Seed phrase stolen: What really matters in the first few hours

Your wallet is empty. Perhaps after a message that looked like a genuine support request. Perhaps after visiting a website where you typed out twelve or twenty-four words because it mentioned a supposedly necessary recovery. Perhaps even without you being able to pinpoint the moment.

What usually follows is a mixture of disbelief and frantic activity. It's precisely this mix that costs the most valuable evidence in the first few hours. Therefore, a sober assessment is crucial: anyone who knows your seed phrase has complete access to all accounts derived from that sequence. A new password, a new PIN, or a new device won't change that.

Crypto Investigation supports those affected in precisely this situation. This article describes what should be prioritized in the first few hours, how to secure evidence for later analysis, and which measures have proven ineffective.

The most important information at a glance

• Basic rule: A compromised seed phrase cannot be repaired. Everything that follows from this sequence is considered lost once a third party knows it.
• First priority: Transfer any remaining funds to a newly created wallet with a fresh seed phrase, generated on a clean device.
• Second priority: Documentation. Addresses, transaction IDs, timestamps, and screenshots form the basis for any subsequent tracking.
• A common mistake: Sending funds to the old wallet also results in losing them. Automated programs empty such addresses within seconds.
• Realistic expectation: The coins themselves cannot be reversed. A chance of recovery exists where the trail leads to a regulated provider.
• Caution: Offers that promise a return against prepayment shortly after the incident are usually a second scam.

Seed phrase stolen: What you should do first

Before you do anything else, check if there are any other holdings under the same seed phrase. This often involves other networks or other accounts within the same wallet that the attacker hasn't yet noticed. Tokens held outside the main account or assets bound to protocols can also be affected.

Create a new wallet with a new seed phrase on a device you believe is clean. If you suspect your computer or phone is compromised, use a different device. Transfer the remaining funds to the new addresses. Start with the largest amount, as time may be short.

Be aware of an unpleasant possibility: Compromised addresses often contain automated programs that immediately intercept and block any access attempts. If the transfer fails because the funds for the network fee disappear immediately, the cause is well-known. We explain how this process works and what options are available in this situation in the article on... Sweeper Bot.

Securing evidence after the theft of the seed phrase

Everything you document now will determine later whether prosecution is even possible. Blockchain data doesn't disappear, but the connection to your case does if it isn't recorded.

What information about the theft you should note down

Record your own affected addresses, all addresses to which your funds were transferred, the transaction IDs of the outflows, the date and time as precisely as possible, and the amounts for each transaction. Include the time you noticed the loss and the time you last entered or saved the seed phrase.

Which documents you should secure immediately

Take screenshots of the transaction history in your wallet and in a blockchain explorer. Save all communication leading up to the incident: messages, emails, links, profile names, phone numbers. Note which websites you visited, including the exact spelling, as such sites often go offline after a few days.

What you should not do after the seed phrase has been stolen

Do not delete anything, not even messages that are unpleasant for you. Do not reset the affected device until the matter is resolved, as this will erase all traces. And under no circumstances should you send any further data to the old address, not even to initiate a transaction.

How perpetrators even obtain a seed phrase

To investigate the incident and protect the new wallet, it's helpful to understand how the word sequence might have been leaked. In practice, there are four methods that account for the vast majority of cases.

Fake wallet pages and recovery forms

The most common route involves a page that looks like the interface of a well-known wallet provider. The reason is usually a supposed malfunction, a necessary synchronization, or a security update. The page then asks for the recovery phrase, allegedly for verification purposes. Such pages are often promoted through advertisements and then even appear above the genuine results in the search results.

Fake support in chats and social networks

Anyone who describes a problem in a public group or in the comments section of a post often receives a private message within minutes from someone claiming to be an employee. They appear competent, use forms and ticket numbers, and eventually ask for a specific phrase or information to be entered on a linked page. No legitimate provider would ever ask for the seed phrase.

Digital backups

Many seed phrases are not lost through an attack, but because they were stored as a photo in the gallery, a note in an app, or a text file in cloud storage. If even one of these accounts is compromised, the wallet is open. These cases usually go unnoticed until late because the access doesn't coincide with any identifiable event.

Tampered devices and used hardware

Less common, but regular: malware on your computer or phone that intercepts keystrokes or reads the clipboard contents. Hardware wallets from dubious sources, which are often shipped with pre-configured passwords, are also vulnerable. Only purchase such devices directly from the manufacturer or authorized dealers and always configure them yourself.

File a criminal complaint after a seed phrase was stolen

The theft of crypto assets is a crime, and filing a report is not just a formality. It is a prerequisite for law enforcement to obtain information from exchanges that would otherwise be inaccessible to you.

A report is processed much more efficiently if it is specific. Helpful elements include a chronological account, a list of the affected addresses, transaction IDs, and a verifiable statement of the loss in euros at the time of the outflow. We have described how to structure such a report separately. Additionally, we can prepare the wording of a criminal complaint upon request.

If your assets have landed in an account with a well-known exchange, it may be helpful to notify that provider. The more precise the information, the sooner it will be processed. With stablecoins, there is a possibility in certain cases that the issuer may block holdings.

Recovering stolen cryptocurrency: What is realistically possible

At this point, transparency is more important than confidence. A confirmed transaction on a public network cannot be reversed. There is no entity that can cancel a booking. Anyone who tells you otherwise is not telling you the truth.

What is possible is tracking. Stolen goods rarely stay where they first end up. They are forwarded, divided, exchanged, and often ultimately pass through a platform where someone had to verify their identity. This is precisely where a lead arises, a point of contact for authorities to investigate. Whether this lead is accessible in your case depends on the available evidence and can be assessed after an initial analysis.

The prospects are better if the amounts involved are significant, if the transaction traces to a regulated platform, and if little time has passed. They are worse if the transactions have been routed through mixed services or are located in networks designed for obfuscation. Neither of these scenarios precludes analysis, but they do alter the probability of success.

How to recognize a recovery scam after a stolen seed phrase

A few days after an incident, individuals or companies often contact the victim promising to recover their belongings. They claim to know details because victims have shared their experiences in forums and groups, and they appear professional. Payment is made upfront, followed by further demands for alleged fees, taxes, or release costs.

A reputable provider doesn't promise a refund, but rather an analysis with an open-ended outcome. They won't demand payment in cryptocurrency to a private address, they won't contact you unsolicited after an incident, and they won't quote success rates they can't substantiate. We explain how to recognize such offers in our article about... Repatriation agencies and recovery scams.

Seed phrase stolen? Get a free case assessment.

You're unsure whether an analysis is even worthwhile in your case? We can clarify that beforehand. We'll examine the outflows, investigate where the trail leads, and tell you frankly whether a tangible point of connection exists. If not, we'll tell you that too.

Use the form for this. free initial assessment on our website. The information you have already gathered following the steps above will be helpful.

FAQ: Seed phrase stolen, what to do

Note: This article is for general information purposes only and does not replace legal advice in individual cases. Crypto Investigation is a forensic service provider and not a law firm.