How to Check Whether a Crypto Wallet Migration Tool or Website Is Legitimate

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Do not use a wallet-migration link until you verify it independently. Open the wallet provider’s known official website or documentation from a bookmark or manually checked address, find the migration instructions there, and compare the complete domain and software source. Never give a website, support agent, or unrelated service your recovery phrase (seed phrase) or private key. A message that creates urgency, supplies a link, or asks you to send crypto to “verify” a wallet is a strong phishing warning.

A legitimate recovery or migration process may involve restoring a wallet in a compatible app, changing devices, or moving assets to a new address. Those steps are not interchangeable. First establish what the provider actually supports, then follow instructions reached from its verified site—not from the message that prompted you to act.

What a wallet migration service is—and what legitimacy means

A migration may mean restoring an existing self-custody wallet in a compatible app, moving accounts to a successor wallet, changing a device, or transferring assets between addresses. Those are different operations. A legitimate tool should state exactly which one it performs, which networks and account types it supports, and whether you remain in control of the keys.

Legitimacy is not established by a familiar logo, a convincing email, a high search ranking, a sponsored result, an app-store listing, or a directory entry. It means the exact website and software can be traced to the provider’s independently verified official documentation, use a documented workflow, and do not require you to surrender secrets or sign unexplained transactions.

Ethereum.org explains that many wallet products provide an interface to your assets rather than custody of them; a centralized exchange, by contrast, controls accounts on its own platform. That distinction determines who can recover an account and what a “migration” actually changes. With self-custody, control of the keys is central to control of the assets. With an exchange account, account access and recovery are handled by the exchange. Do not assume a process for one model applies to the other.

Ask what will change before you begin: Will an app restore access to the same wallet, or will you make a transaction to a new address? Will the new service hold keys, or will you? A page that uses the word “migration” without explaining the action leaves an important risk unanswered. Find the provider’s explanation independently, and stop if the steps or custody model do not match what you were told.

The non-negotiable safety rule

A recovery phrase is the master secret for the accounts it controls. Anyone who obtains it can typically recreate the wallet and move its assets. Ethereum.org’s security guidance states: “No legitimate service, support agent, or website will ever ask you for these,” referring to recovery phrases and private keys.

• Do not type a recovery phrase or private key into a web page, support form, chat, screen-share session, or unsolicited app.
• Do not send cryptocurrency to an address to “activate,” “verify,” “unlock,” or “migrate” a wallet.
• Do not sign a transaction whose destination, permissions, amount, or contract you cannot explain.
• Do not assume that a page using the correct colors, logo, or wallet name is operated by that provider.

A phrase can be used to restore a wallet in a compatible wallet application. That is different from disclosing it to a migration website or a person. Follow only the provider’s official restore instructions, and confirm that the app, chain, derivation method, and account type are compatible before importing anything.

Keep the phrase private even if someone describes the request as a one-time security check, verification step, or way to “sync” balances. A recovery phrase is not a customer-service credential that a support team needs to inspect. If a process appears to require disclosure, stop and confirm through independently found official instructions rather than trying the phrase to see what happens.

Step-by-step legitimacy check

1. Stop before clicking or connecting

Pause if the request arrived unexpectedly by email, text, social media, an advertisement, a support direct message, or a phone call. The Federal Trade Commission (FTC) has warned about fake wallet-update messages that use urgency and send people to imitation pages. Do not reply, click, connect a wallet, download an attachment, or call the number in that message.

Urgency is useful to a scammer because it discourages independent checking. A threat that your assets will disappear unless you act immediately is not proof that a migration is required. Do not let a deadline in an unsolicited message set your next step; independently open the provider’s site and see whether it documents the same change.

2. Find the official route independently

Open a bookmark you created earlier or type a provider address that you have verified through a trusted source. From that site, navigate to the help or security documentation and look for migration, restore, or upgrade instructions. Ethereum.org recommends bookmarking web-wallet sites to reduce phishing risk.

Read the full address in the browser bar. Check the spelling of the registrable domain, not merely the words before it. Be wary of extra hyphens, substituted characters, unusual top-level domains, shortened links, and redirects. A padlock or HTTPS only encrypts the connection; it does not prove who operates the site.

For example, a link can display a familiar wallet name while leading to a different domain. The useful check is not whether the page looks like the wallet, but whether you can navigate from the known official site to that exact address and find the same instructions there. If a separate domain is used, look for an explicit explanation of the relationship on the provider’s verified site.

3. Match the exact workflow

The official documentation should describe the same action you are being asked to take. Compare the page’s wording, supported networks, app version, and destination domains. If the official site does not mention a “migration” campaign, assume the unsolicited claim is unverified and contact support through the known site instead.

Read the instructions all the way through before starting. Note whether they describe restoring an existing wallet, transferring assets, or changing account custody. Check what the provider says will happen at each stage and whether the sequence matches the page in front of you. If the message promises a quick “one-click” process but the official instructions describe something materially different, do not continue on the message’s route.

4. Verify the software source

Download or update a wallet only through the provider’s official distribution page or through an app-store listing reached from that page. Bitcoin.org warns that phishing wallets can imitate genuine products, appear as sponsored search results, or be listed in app marketplaces. Check the publisher name, package identifier, release history, permissions, and update date; a look-alike name is not enough.

Do not treat search placement or marketplace presence as proof that an app is genuine. Use the provider’s official site as the starting point for finding its distribution route. If a download page asks you to bypass operating-system protections, disable security software, or ignore a wallet warning, stop instead of following those instructions.

5. Reject secret-phrase requests

Stop immediately if the page or person asks for a seed phrase, recovery phrase, private key, wallet file password, or a screenshot containing any of them. Legitimate support can troubleshoot without taking possession of the master secret. Close the page and do not paste the phrase into another “validator” or “recovery” service.

A restore flow inside a compatible wallet app is not permission to enter your phrase into any site that claims to be a wallet. Verify the app and its documented restore instructions first. If you are unsure whether the software is the genuine app or whether it supports your wallet, do not enter the phrase while you investigate.

6. Inspect what you are being asked to sign

A wallet connection can grant an application visibility into addresses, while a signature or transaction can grant spending permissions or move funds. Read the wallet’s confirmation screen and check the chain, contract, recipient, amount, token approvals, and requested permissions. Reject anything you cannot interpret. Blockchain transfers are generally irreversible, so a support team cannot simply undo a mistaken approval or payment.

Connecting and signing are not the same action, but neither should be treated as harmless just because a page calls it a verification step. Look at the wallet’s actual confirmation screen rather than relying on a website’s summary. If the destination, requested approval, or transaction details are unclear, cancel and verify what the documented flow is supposed to do before trying again.

7. Confirm through known contact details

If any detail is uncertain, close the suspicious page and contact the provider using support information published on the independently verified official site. Do not use a reply address, phone number, or direct message supplied by the person who contacted you. The FTC recommends independently known contact routes; Ethereum.org says its site will not contact users first.

When you contact support, describe the request and ask whether that exact domain and workflow are official. Do not send your recovery phrase, private key, or a screenshot that exposes them as “proof.” If someone who contacted you first claims to be support, do not continue the conversation through their channel; start a new one using the verified site’s contact details.

How to assess the website and its software

Domain and redirect checks

Start with the final domain after all redirects, not the text of the hyperlink. A legitimate provider may use a separate domain for documentation or downloads, but the relationship should be explained on the provider’s primary verified site. If a migration page is hosted on an unrelated domain, treat that as a separate service requiring its own proof of affiliation.

Search results are clues, not authentication. Attackers can purchase ads for misspelled domains or publish pages that copy support language. Enter the address yourself or use a bookmark, then navigate internally.

Be cautious of shortened links because they hide the destination until opened. If the address changes after you follow a link, inspect where it ends up and whether the official site explains that redirect. Do not assume that a page is affiliated merely because it uses the same branding or says it is an “official partner.” The provider’s verified documentation should establish that connection.

Software authenticity and maintenance

Look for a transparent publisher identity, a public release history, security advisories, and a documented update process. Confirm that the download you receive matches the provider’s stated package or application identifier. Avoid software that disables operating-system warnings, asks for unrelated permissions, or tells you to bypass wallet security prompts.

Ethereum.org’s wallet directory describes criteria such as security testing and active maintenance. A listing can provide background about a wallet, but Ethereum.org says directory inclusion is informational and not an endorsement. It does not prove that a separate migration service, domain, or support account is affiliated with the listed wallet.

Use a listing as context, not as a shortcut around checking the exact app and site. A directory can tell you something about the wallet entry it covers; it cannot certify a link sent in a message or establish that an unrelated migration tool is operated by the same provider. Confirm the service and its current instructions through the provider’s own verified route.

Claims and payment demands

Be skeptical of promises that funds will disappear unless you migrate immediately, guarantees that a stranger can recover stolen crypto for an upfront fee, or requests to send coins to prove ownership. Ethereum.org notes that blockchain transactions cannot be reversed by a support team. A second person offering paid “recovery” after an incident is often another scam.

A legitimate explanation should tell you what the process does, not rely on fear or a promise of guaranteed recovery. If you are asked to pay an unrelated fee or transfer assets to an address before you can “unlock” them, stop. A completed blockchain transfer is not something a support agent can reverse for you, and sending more funds to a recovery offer can create another loss.

Compatibility: a real migration can still fail

Wallet recovery is software-specific. A phrase may restore accounts in one compatible wallet app but not automatically reproduce every account, network, hardware-backed key, multisignature policy, or derivation path in another. The reviewed official guidance does not establish universal compatibility across wallets or chains.

Before moving anything, obtain written compatibility information from the provider for your exact setup:

• the original wallet application and version;
• the destination application and version;
• the blockchain network and token standard;
• the account type, such as a single-key, hardware, or multisignature account;
• the address format and derivation path, where applicable; and
• whether the process restores keys, imports watch-only addresses, or transfers assets to a new address.

Do not infer compatibility from the fact that two apps both support the same broad blockchain name. A provider’s official restore instructions are the place to confirm what its software supports. If they do not answer whether your specific account and setup will work, pause and ask support using contact details found on the verified site.

If documentation is unclear, test the documented process with no funds or with a small amount only after independently verifying the destination address. Do not “test” by revealing your phrase to a website.

A small test transfer, when appropriate to a documented transfer process, can help check the destination address before moving more. It is not a substitute for verifying the address and chain, and it does not make an unverified site trustworthy. Never send funds to a stranger’s address to demonstrate ownership or activate a supposed migration.

Compare migration routes by risk, not appearance

Criterion	Questions to answer	What a safer option looks like
Official provenance	Is the route documented from the provider’s verified official site?	A direct path from the known site to the exact instructions and download.
Secret handling	Who, if anyone, receives the recovery phrase or private key?	No website, support agent, or unrelated service receives either secret.
Compatibility	Does documentation cover your wallet, chain, account type, and address format?	Specific compatibility statements rather than a blanket “works with every wallet” claim.
Authenticity and maintenance	Can you verify the publisher, release history, and security process?	Official distribution, identifiable publisher, current maintenance, and clear security information.
Custody model	Who controls keys and account recovery after migration?	The service clearly explains self-custody versus custodial control and its consequences.
Transaction impact	Does the process require a transfer, approval, or other signature?	Every requested action is explained before signing, with recipient and permissions visible.

Do not rank options by follower counts, testimonials, logos, or search position. Those signals do not authenticate a domain or establish technical compatibility.

Also compare what happens if something goes wrong. A self-custody wallet provider may supply an interface rather than hold the assets or control the keys, while a centralized exchange controls accounts on its own platform. Establish who controls recovery and what support can actually do; do not assume that customer support can reverse an on-chain transfer.

Red flags that should end the session

• An “account will be suspended” or “assets will be lost today” deadline.
• A link supplied in an unsolicited message instead of instructions found on the official site.
• A request for a recovery phrase, private key, wallet password, or screenshot of secret data.
• A demand to send crypto to a different address before migration.
• A promise to reverse a confirmed blockchain transaction or recover funds for a fee.
• A caller or chat agent who contacted you first and insists on remote access.
• A download that requires disabling security software or ignoring a wallet warning.
• A directory or marketplace listing presented as proof of affiliation with a separate service.

One red flag is enough reason to pause. You do not need to prove that a page is malicious before deciding not to connect or sign; an unexplained request is sufficient reason to stop and verify it through an independent route.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What to do if you already interacted with it

If you entered a recovery phrase or private key

Assume the secret is compromised. From a clean, trusted device, create a new wallet through a workflow you independently verified as official. Move remaining assets to addresses controlled by the new wallet before the suspected attacker acts. Do not reuse the exposed phrase.

For Ethereum tokens, review and revoke token approvals where relevant. Change passwords for associated exchange accounts and enable two-factor authentication. Do not pay anyone who contacts you promising recovery; Ethereum.org warns that recovery offers after a scam are a common second scam, and blockchain transfers cannot be reversed by a service.

Use a trusted device and a verified wallet workflow for the response. Do not return to the suspicious page to ask it to “remove” your phrase or confirm that it was deleted. Once disclosed, treat the secret as exposed rather than relying on a scammer’s assurance that it was not saved.

If you only connected or signed

Use trusted wallet and network tools to inspect the permission or transaction you approved. For Ethereum, official scam guidance specifically recommends revoking token approvals after a suspected scam. There is no single remediation procedure for every chain or wallet, so identify the exact approval or transaction before taking further action.

Check what the wallet actually approved rather than assuming that disconnecting the site undoes an approval or transaction. If you cannot determine the effect, consult the wallet provider through its verified support route. Do not disclose your phrase while seeking help, and do not follow remediation links sent by the site or an unsolicited helper.

If you downloaded software but did not disclose secrets

Disconnect the device from the network if you suspect malware, uninstall the untrusted software, run your operating system’s security checks, and change credentials from a separate clean device. Monitor wallet and exchange activity. Do not reinstall the same package from an advertisement or message; obtain software only through the verified official route.

If you entered exchange credentials on the suspicious site, change them from a clean device and enable two-factor authentication on the exchange account. Use the exchange’s verified site or app, not a link in the original message. Keep watching for further suspicious contact, especially anyone who claims they can retrieve lost funds for a fee.

Where a hardware wallet fits

Ethereum.org describes hardware wallets as offline storage for private keys, and Bitcoin.org advises buying them from the manufacturer or an authorized reseller. Hardware storage can reduce exposure of keys to a compromised computer, but it does not make a suspicious migration website safe and is not required for every user.

A hardware device still requires you to verify addresses and transaction details on its screen. Never type its recovery phrase into a website, and never buy a device from an untrusted reseller if its packaging or initialization appears altered. The relevant question remains whether the migration workflow is officially documented and whether you understand what you are signing.

A hardware wallet is an optional custody consideration, not a website-checking tool or a fix for a phishing link. It cannot make an unsupported migration compatible, authenticate a separate service, or reverse a transfer. If you consider one, follow the manufacturer’s official setup instructions and obtain it from the manufacturer or an authorized reseller.

A simple decision rule

1. Official source: You reached the instructions from a bookmark or independently verified provider domain.
2. No secret disclosure: The workflow never asks a website or person for your recovery phrase or private key.
3. Documented compatibility: Your wallet, network, account type, and destination are explicitly supported.
4. Understandable actions: You can explain every connection, approval, signature, and transfer before confirming it.
5. Independent confirmation: Any uncertainty was resolved through support details published on the known official site.

If any answer is “no,” stop. A genuine migration can wait while you verify it; an attacker’s deadline is part of the attack.

Frequently Asked Questions

Should a wallet migration website ever ask for my seed or recovery phrase?

No. A recovery phrase or private key is a master secret. Ethereum.org’s security guidance says no legitimate service, support agent, or website will ask for them. A phrase may be used to restore a wallet in a compatible wallet app, but only follow the provider’s official restore instructions.

How can I check whether a wallet migration link is real?

Do not rely on the message that sent it. Open a bookmark you saved yourself or independently verify the provider’s address, then navigate to its migration or recovery instructions. Check the full domain and any redirects, and confirm the exact workflow and software source from the provider’s site.

Does an Ethereum.org wallet-directory listing prove that a migration service is legitimate?

No. Ethereum.org says its directory uses criteria such as security testing and active maintenance, but listings are informational, not endorsements. A listing for a wallet does not establish that a separate migration site, link, or support account is affiliated with it.

What if I already entered my recovery phrase on a suspicious site?

Assume it is compromised. From a clean, trusted device, create a new wallet using a workflow you independently verified as official and move remaining assets to it. For Ethereum tokens, review and revoke approvals where relevant. Do not reuse the exposed phrase or pay an unsolicited recovery offer.

What if I only connected my wallet or signed something?

Inspect the specific permission or transaction using trusted wallet and network tools. For Ethereum, official scam guidance recommends revoking token approvals after a suspected scam. There is no universal remediation process for every chain or wallet; verify what you approved and seek help through the wallet provider’s known official contact route.

Can a legitimate recovery phrase work in every wallet app?

No universal compatibility is established. Ethereum.org says a phrase can restore a wallet in a compatible wallet app. Use the provider’s official restore instructions and confirm support for your wallet, network, account type, and other relevant setup details before proceeding.

Can support reverse a crypto transfer if the migration turns out to be a scam?

Generally, no. Ethereum.org notes that blockchain transactions cannot be reversed by a support team, and Bitcoin.org advises checking addresses and transactions before signing or sending. Be wary of anyone who promises guaranteed recovery for an upfront fee.

The Bottom Line

Bottom line: Verify the exact site by reaching it from the wallet provider’s independently confirmed official website or your own bookmark. Never disclose a recovery phrase or private key to a website or support contact; check compatibility and read every transaction or approval before signing. If a page creates urgency or any step is unclear, stop and contact the provider through details published on its verified site.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.