Never Share Your Seed Phrase
What a seed phrase actually is
When you set up a crypto wallet, the wallet generates a seed phrase: twelve or twenty-four ordinary words in a specific order. That sequence of words is not a password that protects your wallet. It is the mathematical root from which every private key in your wallet is derived.
Anyone who has your seed phrase can reconstruct your wallet entirely. They do not need your device. They do not need your PIN. They do not need access to any account. They enter those words into any compatible wallet application, anywhere in the world, and they have complete control over every address, every asset, everything that wallet has ever held or will ever hold.
This is what makes the seed phrase categorically different from other credentials. A stolen password gives an attacker access to an account until the password is changed. A stolen seed phrase gives an attacker permanent, irrevocable access to the wallet itself. There is no changing it, because the seed phrase does not protect the wallet. It is the wallet.
How the attacks work
The attacks that successfully extract seed phrases share a common structure: they create a situation where entering the seed phrase feels like the right response to a legitimate problem. The three most common forms are worth understanding separately, because they look different on the surface.
The fake support scenario is the most persistent. A user encounters a problem: a transaction that failed, a balance that looks wrong, a wallet that behaves unexpectedly. They go looking for help in the places where crypto communities gather: Discord servers, Telegram groups, Twitter replies. Someone responds quickly, identifies themselves as official support for the protocol or wallet, and asks for the seed phrase to verify the wallet or diagnose the problem.
No legitimate support team will ever ask for your seed phrase. This is not a policy. It is a structural reality. The wallet's design assumes that only you know the seed phrase. A support team that had your seed phrase would have complete control of your wallet, which is not how legitimate support systems are built. The request itself is the signal.
The fake airdrop scenario exploits the same psychology from a different angle. A message arrives through Discord, Telegram, email, or social media, saying you are eligible for a token distribution. You click through to a page that looks like the official project website. To claim the airdrop, you need to verify your wallet by entering your seed phrase.
No legitimate airdrop requires a seed phrase. Airdrops work by sending tokens directly to wallet addresses. The recipient does not need to do anything, certainly not hand over the credentials that control their entire wallet. The request for a seed phrase in this context is the entire mechanism of the scam. There is no airdrop, only the seed phrase collection.
The fake wallet app scenario is covered in detail in a separate ZenRealm article. The short version: a fake wallet app appears in the App Store or through a search result, and during setup asks you to enter your seed phrase to restore an existing wallet. This framing can feel reasonable. You are trying to access your existing wallet through a new app. But a legitimate wallet app only needs your seed phrase when you are deliberately importing a wallet you previously created. Any app that requests it as part of a standard setup flow is designed to steal it.
What happens when it goes wrong
In April 2026, a fake version of the Ledger Live app appeared on the Apple App Store. It looked indistinguishable from the real application. It asked users to enter their seed phrases. More than 50 people did. Total losses reached approximately $9.5 million. Three of those users each lost more than $1 million.
One of them, identified publicly as G. Love, described losing a decade of Bitcoin savings, funds he had described as his retirement. He was not careless. He did not ignore warnings. He used what appeared to be an official app distributed through a platform he had been taught to trust. The app was there for six days before Apple removed it.
The losses in that incident were not the result of a technical exploit. They were the result of people responding to what looked like a legitimate request in a legitimate context. The seed phrase was entered willingly. The transfer that followed was irreversible.
Why the requests feel convincing
The attacks that successfully extract seed phrases tend to use one or more of three psychological levers.
Urgency: your wallet is at risk, your assets may be frozen, you need to act now before something gets worse. Urgency reduces the time available to think critically about whether a request makes sense.
Authority: the message comes from official support, a verified account, a platform you recognize. Authority creates a bias toward compliance. If the source looks legitimate, the request feels like it should be followed.
Opportunity: there are tokens available for a limited time, you have been selected, the window closes soon. Opportunity creates the fear of missing something valuable if you pause.
None of these levers are unique to crypto. They are the same mechanisms used in phone scams, phishing emails, and social engineering across every industry. What makes them effective in crypto is the combination of irreversibility and the fact that most users are navigating an environment they do not fully understand, which makes authoritative-sounding guidance feel more necessary.
What actually protects your seed phrase
Your seed phrase is needed in exactly two situations: when you are setting up a new wallet for the first time, and when you are deliberately restoring a wallet you previously created onto a new device. Every other request to enter your seed phrase, regardless of the source, the reason given, or the urgency of the situation, is an attack.
Store your seed phrase offline. Write it by hand on paper or engrave it on metal. Do not photograph it. Do not type it into any document, note-taking app, or cloud service. Do not send it to anyone through any channel.
If you are ever in a situation where someone is telling you that you need to enter your seed phrase to solve a problem, claim a reward, or verify something, stop. The problem they are describing does not require your seed phrase to solve. The reward does not require it to claim. The verification does not require it. The request is the attack.
The wallet you built, the assets you accumulated, the choices you made over months or years, all of it can be moved to a stranger's address in the time it takes to type twenty-four words. The seed phrase is the only thing standing between your wallet and anyone who wants to take it.
Most people who have lost funds this way understood that seed phrases were important. What they did not fully have, in the moment it mattered, was a clear sense of which requests were impossible to be legitimate. That line is simpler than it seems: no one who is trying to help you will ever need it.
Read more:
Fake Wallet Apps: How They Steal Your Seed Phrase
What Is Social Engineering in Crypto — and Why It Has Become the Primary Attack Vector