A leaked seed phrase means every account derived from it should be treated as compromised, but coins are not necessarily lost until an attacker moves them. Create a fresh wallet on a clean device and transfer remaining assets immediately; changing the wallet password does not change the seed.
A practical workflow#
- Prepare a new seed on a trusted device. For seed phrase leaked, complete this before value or signing authority changes hands and verify the resulting state afterward.
- Move native assets and valuable tokens to new addresses. Write the boundary down first so urgency cannot quietly expand what the wallet or account is allowed to expose.
- Transfer NFTs and revoke residual approvals where useful. Keep the first exposure small enough that a wrong assumption can be corrected without a material loss.
- Update exchange allowlists and payment records. Keep the original timestamp, identifier and unedited record so another person can reproduce the conclusion.
- Never reuse the old seed or deposit into its addresses again. Complete this through the verified product interface, then test the control instead of assuming it is active.
What actually matters#
The phrase is the root secret. An attacker can import it elsewhere without triggering a login alert and may monitor the addresses for future deposits.
For seed phrase leaked, separate what can be verified before acting from what can only be monitored afterward. Put hard limits around the second category.
A decision rule you can reuse#
If the wallet contains complex DeFi positions, plan transaction order and fees carefully. Professional incident assistance may be justified, but no helper needs the leaked or new seed.
Mistakes that change the outcome#
- Testing the leaked wallet by adding more funds. The branding can be copied, so the request must be re-opened through an independently verified channel.
- Entering the phrase into a “checker”. This can expose the root credential; a later password change may not remove the attacker’s access.
- Changing only the app password. This can expose the root credential; a later password change may not remove the attacker’s access.
- Announcing the migration publicly before completion. This weakens a control that should limit the blast radius of seed phrase leaked.
Evidence to keep#
Do not judge the outcome of seed phrase leaked only by whether the interface shows a success message. Use evidence that can still be checked after the page is closed.
| Checkpoint | Evidence | Stop condition |
|---|---|---|
| Prepare a new seed on a trusted device | Dated control check, recovery test or authenticated settings record with secrets removed | Testing the leaked wallet by adding more funds |
| Move native assets and valuable tokens to new addresses | Exact URL or contract address matched to official documentation | Entering the phrase into a “checker” |
| Transfer NFTs and revoke residual approvals where useful | Transaction or withdrawal ID plus the matching explorer or account record | Changing only the app password |
Keep transaction hashes, official case numbers or dated screenshots when they help document seed phrase leaked, but exclude seed phrases, private keys and authentication codes.
Frequently asked questions#
Can I create a new account under the same phrase?
No. Every derived account remains accessible to someone with that phrase.
Does adding a passphrase save the old wallet?
It creates different derived accounts but does not protect assets already under the exposed seed path.
What if nothing has moved for months?
The attacker may be waiting or may not have noticed. Absence of theft does not restore secrecy.
Related guides#
Sources#
- Ethereum.org: Security and Scam Prevention
- MetaMask: Wallet Security
- CISA: Avoiding Social Engineering and Phishing Attacks
Risk notice: Crypto actions can be irreversible. Never share a seed phrase, private key, password or authentication code, and verify every domain and wallet prompt independently.
Editorial standard
This guide is educational and source-led. Security controls, exchange rules and legal requirements can change; verify critical steps through the relevant official service before acting.
