DeFi Market
If your seed phrase is compromised, that wallet can't be made secure again. Anyone with those 12 or 24 words controls every address the wallet has ever made, and you can't change the words. So the job is a race: make a brand-new wallet with a brand-new seed phrase on a clean device, move whatever is left into it, and abandon the old one for good. Then find the leak and report the theft.
What do I do if someone has my seed phrase?
Move first. Think later. A thief with your phrase doesn't need your phone or your PIN. They can rebuild your wallet on their own device in a minute, and many run software that empties it automatically.
Chainalysis counted about 158,000 personal wallet compromises in 2025, nearly triple the 54,000 it recorded in 2022, hitting at least 80,000 people. The total taken from individuals actually fell, to $713 million from a $1.5 billion peak in 2024, which Chainalysis reads as thieves hitting more people for smaller amounts. Ordinary holders are the target.
The first hour: step by step
- Stop using the device you think leaked it. If the phrase was on that laptop or phone, in a note, a photo or a file, assume it's infected. Build the new wallet somewhere else.
- Make a new wallet with a new seed phrase. A fresh install, or a hardware wallet bought new from the maker. Don't tap "add account" in your old wallet app. That makes another address from the same stolen seed.
- Write the new phrase on paper. Not a screenshot, not a notes app, not cloud storage. Check it twice.
- Move the most valuable thing first. If a thief's bot is watching, you may get one or two transactions through before it reacts. Spend them on what matters most.
- Move everything else, then stop. Don't send new money to the old address, ever. Update any exchange or app that pays out to it.
- Save the evidence and report it. Note the addresses and transaction IDs, then file with the FBI at ic3.gov, typed in by hand. Our guide on how to report a crypto scam covers who else to tell.
First, check: was it your seed phrase, or a token approval?
Not every drained wallet is a seed phrase leak. Many are approval drains: you signed something on a fake site that let a contract spend one token. The fixes differ.
| What you see | Likely cause | What fixes it |
|---|---|---|
| Everything gone at once, across several coins or chains | Seed phrase or private key | New seed, move what's left, abandon the wallet |
| Gas money vanishes seconds after it arrives | Seed phrase or private key, with a sweeper bot | New seed. Revoking won't help |
| Bitcoin taken from a hardware wallet you never plugged into anything strange | Seed exposed or weakly generated | New seed on a different device |
| One token gone, your ETH or SOL still there | Token approval you signed | Revoke the approval; your seed may be fine |
| Tokens left in a series of small, timed transfers to one contract | Token approval | Revoke, then watch the wallet |
If it looks like an approval, our guide to checking and revoking token approvals walks through it. If you're not sure, treat it as a seed leak. A new wallet costs you an afternoon. Guessing wrong costs you the rest.
Can I change my seed phrase?
No. The seed phrase is the wallet. Every address and private key is worked out from those words, so you can't swap them for new ones and keep the same addresses. "Changing" it means creating a new wallet, which gives you new addresses, and moving your funds across.
A new PIN or a factory reset on the same seed does nothing. The thief has the master copy.
Why does my crypto disappear as soon as I send gas?
That's a sweeper bot. It's a script a thief runs on a wallet they control. It watches the address every second, and the moment anything lands, it sends it out. On Ethereum and similar chains it hits hardest, because moving a token costs a small fee in the chain's own coin. Your tokens are stuck without gas, you send gas, and the bot takes the gas before you can use it.
If something valuable is still stuck, such as staked tokens or an NFT, the only way past a bot is a single private transaction that pays the gas and moves the asset together, so the bot never sees the gas arrive. That's a job for an experienced person you already trust. It is never a job for a stranger who found you online.
Bitcoin is simpler. Fees come out of the coins you're moving, so there's no gas to steal. It's a straight race: if any bitcoin is left, send all of it to the new wallet now, with a normal or higher fee.
⚠ Red flag
Never type your seed phrase into a website, an app you didn't install from the maker, a "validation" form or a chat with support. No real wallet company, exchange or government agency will ever ask for it. And if you see someone post a seed phrase in a comment asking for help, don't log in "to look." Those wallets hold tokens and no gas, and a sweeper takes the gas you send to move them.
How did someone get my seed phrase?
Whatever leaked the first phrase can leak the second. These are the common routes.
| How it leaked | What it looks like | Fix this too |
|---|---|---|
| A fake wallet app | An app store listing that looks like the real one and asks for your phrase to "restore" or "sync" | Delete it; only install from links on the maker's own site |
| A phishing site or fake airdrop | A free token or NFT with a link to "claim," then a box for your phrase | Clear the browser, check every extension |
| Fake support | A helpful "agent" in a DM, a comment reply or a phone call who needs your phrase to fix an error | Real support never asks for it |
| A photo or screenshot | The phrase sits in your camera roll or cloud backup | Delete it everywhere, including cloud trash |
| Malware on your computer | The phrase was in a text file, a password manager note or an email to yourself | Wipe the device or retire it |
| A weakly made seed | Coins vanish from a hardware wallet you kept offline | Check the maker's advisory; new seed on a different device |
Fake apps. In April 2026 a counterfeit Ledger Live app for Mac got into Apple's App Store under an unrelated publisher name. BleepingComputer reported it drained about $9.5 million from around 50 people who typed in their recovery phrases. An app store listing proves nothing. Our guide to fake crypto apps shows how to check.
Fake airdrops. The FBI warned in June 2025 about free NFT "rewards" sent to Hedera wallet users, with a link in the memo field to a fake site that asked for the seed phrase. Its advice: never give a seed phrase in response to contact you didn't start.
Your photo gallery. In February 2025 Kaspersky found apps in both the App Store and Google Play that scanned people's photos for screenshots of recovery phrases. If your phrase was ever in your camera roll, count it as leaked.
Nobody leaked it at all. This one is rare but real. Starting 30 July 2026, thieves began sweeping bitcoin from Coldcard hardware wallets whose seeds had been made with far too little randomness, because of a firmware build error dating to March 2021. TRM Labs put the preliminary total at about 1,816 bitcoin, roughly $116 million, from more than 5,200 addresses. A firmware update doesn't fix a seed that was already made. If you created a seed on one of these devices, check the maker's advisory for your model and move to a new seed. If you worry your hardware was tampered with in other ways, see our hardware wallet tamper check.
Prefer to watch? What to do when your seed phrase leaks, in under a minute.
Read the video transcript
Seed phrase compromised? That wallet is gone. You can't change the words, and whoever has them controls every address. Chainalysis counted about a hundred fifty eight thousand wallet thefts like this in 2025. So, four things, in order. One: make a brand-new wallet with a brand-new seed phrase, on a different device. Not a new account in the same app. That's the same stolen seed. Two: move what's left, most valuable first. Three: if your gas money vanishes the second it lands, that's a sweeper bot. Stop sending it. Every top-up goes to the thief. Four: save the transaction IDs and report it at ic3.gov. Then get ready for the recovery offers. Anyone who messages you promising to get it back for a fee is the second scam. Where did your seed phrase leak from? Comment below, and hit like and subscribe.
Can a drained wallet be recovered?
Usually not. There's no bank to call and no chargeback. Once a transaction confirms, only the person who received the coins can send them back.
The exception is when stolen funds stop somewhere with a person in charge. Exchanges and some stablecoin issuers can freeze funds when law enforcement asks, which is why the report matters. Our guide on whether crypto scams can be traced explains where money gets stuck.
Then comes the second wave. Expect messages from "recovery agents" and even fake FBI agents. In July 2026 the FBI warned that impersonators are contacting people who already filed IC3 complaints, through Facebook Messenger and Telegram. It says IC3 has no social media presence and doesn't recover funds through those apps. Before you answer anyone, read how crypto recovery scams work.
What to put in your report
Give IC3 your old wallet address, every address the funds went to, the transaction IDs with dates and amounts, the wallet you used, what you did just before the theft, and screenshots of any chat or "support" conversation. If a block explorer shows the coins reaching an exchange, name it, and tell that exchange too. File even if you don't have every detail.
If you're 60 or older and want help filing, the Justice Department's Elder Justice Hotline is 1-833-372-8311. Some theft losses may count at tax time, depending on the facts; our guide on whether crypto scam losses are tax deductible explains the IRS test. Not sure whether what happened was a scam at all? Try our is this a scam quiz, or browse every guide in our Scams hub.
How to keep the new seed phrase from leaking
- Paper or metal, never a screen. No photos, no notes apps, no email drafts, no cloud.
- Get wallet apps from the maker's own website link, not from a search ad or a store search.
- Keep long-term savings off your daily device. Our hot wallet vs cold wallet guide explains the split.
Rob's take
I've held bitcoin since 2011, and my rule is simple: a seed phrase should never touch anything with a battery. Most drained wallets I hear about weren't hacked in the movie sense. Somebody typed 24 words into a box because a screen asked nicely. If you're reading this after the fact, move what's left today and be ready for the "recovery" calls. They come fast.
Seed phrase compromised FAQ
What do I do if someone has my seed phrase?
Make a new wallet with a new seed phrase on a clean device and move everything that's left into it, most valuable first. Then stop using the old wallet for good. Save the transaction details and report the theft at ic3.gov.
Can I change my seed phrase?
No. The seed phrase is the wallet, and every address comes from it. To get a new one you create a new wallet, which has new addresses, and move your funds across. Adding a new account in the same app keeps the same stolen seed.
Why does my crypto disappear as soon as I send gas?
A sweeper bot is watching the wallet. The thief's script holds your key and sends out anything that arrives, usually within seconds. Stop sending gas, because each top-up goes straight to the thief.
Can a drained wallet be recovered?
Usually not, because crypto transactions can't be reversed. Funds are sometimes frozen when they reach an exchange or a stablecoin issuer and law enforcement asks, which only happens if you report it. Anyone who contacts you offering recovery for a fee is running a second scam.
How did someone get my seed phrase?
The common routes are fake wallet apps, phishing sites and fake airdrops, fake support agents, photos or files of the phrase, and malware. In rare cases a hardware wallet made a weak seed. Find the route before you set up the new wallet, or it can leak again.
Does revoking approvals fix a stolen seed phrase?
No. Revoking only cancels permissions you gave to contracts. A thief with your seed phrase has the keys themselves, so the only fix is moving to a new wallet. Revoking helps when a single token was drained through an approval.