Do not connect your wallet or enter any recovery information until you have independently verified the exact domain. A legitimate migration flow should be documented by the wallet provider, use software obtained through an official distribution route, and never ask a website, support agent, or unrelated service for your recovery phrase or private key. Treat an unsolicited urgent migration message as a likely phishing attempt and verify it through contact details you already know are genuine.
What makes a wallet migration site legitimate?
Legitimacy is not established by a familiar logo, a convincing message, a search result, an app-store listing, or a directory entry. You need to verify the specific website and the specific action it asks you to take.
As an Amazon Associate I earn from qualifying purchases.
A credible migration or recovery route has four characteristics:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Independent provenance: the wallet provider’s verified website or documentation points to the exact domain, app, or procedure.
- Safe secret handling: it does not request your recovery phrase, seed phrase, private key, password, or one-time authentication code through a webpage, chat, email, or support contact.
- Documented compatibility: the provider explains that the route supports your wallet type, network, account format, and version.
- Transparent custody: you can tell whether you remain in control of the keys or are opening an account with a custodial service.
If any of these points cannot be verified, stop. A migration that is genuinely required should remain available through the provider’s independently verified support and documentation channels.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Why recovery phrases and private keys are a hard stop
A recovery phrase is the master secret for a wallet. Anyone who obtains it can generally recreate the wallet and control its accounts. A private key similarly authorizes transactions for the account it belongs to. Sending either to a website or support representative is equivalent to handing over control.
Ethereum.org’s security guidance states: “No legitimate service, support agent, or website will ever ask you for these.” In that sentence, “these” means recovery phrases or private keys. A real wallet application may provide a documented restore function in which you enter a phrase locally to recover your own wallet. That is different from disclosing the phrase to a migration website, a person in chat, or a form reached from an unsolicited link.
What a legitimate restore workflow looks like
- You obtain the wallet application from the provider’s official website or from an app listing reached through that site.
- The app’s own documented restore process explains which phrase format, network, and account type it supports.
- The phrase is entered into the trusted wallet software, not sent to a web form or support contact.
- You can verify the resulting addresses before moving funds or signing anything.
Do not assume that every wallet app, blockchain, derivation path, or migration service is compatible with every phrase. Use the provider’s instructions for your particular wallet and account.
Free tools Windows power users keep installed
One-click scans. No signup required.
Step-by-step legitimacy check
1. Stop before clicking or connecting
Do not follow a migration link from an unexpected email, text message, social-media post, advertisement, browser pop-up, or support direct message. Fake wallet-update campaigns often create urgency and send users to imitation pages. Do not connect a wallet merely to see what the site does; a connection can expose account information and may lead to a signing request.
2. Find the provider through an independent route
Open the wallet provider’s known official site using a bookmark you saved previously or an address you verify yourself. Do not use the link, phone number, QR code, or reply address supplied by the suspicious message. Locate the migration, upgrade, or recovery instructions from the official site and compare the exact domain character by character.
Check the complete address, including the registered domain, spelling, subdomain, path, and any redirect. A padlock or HTTPS connection only encrypts the connection; it does not prove that the site is operated by the wallet provider. Ethereum.org recommends bookmarking web-wallet sites to reduce the risk of phishing.
3. Validate the software’s distribution route
Download or update wallet software from the provider’s official website or from a verified app listing reached through that site. Bitcoin.org warns that phishing wallets can imitate genuine products, appear as sponsored search results, or be placed in app marketplaces. An app name and icon are not sufficient authentication.
Recommended Free Tools
Before installing, compare the publisher, package or application identifier, linked privacy policy, release history, and the provider’s own support documentation. If the provider does not document the application or link, do not enter wallet secrets into it.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
4. Reject requests for secrets and unrelated payments
Never type a recovery phrase or private key into a migration webpage. Never send one in a ticket, email, chat, screen recording, or telephone call. Also reject requests to send cryptocurrency to “verify” an account, unlock a migration, pay a release fee, or prove ownership. A transaction sent to an attacker is normally irreversible.
5. Examine the claim, not the branding
Scammers commonly claim that an account will be frozen, assets will disappear, a wallet must be synchronized immediately, or a regulation requires an urgent transfer. They may use copied logos, realistic terminology, fake case numbers, or a caller ID that appears familiar. None of those details authenticates the site.
Ethereum.org says blockchain transactions cannot be reversed by a support team. Bitcoin.org likewise warns that legitimate support does not ask for seed phrases or private keys. Promises to recover funds for an upfront payment are especially dangerous: recovery offers that arrive after a scam are a common second scam.
6. Treat directories as context, not approval
A wallet directory can help you identify software, but inclusion does not authenticate every separate migration service or link that mentions the wallet. Ethereum.org describes directory criteria such as security testing and active maintenance while making clear that listings are informational, not endorsements.
Use a listing to identify the provider, then leave the directory and verify the migration route on that provider’s own independently confirmed site. Do not infer an affiliation from a logo, a directory badge, a social-media follower count, search ranking, or testimonials.
7. Ask through a known-real contact route
If the instructions remain unclear, contact the provider using support details published on the verified official site. Do not reply to the suspicious message or trust a caller or direct-message account that contacted you first. The Federal Trade Commission advises consumers to contact a company through a website or telephone number they already know is real. Ethereum.org also says its site will not contact users first.
Signals that should make you stop
| Signal | Why it is risky | Safer response |
|---|---|---|
| An unsolicited message says migration is mandatory today | Urgency is designed to prevent independent verification. | Close the message and start from a saved bookmark or manually verified provider address. |
| The page asks for a seed phrase or private key | The requester could recreate and control the wallet. | Do not submit anything; leave the page. |
| A caller or support agent asks you to move funds | Sending funds to an attacker cannot normally be reversed by support. | End the contact and use the provider’s official support route. |
| The site has the right logo but a slightly different domain | Look-alike domains and redirects can imitate a legitimate brand. | Compare the exact address with the one published in official documentation. |
| An app appears in search or an app marketplace without an official link | Phishing applications can be distributed through those channels. | Reach the listing from the provider’s verified website. |
| A directory lists a wallet used by the site | A listing does not prove that a separate service is affiliated. | Verify the service independently with the wallet provider. |
| The service promises guaranteed recovery for a fee | Post-scam recovery offers are a frequent second fraud. | Do not pay or share more information. |
Compare legitimate migration routes before choosing one
Sometimes a provider offers more than one genuine route, such as an in-app upgrade, a new official application, or restoration in a compatible wallet. Compare the routes on the following questions rather than on appearance or popularity.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
| Question | What to verify |
|---|---|
| Where did the route originate? | The exact flow is documented on the provider’s independently verified official site. |
| What secrets are required? | No website, support agent, or unrelated service receives your recovery phrase or private key. |
| Is it compatible? | The provider identifies support for your wallet, chain, account type, network, and relevant software version. |
| How is the software maintained? | It comes through an official distribution route and has an identifiable maintenance and security process. |
| Who controls recovery? | You understand whether the wallet is self-custody or whether a centralized platform controls the account. |
Ethereum.org explains that many wallet providers supply an interface rather than custody of assets, while centralized exchanges control accounts on their own platforms. That distinction affects what “migration” means: importing a wallet into compatible self-custody software is not the same as transferring assets to a custodial account.
What to do if you already interacted with the site
If you entered a recovery phrase or private key
Assume the secret is compromised, even if the site displayed an error or nothing happened afterward. From a clean, trusted device, use a wallet application or workflow independently verified as official. Create a new wallet and move remaining assets to it. Do not reuse the exposed phrase, and do not wait for the suspicious site to respond.
For Ethereum assets, review and revoke token approvals where relevant. Change passwords on associated exchange accounts and enable two-factor authentication there. A password change does not repair an exposed wallet phrase, so the funds must be moved to a wallet controlled by a new secret.
If you only connected the wallet
Connection alone is different from signing a transaction, but it can reveal account information and may leave permissions that should be reviewed. Use trusted wallet and network tools to inspect connections and approvals. The available official guidance does not establish one universal cleanup procedure for every chain or wallet, so follow the provider’s documented steps for your network.
If you signed a transaction
Identify exactly what you approved before taking further action. A transaction may transfer assets, grant a token allowance, or perform another contract operation. For Ethereum, official scam guidance recommends revoking token approvals after a suspected scam. Because blockchain transactions are generally irreversible, a support team cannot simply cancel a signed transfer.
If someone offers recovery help afterward
Do not pay a person who contacts you claiming to be a hacker, investigator, official, or recovery specialist. Do not provide another phrase, private key, password, or remote access. Treat the unsolicited offer as a possible second scam and use only contact details obtained independently from the provider.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Hardware wallets: an option, not a legitimacy test
Hardware wallets store private keys offline and can reduce exposure to malicious websites, but owning one does not make a suspicious migration page safe. You still need to verify software, domains, transaction details, and signing requests.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
If you choose this custody model, Bitcoin.org advises buying hardware from the manufacturer or an authorized reseller. No particular model or retailer is required for the legitimacy checks in this article. A hardware wallet cannot protect funds if you disclose its recovery phrase or approve a malicious transaction.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHow to verify before signing or sending
- Confirm that the destination address and network match the provider’s independently verified instructions.
- Read the wallet’s transaction or approval prompt instead of accepting a request based on the site’s description.
- Check whether the action is a transfer, token allowance, contract interaction, or account change.
- For a large balance, test the documented process with a small amount only when the route is already verified and the recipient address is independently confirmed.
- Keep records of the official instructions and the address you verified, so a later redirect or message cannot silently change the destination.
Verify every transaction before signing or sending. Ethereum.org and Bitcoin.org both warn users to check addresses and transactions because completed blockchain transfers are generally not reversible.
Frequently misunderstood points
“The message knew my wallet address, so it must be official.”
Wallet addresses are often public. Knowing one does not prove that the sender controls the wallet provider, support channel, or migration system.
“The site uses HTTPS, so it is safe.”
HTTPS protects data in transit between your browser and the site. It does not certify the site owner or prevent a phishing domain from using encryption.
“The wallet is listed in a reputable directory, so every related tool is safe.”
A directory entry can provide background about a wallet but does not endorse separate migration tools, support accounts, or links.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →“I need to reveal the phrase so the service can migrate my funds.”
A phrase may restore a wallet inside compatible, trusted wallet software, but a migration website or support agent should not receive it. If a service requires disclosure, do not use that service.
A short decision checklist
- Did I initiate this migration, or did an unknown party create the urgency?
- Did I reach the provider through a bookmark or independently verified address?
- Does the exact domain match the provider’s documentation?
- Is the software linked from an official distribution route?
- Does the workflow avoid recovery phrases, private keys, passwords, and one-time codes?
- Is compatibility with my wallet, chain, account type, and version documented?
- Do I understand who controls the keys and how recovery works?
- Have I read and independently verified every address and transaction before signing?
If you cannot answer each applicable question confidently, do not connect, sign, send, or disclose anything. Close the page and verify the route with the provider through a known-real channel.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
