Seed Phrase Scams: No Tracker Needs Your Words

Published July 29, 2026 · Updated September 18, 2026 · Privacy and safety

A seed phrase scam is any request for your recovery words, and the request itself is the whole of the evidence: an app, a site or a person that asks for the phrase is stealing from you. There is no legitimate version of that request, no feature that requires it and no reason to weigh the sender's credibility.

Ledger's Academy states the same rule about its own hardware in its own words: Ledger will never ask for the 24 words, the device is the only place they are required, and anyone or any app that asks for them is a criminal (Why the twenty-four words phrase). What follows is why the request makes no technical sense, how it is dressed up, and what to do if the words are already gone. This page is security information, not financial advice.

What is a seed phrase scam, and why does the request itself give it away?

A seed phrase scam works by borrowing the shape of a login. The mental model that gets people robbed is treating recovery words like a password — something you hand to a service so the service can look at your account on your behalf.

A seed phrase is not that. The Bitcoin Wiki defines it as a list of words that store all the information needed to recover funds on-chain, and states plainly that anybody else who discovers the phrase can steal the coins, so it must be kept safe like jewels or cash (Seed phrase). It is the master secret from which every private key in the wallet is derived. Phrases are usually 12 or 24 words, and other lengths exist: Trezor documents devices generating a 12, 18 or 24-word recovery seed, drawn from a fixed list of 2,048 words (What is BIP39).

What can someone actually do with your seed phrase?

Anyone holding your seed phrase can rebuild your entire wallet on hardware you have never touched and move everything in it. Four consequences follow, and they are the reason the rule has no exceptions:

• The wallet can be recreated elsewhere. The phrase regenerates every address you have ever had and every key that signs for them.
• No phone, PIN or biometric is needed. Your device is a convenience for you, not a barrier for them.
• The movement is immediate and, in practice, final. The Federal Trade Commission states that cryptocurrency payments typically are not reversible, and that you can usually only get your money back if the person you paid sends it back (What to know about cryptocurrency and scams).
• There is no fraud department. The FTC also notes that cryptocurrency payments do not come with the legal protections that credit and debit cards carry.

Handing over a seed phrase is not like giving somebody a bank login. It is closer to signing over the deed, handing across the keys and moving out.

Why can no portfolio tracker need a seed phrase to show a balance?

Reading a balance requires a public address; signing a transaction requires a private key. Those are two different capabilities, and a tracker only ever needs the first. Blockchains are public ledgers — bitcoin.org states that all Bitcoin transactions are public, traceable and permanently stored in the network, and that anyone can see the balance and all transactions of any address (Protect your privacy).

There is no row in which displaying a number requires a signing key. An app that asks for one anyway is asking for a capability it has no use for, and the only capability a seed phrase adds is the ability to spend. Holdtotal never asks for a seed phrase, a private key, a wallet address or an exchange API key, because holdings are typed in by hand — the three ways a tracker can learn what you hold are compared in the piece on connecting a wallet.

How is the request disguised inside an app or a message?

The request is rarely a box labeled "seed phrase". The framings that work are the ones that sound procedural, and five of them account for most cases:

• "Import wallet" or "Restore wallet" inside an app that is supposed to be read-only. Importing is a signing operation, and a tracker has no reason to offer it.
• "Validate your wallet" or "Sync your wallet" — invented ceremonies. No chain has a validation step that involves typing words into an app.
• "Your wallet has a pending reward, connect to claim" — urgency plus a reward, the standard pair.
• Support that sends the first message. Real support does not open the conversation, and no legitimate support process needs the phrase.
• A "wallet checker" that wants the phrase to check for compromise. If the phrase were compromised, typing it into another site would not be the fix.

One tell covers all five: the request is for words, not for an address. An address is an opaque string your wallet gives you to copy and paste; a seed phrase is ordinary dictionary words that a wallet once told you to write down. If a form wants words, close it. The same instinct applies to softer claims about privacy, which are worth testing rather than trusting — the method is in the piece on checking a tracker's claims.

What should you do if you have already entered your seed phrase?

Assume the wallet is compromised and act on that assumption rather than waiting for proof. Speed matters more than certainty.

1. Create a new wallet with a freshly generated phrase, on a device you trust. Never reuse the exposed phrase for anything, including as a backup. bitcoin.org recommends keeping backups offline and encrypting any backup that is exposed to the network (Secure your wallet).
2. Move whatever is left to the new wallet, immediately. If some value is staked or locked, move what is liquid first.
3. Treat every unsolicited recovery offer as fraud. On 11 August 2023 the FBI's Internet Crime Complaint Center issued alert I-081123-PSA on companies falsely claiming an ability to recover funds lost in cryptocurrency scams: the operators charge an up-front fee and then either stop replying or deliver an incomplete or inaccurate tracing report and ask for more money (IC3 alert I-081123-PSA).
4. Treat the exposed wallet as public forever. Compromised addresses are commonly watched by automated sweepers, so send nothing to it again, not even a small test amount.

If the wallet was empty, the lesson came at the cheapest price available. Retire the phrase anyway.

What this article does not cover

This page covers the seed phrase scam and nothing adjacent to it. It does not evaluate wallets or hardware devices, does not cover exchange account takeovers, SIM-swap attacks or malware, and does not advise on holding, valuing or disposing of any asset. Nothing here is financial advice; the site's disclaimer sets out the limits, and the Holdtotal home page describes what the app does.

The rule, restated so it can be quoted on its own: nobody legitimate will ask for your seed phrase — not support, not a wallet, not an exchange, not a portfolio tracker, not an airdrop, not a validator, not a security check. Write the phrase on paper, keep it offline, and type it only into the wallet software that generated it, during a recovery you started yourself, on a device you control.

FAQ

Can someone steal crypto with only a seed phrase and no device?

Yes. The phrase alone regenerates every private key in the wallet, so an attacker restores it on their own hardware and signs from there. Your handset, PIN and biometrics protect only your copy of the wallet, not the funds themselves. That is why a seed phrase scam needs nothing else from you once the words are typed.

Is it safe to keep a seed phrase in a password manager or a photo?

Any copy that touches a networked device inherits that device's risk. bitcoin.org advises keeping backups offline and encrypting any backup exposed to the network, because an online backup is highly vulnerable to theft. A photo in a cloud gallery is an online backup. Paper stored somewhere only you can reach remains the plainer option.

Can a stolen crypto transaction be reversed?

Almost never. The Federal Trade Commission states that cryptocurrency payments typically are not reversible and that you can usually only get your money back if the recipient sends it back, with none of the legal protections a credit card carries. That is also why the FBI's IC3 warns about paid recovery services that charge up-front fees.