Seed Phrase Exposed? An Emergency Wallet Plan (2026)

If another person saw your recovery phrase, it entered a suspicious website, or the device storing it was compromised, treat the entire wallet as unsafe. Changing the app password does not replace the phrase and cannot stop an attacker from restoring the wallet elsewhere.

1. Create a fresh wallet in a clean environment

Use a trusted second device or a new browser profile and install the wallet from its official source. Generate a new phrase. Do not reuse the old phrase or store the new one in the same cloud document, email account, photo library, or password note that may have been exposed.

2. Move what you still control

Prioritize valuable and liquid assets, verify the new destination, and test a small amount. If the old address appears to have an automated sweeper, blindly adding native gas may let the attacker steal it immediately. That scenario can require specialist help; do not accept help from unsolicited direct messages.

3. Retire every account derived from the old phrase

The phrase controls more than the currently visible account. Stop using all addresses derived from it, replace saved withdrawal addresses and QR codes, and warn anyone who regularly pays the old address.

4. Remove the original breach

Scan the device, remove suspicious extensions, review email and exchange sessions, change unique passwords, and check two-factor authentication. Revoking token approvals can help when the problem was a malicious allowance, but it does not repair an exposed seed phrase.

5. Preserve evidence

Keep the phishing domain, messages, destination addresses, transaction hashes, and times. Report the incident to the wallet provider, relevant exchanges, and the appropriate authority in your jurisdiction.

MetaMask’s emergency guidance recommends creating a new wallet on another browser or device, moving remaining assets, and discontinuing all accounts linked to the compromised phrase: unauthorized transactions response.

Why speed matters here, and where it does not

If a phrase is exposed but no funds have moved yet, you are in a race. Automated sweeper bots monitor compromised addresses and drain any native asset within seconds of it arriving. That is what makes this situation different from most security incidents.

The practical consequence: do not send gas to a compromised address to try to rescue a token sitting there. The sweeper will take the gas before your rescue transaction confirms, and you will have donated it. Where a token is genuinely valuable and stuck this way, recovery requires a specialist technique that submits the funding and the rescue in the same block. Do not attempt it casually, and do not accept an offer of help from anyone who contacted you first.

Where speed does not help: if funds are already gone, they are gone. A confirmed transaction cannot be reversed, and no service can undo it. Every offer to do so is a second scam aimed at someone who has already lost once.

What a compromised phrase actually exposes

A recovery phrase is not a password for one account. It is the root from which every address in that wallet is derived — across every network the wallet supports.

That means the exposure covers accounts you have never opened in the interface, addresses on chains you have never used, and any account added in the future from the same phrase. Retiring "the wallet" therefore means retiring the entire tree, not just the address you were watching.

It also means that adding a new account inside the same wallet is not a fix. The new account shares the same compromised root.

Rebuilding safely afterwards

• Generate the new phrase on a clean device, ideally one that was never involved in the incident.
• Write it down physically. Never store it in cloud notes, email, a photo library or a chat message — those channels are how many phrases leak in the first place.
• If the amount justifies it, move to a hardware wallet where the key never touches an internet-connected device.
• Update every saved withdrawal address and payment QR code that pointed at the old wallet, including whitelists on exchanges.
• Tell anyone who pays you regularly that the address has changed, and expect them to verify it with you through a second channel.

FAQ

Does deleting the app protect the funds? No. Anyone with the phrase can restore the wallet elsewhere.

Can I keep using the old address after moving funds? It is unsafe; the compromise does not expire.

Can support reverse the theft? A self-custody wallet cannot reverse confirmed blockchain transactions.

For a significant loss, contact a reputable security professional and local authorities promptly.