iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Treat an exposed seed phrase as a compromised wallet. On a device you trust, create a completely new wallet with a newly generated recovery phrase, move every remaining asset to it as soon as you can, and stop using the old phrase. Then review token approvals, disconnect unfamiliar dApps, secure linked accounts, and preserve evidence if anything is missing. Changing an app password, disconnecting a dApp, or buying a hardware wallet does not make the exposed phrase safe again.
Do these things first
Speed matters because anyone who has the recovery phrase may be able to derive the wallet’s private keys and sign transactions. There is no reliable way to tell whether an attacker has already copied or used it. Assume compromise if you typed the phrase into an unfamiliar website or app, sent it to someone, stored it in an online account, photographed it, or entered it after following an unsolicited support message.
- Stop the interaction. Close the suspicious site or app, stop replying to the contact, and do not run commands, install software, or share your screen at an unknown person’s request.
- Choose a trusted device. If the computer or phone where the phrase was entered could have malware, do not create the replacement wallet there. Use a device you have good reason to trust, with its operating system and wallet software obtained from official sources.
- Create a new wallet and phrase. Generate the phrase in the wallet you intend to keep using. Do not reuse the exposed phrase or import it into another wallet.
- Move what remains. Send assets to addresses in the new wallet promptly. Check the destination address character by character and select the correct network before confirming.
- Inspect permissions and connected apps. Revoke suspicious token approvals and disconnect unfamiliar dApps. Revocation is a separate protective action; it does not undo a transfer that already happened.
- Secure related accounts. Change passwords for linked exchange or email accounts and turn on two-factor authentication where available.
Do not wait for an attacker to make the first transaction. A phrase compromise is urgent even when the balance still appears unchanged.
Recommended Free Tools
Why a seed-phrase leak is different from a password leak
A recovery phrase is the root credential for the wallets it generates. Possession can allow an attacker to control addresses, sign transactions, and move assets without knowing your wallet app’s PIN or password. Those app credentials usually protect access on one device; they do not replace the phrase or invalidate it.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Moving funds to a fresh wallet protects the assets that arrive there, but it does not repair the old wallet. The old phrase remains compromised forever. Do not keep using an old address for deposits merely because it has not yet been drained.
A hardware wallet can keep a newly generated key away from routine online exposure, but it cannot revoke a phrase that was already disclosed. It also cannot make a malicious transaction or token approval harmless. The Singapore Police Force’s July 1, 2026 advisory specifically warns that approvals can permit later transactions even when a hardware wallet is involved.
How to migrate remaining assets safely
1. Prepare without exposing either phrase
Use a private location and a trusted device. Download the wallet application or hardware-wallet firmware only from the manufacturer’s official channel, verify that you are using the intended product, and update it before setup when the official instructions require an update. Never ask a support agent to “check” your phrase and never paste it into a form, chat, browser extension, cloud note, password manager field, or command-line prompt.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIf you suspect the current device is infected, disconnect it from the network and use a different trusted device for setup and transfers. Malware can alter copied addresses or observe what you type. A clean device does not guarantee that an attacker cannot act first, so continue without unnecessary delay.
2. Generate a genuinely new wallet
Choose “Create new wallet” rather than “Restore,” “Import,” or “Recover.” Let the wallet generate a new recovery phrase using its own setup process. Write the words down in the order shown, check the spelling, and complete any verification screen without photographing or copying the phrase.
Confirm that the addresses displayed after setup belong to the new wallet. If a device or app presents a phrase supplied by another person, or asks you to type an existing phrase before it will “unlock” a prize, support case, airdrop, or refund, stop: that is not a safe wallet-creation flow.
3. Store the new phrase offline
Keep the phrase on a durable physical record in a private place. Make a second copy only if you can secure it to the same standard. Do not store a digital photograph, screenshot, email draft, cloud document, or unencrypted text file. Anyone who obtains the new phrase can repeat the same takeover.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
The Singapore Police Force says a hardware-wallet recovery phrase should be entered only directly on the device during initial setup or recovery. That rule is a useful test for any wallet: an unsolicited website, “validation” page, or support representative should never need the words.
4. Transfer assets in a controlled order
Start with the assets that would cause the greatest loss if an attacker moved them first. Send a small test amount when practical, confirm that it arrived at the new address on the intended network, and then transfer the remainder. Check network names carefully; an address can look correct while a transaction on the wrong network leaves funds inaccessible.
Review the final transaction on the wallet’s confirmation screen. If the address changes after you copy it, or the wallet shows an unexpected recipient, cancel and investigate the device and clipboard before proceeding. Keep enough of the relevant network’s native token to pay transaction fees, but do not leave a large balance in the old wallet simply to avoid a second fee.
Once migration is complete, stop signing from the old wallet. Do not use it for “one last” approval, message signature, or test transaction.
Check token approvals and dApp connections separately
A dApp connection alone is not identical to a seed-phrase compromise. Connecting may only let an application see public addresses and request signatures. A signed token approval can grant a spender permission to move specified tokens later, while a signed transaction can authorize an immediate action. A phrase leak is more severe: it can let an attacker control the wallet without waiting for an approval.
If you interacted with an unfamiliar dApp, review the wallet’s connected sites and remove unknown connections. Then use a reputable block-explorer or wallet permission interface for each affected network to identify and revoke suspicious token allowances. Read exactly which token, spender, network, and allowance you are changing before signing.
- Revoking an approval normally requires a new on-chain transaction and a network fee.
- Revocation prevents future use of that allowance; it does not reverse transfers already completed.
- Disconnecting a site does not revoke an approval that was already signed.
- A hardware wallet still displays and signs approvals; it does not make a deceptive approval safe.
If the seed phrase was exposed, perform the migration even when every approval appears clean. Approval review is an additional check, not a substitute for replacing the wallet.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
When the device itself may be compromised
Warning signs include unknown remote-control software, a wallet downloaded from an advertisement or message, unexpected browser extensions, altered destination addresses, repeated password prompts, or security alerts you cannot explain. Do not type the new phrase into that device.
Use a separate device that you have updated and obtained through a trusted supply chain. For a substantial balance, a hardware wallet may reduce exposure to ordinary online attacks because key operations can remain on the device. Government guidance from Singapore’s February 5, 2025 advisory and MyEtherWallet’s September 10, 2026 help article presents this as an option, particularly for larger holdings.
Hardware is not a cure-all. It cannot recover assets already stolen, undo a disclosed phrase, or protect you from approving a malicious contract. Choose it only for the new wallet, follow the device’s own setup and recovery instructions, and verify transaction details on the device display before signing.
If funds have already disappeared
Blockchain transfers are generally irreversible. A wallet provider cannot simply freeze a self-custodied seed-phrase wallet or retrieve assets sent to another address. Do not delay the protective migration while trying to negotiate with the attacker.
Preserve evidence before deleting messages or resetting devices:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- the old and new wallet addresses;
- transaction hashes, timestamps, token amounts, and networks;
- suspicious URLs, app names, advertisements, and wallet-pop-up text;
- emails, messages, phone numbers, usernames, and payment receipts;
- screenshots that do not contain any recovery phrase or private key.
Contact the affected exchange or wallet provider through the contact details on its official website, not through a reply or account that contacted you first. Report the incident to appropriate law-enforcement or cybercrime authorities in your jurisdiction. Provide the evidence and explain that the transactions were unauthorized; avoid exaggerating what you can prove.
Be especially cautious after a loss. “Recovery agents” who promise a guaranteed refund, request an upfront fee, or ask for your new phrase are common follow-on scams. No legitimate investigator needs your recovery phrase to trace a public transaction.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Secure accounts connected to the wallet
If the wallet was linked to an exchange, email account, or other service, change those passwords from a trusted device. Use a unique password for each service and enable two-factor authentication, preferably with an authenticator app or security key when the service supports it. Review active sessions, API keys, withdrawal addresses, and account recovery methods.
This account cleanup protects services that may be compromised separately; it does not change the cryptographic keys in the old wallet. Complete the new-wallet migration first when funds remain at risk, then work through account security methodically.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteCommon mistakes that make the situation worse
- Changing only the wallet-app password: the exposed recovery phrase still controls the wallet.
- Importing the phrase into a “safer” app: every copy remains vulnerable, and the new app does not create new keys.
- Waiting for proof of theft: an attacker may transfer funds without warning.
- Assuming a dApp disconnect is enough: existing approvals can remain active.
- Entering a phrase into a hardware-wallet website: setup or recovery should use the device’s own secure process, not a web form.
- Sending funds to an address from a message: independently verify the destination and network.
- Paying a guaranteed-recovery service: irreversible transfers and recovery-fee scams make promises of certainty a major warning sign.
A practical decision guide
| What happened | Priority response | What it does not prove |
|---|---|---|
| Phrase typed into an unknown site, app, form, or message | Assume full compromise; create a new wallet on a trusted device and move remaining assets immediately. | It does not prove that funds are already gone. |
| Phrase stored online, photographed, or sent to another person | Replace the wallet and phrase; treat every address derived from the old phrase as unsafe. | Deleting the file or message does not prove copies were deleted. |
| Only connected to a suspicious dApp | Disconnect it, inspect approvals, and revoke suspicious allowances. | A connection alone does not establish that assets were transferred. |
| Signed an unfamiliar approval or transaction | Revoke the allowance where possible, migrate if the phrase was also exposed, and monitor affected networks. | Revocation cannot undo a completed transfer. |
| Assets already moved without permission | Secure any remainder, preserve transaction evidence, and report through official channels. | A provider or investigator cannot promise a reversal. |
What to remember about the replacement wallet
The replacement wallet is safe only if its phrase was generated privately, never disclosed, and stored offline. Keep the old wallet only as an evidence reference if needed; do not sign from it or send new funds to it. A hardware wallet can be a sensible way to protect the new keys, especially for larger holdings, but the security benefit starts with the new phrase and careful transaction review. It cannot rehabilitate the old phrase or remove the risk of a malicious signature.
When in doubt, act on the strongest assumption: phrase disclosure means migration, suspicious dApp activity means approval review, and missing funds mean evidence preservation and official reporting. These are separate tasks, and completing one does not replace the others.
Frequently Asked Questions
Should I move funds if I am not certain the phrase was copied?
Yes. If the phrase was entered into an untrusted site or app, sent to someone, or stored where another person could access it, the cost of waiting can be total loss. Create a fresh wallet on a trusted device and migrate what remains.
Can a hardware wallet restore an exposed seed phrase safely?
No. Importing the exposed phrase into a hardware wallet keeps the same compromised keys. Use the hardware wallet to generate a new wallet instead, and enter its phrase only through the device’s approved setup or recovery process.
Free tools Windows power users keep installed
One-click scans. No signup required.
Will revoking a token approval return stolen cryptocurrency?
No. Revocation blocks a future use of that allowance when the transaction succeeds, but it cannot reverse a transfer that has already been confirmed on-chain.
What information should I give a wallet provider or police report?
Provide wallet addresses, transaction hashes, networks, timestamps, suspicious links or applications, and messages or payment records. Never include a recovery phrase or private key.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
