Last updated: October 22, 2026
If your seed phrase may be compromised — you typed it into a website, stored it in the cloud, photographed it, or someone saw it — treat every coin it controls as at risk and move everything right now to a brand-new wallet created with a new seed on a clean device; changing a PIN or password does nothing, because the seed alone gives full access. Move the largest and most liquid assets first. Here is the order of actions, the traps to avoid, and how to rebuild safely. If you need to convert coins quickly, a no-account swap like USDT → BTC can send straight to the new wallet.
- Minutes matter — act immediately
- 1 seed controls every coin derived from it
- New seed, new device, new addresses
- 0 "recovery services" to trust
Signs your seed may be compromised
| Situation | Risk |
|---|---|
| Entered it on a website, "wallet validation" form or support chat | Critical — assume it's stolen |
| Stored in cloud notes, email, password manager or photos | High |
| Device with the wallet had malware | High |
| Someone saw or photographed the backup | High |
| Unknown outgoing transactions in your history | Already exploited |
What to do right now (step by step)
- Create a new wallet on a clean device — ideally a hardware wallet — with a brand-new seed. Never "restore" the old seed.
- Move the most valuable, most liquid assets first to the new addresses.
- Remember every chain: one seed usually controls BTC, ETH, tokens, SOL, TRX and more — check each network.
- Revoke token approvals on EVM chains from the old wallet (see wallet drainers).
- Unstake or withdraw from staking and DeFi positions tied to the old keys as soon as possible.
- Back up the new seed properly — offline, never digital (seed backup guide) — and consider a passphrase.
- Stop using the old seed forever, including old addresses for receiving.
Traps to avoid
- Sweeper bots: on EVM and Tron, attackers often run bots that instantly take any gas you send to a compromised wallet. Don't top it up hoping to rescue tokens without a plan.
- "Recovery experts": people who promise to recover stolen crypto for an upfront fee are almost always scammers.
- Fake support: no wallet or exchange support will ever ask for your new seed.
- Reusing the device that had malware — wipe it first.
If funds were already stolen
Crypto transfers can't be reversed, but act fast: note transaction IDs (tracking guide), report to the police, and for stablecoins notify the issuer quickly — USDT and USDC can sometimes be frozen (details). Report the phishing site that captured your seed so others are warned. Learn the patterns in how to spot a fake exchange.
Frequently asked questions
What should I do if someone has my seed phrase?
Immediately create a new wallet with a new seed on a clean device and move all funds to it, starting with the most valuable. The old seed can never be made safe again.
Will changing my wallet password protect me?
No. The password or PIN only locks the app on your device. Anyone with the seed can restore the wallet elsewhere.
Can a hardware wallet protect a leaked seed?
No. If the seed leaked, the attacker can restore it on any device. Create a new seed on the hardware wallet.
Can stolen crypto be recovered?
Rarely. Issuer-controlled tokens like USDT can sometimes be frozen if reported quickly. Beware of paid "recovery services".
How do I prevent this in the future?
Never type your seed anywhere except into a wallet you're restoring, keep backups offline, and use a hardware wallet for savings — see hot vs cold wallets.
Rebuild on a fresh wallet: USDT → BTC, BTC → XMR or all pairs. No account, no ID, no logs.