Terenval Answers · P1 safety · Русская версия

What Should You Do If Your Seed Phrase Is Exposed?

If someone else may have seen your seed phrase, assume the wallet is compromised. The phrase itself cannot be made secret again, so the durable fix is a new recovery setup.

Last reviewed: 2026-10-05.

Key takeaways

• Seed exposure is a key-compromise event, not a password-reset problem.
• A new account derived from the same compromised seed can still be compromised.
• Use a clean device and verified wallet source for the replacement wallet.
• Prioritize assets by value and urgency while accounting for gas.
• If a sweeper bot is active, ordinary recovery attempts can become more complex; avoid sending fresh gas blindly.

1. Decide whether the phrase was actually exposed

Assume compromise if you entered the phrase into a phishing site, sent it to “support,” stored it where an attacker gained access, installed a fake wallet that received it or used it on a device you know is infected.

You do not need proof that funds have already moved. Recovery phrases are bearer-like secrets: once copied, another party can wait before using them.

2. Create a fresh recovery setup

Use a clean device or browser profile and install a wallet through its independently verified official source. Generate completely new recovery material and record the backup securely according to the wallet's documented process.

Do not “change a few words” in the old phrase. BIP39 mnemonics are structured backups; editing words manually is not key rotation.

3. Inventory and move assets

Use block explorers and the wallet to identify assets across networks. Move higher-value and liquid assets first when practical, while leaving enough native gas for subsequent transfers. NFTs, DeFi positions and token approvals can require separate actions.

If assets disappear immediately whenever gas arrives, a sweeper bot may be monitoring the compromised account. Do not repeatedly fund it without a deliberate recovery plan.

4. Revoke and retire

Where relevant, revoke old token approvals as part of the migration, but remember that revoking an allowance does not make compromised private keys safe. Once assets and positions are moved, discontinue use of all accounts derived from the exposed seed.

Also investigate how the phrase leaked: malware, fake wallet, phishing, cloud storage, screen sharing or social engineering. Otherwise the new wallet can be compromised in the same way.

Incident-response checklist

1. Stop entering the old seed anywhere.
2. Use a clean, verified environment.
3. Create a fresh wallet and recovery phrase.
4. Verify the new receive addresses.
5. Inventory old-wallet assets and gas needs.
6. Move assets carefully, prioritizing material balances.
7. Review DeFi positions and approvals.
8. Retire the old seed and fix the original compromise source.