No portfolio tracker needs your seed phrase. Ever.
This is the shortest useful rule in crypto, and it is worth stating without hedging: a portfolio tracker that asks for your seed phrase is stealing from you. There is no version of that request that is legitimate, no feature that requires it, and no reason to give it the benefit of the doubt.
The rest of this post is about why the request is nonsense, because understanding the reason makes the rule stick better than memorising it.
A seed phrase is not a password
The mental model that gets people robbed is treating a seed phrase like a login credential — something you hand to a service so it can look at your account.
It is not that. A seed phrase is the master key from which every private key in your wallet is derived. Twelve or twenty-four words, and from them a wallet regenerates every address you have ever had and every key that signs for them.
Which means:
- Anyone with the phrase can recreate your entire wallet on their own device.
- They do not need your phone, your password, or your biometrics.
- They can move everything, immediately, and the transaction is final.
- There is no fraud department. Nobody can reverse it.
Handing over a seed phrase is not like giving someone your bank login. It is closer to signing over the deed while also handing them the keys and moving out.
Why a tracker cannot possibly need it
Here is the technical part, and it is what makes the rule absolute rather than just cautious.
Reading a balance requires only a public address. Blockchains are public ledgers — that is the entire point of them. Anyone can look up what any address holds, right now, without permission from anyone. That is not a loophole; it is the design.
Signing a transaction requires a private key. That is the only thing keys are for: authorising movement.
So the request breaks down cleanly:
| What the app says it wants to do | What it actually needs |
|---|---|
| Show your balances | A public address |
| Show your transaction history | A public address |
| Show your total across chains | Several public addresses |
| Move your funds | A private key |
There is no row where "display a number" needs a signing key. If an app asks for one anyway, it is asking for a capability it has no use for — and the only capability a seed phrase adds is the ability to spend.
What the request looks like in practice
It is rarely as blunt as a box labelled "seed phrase". The framings that work on people are the ones that sound procedural:
- "Import wallet" or "Restore wallet" in an app that is supposed to be read-only. Import is a signing operation. A tracker has no reason to offer it.
- "Validate your wallet" or "Sync your wallet" — invented ceremonies. There is no validation step in any chain that involves you typing words into an app.
- "Your wallet has a pending reward, connect to claim" — urgency plus a reward, the standard pair.
- Support that DMs you first. Real support does not open the conversation, and no legitimate support process ever needs your phrase. This one catches people who were already having a bad day with a genuine problem.
- A "wallet checker" that wants the phrase to check for compromise. If the phrase were compromised, typing it into another website would not be the fix.
The tell that covers all of them: the request is for words, not an address. An address is a long string starting with something like bc1, 0x, or 4. A seed phrase is ordinary English words. If a form wants words, close it.
If you have already entered it
Assume the wallet is gone and act on that assumption. Speed matters more than certainty here.
- Create a brand-new wallet with a freshly generated phrase, on a device you trust. Do not reuse the old phrase for anything, ever, including as a "backup".
- Move whatever is left, immediately, to the new wallet. If there is staked or locked value, move what is liquid first.
- Do not pay a "recovery service". Every single one is a second theft aimed at people who just lost money. There is no technical means to un-leak a phrase or claw back a confirmed transaction.
- Treat the exposed wallet as public forever. Do not send anything to it again, even a small amount. Attackers script these addresses and sweep them within seconds of any deposit.
If the wallet was empty, you got lucky and learned the lesson at the cheapest possible price. Retire the phrase anyway.
The rule, restated
Nobody legitimate will ever ask you for your seed phrase. Not support. Not a wallet. Not an exchange. Not a portfolio tracker. Not an airdrop. Not a validator. Not a security check.
If something asks, the asking is the attack. You do not need to work out whether the app is trustworthy, read its reviews, or check whether the domain looks right. The question itself is the answer.
Write the phrase on paper, keep it offline, and never type it anywhere except the wallet software that generated it — during a recovery you initiated yourself, on a device you control.