI IC3 2025 report) [IC3's categories overlap, so seed phrase theft also shows up under other crime types.]
How do scammers trick people into giving up a seed phrase?
- Fake wallet apps. Ledger says a fake Ledger Wallet (formerly Ledger Live) app is "one of the most common scam tactics." It shows an "error message" and then asks for your 24 words. (Ledger)
- "Verify" or "restore wallet" web forms. These impersonate wallet providers or dapps. (Revoke.cash; MetaMask)
- Letters in the mail. Ledger reports physical letters with a QR code that leads to a page asking for your recovery phrase. (Ledger)
- Fake support. Impersonators offer to fix a stuck transaction and ask for the phrase "to look into" it. (MetaMask) See fake support scams.
- Malware and cloud copies. Fake game launchers or meeting apps scan your device for wallet data, and phrases saved in Google Drive, iCloud or Dropbox can leak with that account. (Revoke.cash)
- Pasted commands. Revoke.cash warns about terminal commands shared on Discord or Telegram, disguised as troubleshooting or "airdrop claim instructions," that install malware. (Revoke.cash)
How should I store my seed phrase instead?
"Always remember: There is never a good reason to type your phrase into a computer."
- Write it on paper or metal and keep it somewhere physically secure. Never store it in the cloud, in notes, or as a photo or screenshot. (Revoke.cash; Trezor)
- Write it down alone. Trezor warns about cameras and microphones nearby and says not to read your words out loud. (Trezor)
- Use a hardware wallet, which keeps private keys off your computer. (Revoke.cash) See how to set one up safely.
What should I do if I already typed my seed phrase into a website?
- Assume the wallet is compromised. Revoke.cash: the affected addresses "need to be abandoned." (Revoke.cash)
- Check your device for malware, or back up your files and wipe it if you're not sure how the phrase leaked. (Revoke.cash)
- Create a new wallet with a new phrase on a clean device, preferably a hardware wallet, and move what's left right away. Sweeper bots may grab incoming funds, and Revoke.cash suggests the Flashbots Whitehat Hotline when high-value assets are still at risk. (Revoke.cash)
- Report it at ic3.gov if you lost money. (FBI IC3)
Frequently asked questions
Will my wallet company ever ask for my seed phrase?
No. MetaMask says it "will never ask you for your Secret Recovery Phrase." Ledger and Trezor say the same about their recovery phrases and wallet backups.
Can I change my seed phrase and keep the same wallet?
No. A seed phrase defines the wallet. Revoke.cash says that once it is compromised you must create a completely new one and move your assets away from the old wallet.
Does 2FA protect a wallet if my seed phrase leaks?
No. Revoke.cash says passwords and 2FA protect account logins and have no effect on a wallet controlled by a seed phrase.
Is it safe to keep a photo of my seed phrase in my phone?
No. Revoke.cash and Trezor both say never to keep a digital copy, including photos, screenshots, notes or cloud storage.
No affiliate links on this page, by policy.
Sources
- Ledger, "Ongoing phishing campaigns" (living page). ledger.com (accessed 2026-10-24)
- MetaMask Help Center, "How to verify the real MetaMask wallet" (undated). support.metamask.io (accessed 2026-10-24)
- MetaMask Help Center, "Contact MetaMask Support" (undated). support.metamask.io (accessed 2026-10-24)
- MetaMask Help Center, "Spoofing scams" (undated). support.metamask.io (accessed 2026-10-24)
- Revoke.cash, "Seed Phrase Compromise - Why It's Game Over" (undated). revoke.cash (accessed 2026-10-24)
- Revoke.cash, "You've Been Scammed, Now What?" (undated). revoke.cash (accessed 2026-10-24)
- Trezor, "Keeping your wallet backup safe" (undated). trezor.io (accessed 2026-10-24)
- FBI Internet Crime Complaint Center, "2025 IC3 Annual Report," April 2026 (pp. 54–55). ic3.gov (accessed 2026-10-24)
- FBI IC3, "FBI Guidance for Cryptocurrency Scam Victims" (I-082423-PSA), 2023-08-24. ic3.gov (accessed 2026-10-24)
Changelog
- 2026-10-24: First published.