Recommended Free Tools
Assume the wallet is compromised. Stop using the exposed recovery phrase, use a device you trust to create a completely new wallet with a newly generated phrase, and transfer any remaining assets to it as soon as you can. A wallet-app password, PIN, dApp disconnection, or hardware wallet does not make an exposed phrase safe again. Then review token approvals, secure linked accounts, preserve evidence, and treat any promise of guaranteed recovery as a likely scam.
Why an exposed seed phrase is an emergency
A seed phrase (also called a recovery phrase) is the master backup for a wallet. Anyone who obtains it may be able to recreate the wallet elsewhere, derive its private keys, and sign transactions without your app password, phone, or hardware device. The practical rule is simple: if you typed the phrase into an unfamiliar website or app, sent it in a message, stored it in an online note or cloud folder, photographed it, or showed it to someone you do not fully trust, treat it as compromised.
As an Amazon Associate I earn from qualifying purchases.
Changing the wallet application’s password or unlocking PIN does not retire the phrase. Disconnecting a site does not invalidate it, and moving funds out does not change the status of the old wallet. The phrase remains known to whoever saw or captured it, so the old wallet should never again hold assets you want to protect.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallBlockchain transfers are generally irreversible. The priority is therefore to protect assets that are still present, not to spend time proving exactly how the phrase leaked.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Do these things first
- End the suspicious interaction. Close the phishing page, stop messaging the supposed support agent, and do not run commands, install remote-access software, or download a “security” tool supplied by an unknown person.
- Choose a trustworthy device. If the phone or computer that held the phrase may have malware, use a different device that is up to date and obtained from a trusted source. Do not create the replacement wallet on a device you suspect is being monitored.
- Create a new wallet and phrase. Generate it in the wallet software or hardware wallet you intend to keep using. Do not import, reuse, or “change” the exposed phrase.
- Move remaining assets promptly. Send funds to the new wallet, carefully checking the destination address and the correct network before confirming.
- Inspect permissions and accounts. Review token approvals, disconnect unknown decentralized applications (dApps), change passwords for linked exchange accounts, and enable two-factor authentication where available.
An attacker who has the phrase may act at any time. No procedure can guarantee that a transfer will arrive before an attacker spends the balance, so work methodically but do not delay.
Work out what was exposed
You do not need to disclose your phrase to anyone for diagnosis. Classify the event from your own records and act at the highest-risk level that fits.
| What happened | Primary risk | Required response |
|---|---|---|
| The phrase was entered on a website, in an untrusted app, or sent to another person | Full wallet control may be possible | Create a fresh wallet on a trusted device and migrate remaining assets immediately |
| The phrase was stored in cloud notes, email, a password manager account with a suspected breach, or an online photo | Copying or later account access may reveal the keys | Treat it as compromised; migrate funds and secure the account that stored it |
| You connected to an unfamiliar dApp but did not reveal the phrase | A connection alone usually does not transfer assets; signed approvals or transactions can grant permissions | Disconnect the dApp, review approvals, and revoke suspicious permissions |
| You signed an unfamiliar approval or transaction | The contract may be authorized to move specified tokens or perform another action later | Revoke the approval promptly and still migrate if the phrase may also have been exposed |
| You only changed an app password or PIN | The recovery phrase remains valid | Do not treat this as remediation; create a new wallet and move assets |
If there is any uncertainty between these cases, use the full-compromise response. A false alarm costs a new wallet and a transfer; assuming a leak was harmless can cost everything in it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsCreate a replacement wallet safely
Use a device you can trust
Install wallet software only from the developer’s official distribution channel. Update the operating system and browser, remove unneeded extensions, and avoid using a device that recently showed pop-ups, unknown applications, remote-control sessions, or unexplained account activity. If you cannot establish that the existing device is clean, create the wallet on another trusted device. Never ask a stranger to create it for you.
Generate a genuinely new phrase
Start the wallet’s “create new wallet” or equivalent setup flow. Confirm that the phrase is generated by the wallet itself and is not supplied by a website, chat message, recovery service, or support representative. Write the words down offline in the order displayed. Do not photograph them, paste them into a document, email them, or store them in an internet-connected note.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
During setup, complete the wallet’s verification exercise without exposing the words to a camera or screen-sharing session. Keep the written backup in a private, access-controlled location. Anyone who obtains this new phrase can control the replacement wallet, so support staff should never need to see it.
Understand the hardware-wallet option
A hardware wallet can reduce exposure of private keys to online attacks because key operations take place on a dedicated device. It is an option worth considering for a new wallet, particularly for larger holdings, but it is not a repair for the old one. Buying a device cannot revoke a phrase that has already been disclosed, and a hardware wallet does not make a malicious token approval harmless.
When using one, enter its recovery phrase only directly on the device during initial setup or recovery, as advised by the Singapore Police Force. A website asking you to type that phrase into a form is a phishing warning. Keep the device, its backup, and any passcode under your control; verify addresses on the device’s own screen before approving transactions.
Transfer what remains to the new wallet
- Open the new wallet and copy its receiving address for the exact asset and network you intend to use.
- Compare the first and last several characters of the address on the sending device with the address displayed by the receiving wallet. For high-value transfers, verify the complete address using a second trusted viewing method.
- Check the network. Sending an asset over the wrong chain can make it difficult or impossible to recover.
- Send a small test amount when practical, wait for confirmation, and then send the remainder. Account for network fees and leave enough native currency in the old wallet to pay them.
- Confirm the transaction in a block explorer or the wallet’s transaction history. Save the transaction hash and destination address for your records.
Do not keep using the old address for new deposits after migration. If an exchange, employer, client, or recurring payment still uses the old address, replace it with the new one and explain that the former address is no longer safe.
If an attacker is actively draining the wallet, a test transaction may give them time to take the balance. In that situation, prioritize a carefully checked full transfer, using a trusted device and the correct fee settings, rather than broadcasting a sequence of unnecessary transactions.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Review token approvals and dApp connections
Seed-phrase compromise and malicious approvals are different incidents and can occur together. A dApp connection by itself generally does not authorize a transfer. A signed approval can let a contract spend specified tokens later, while a signed transaction can execute an immediate action. The risk exists even when the private key is held on a hardware wallet: the device can protect the key while you are still authorizing a harmful request on its screen.
Disconnect unfamiliar applications
Open the wallet’s connected-sites or dApp-connections area and remove entries you do not recognize or no longer need. Disconnecting prevents some future requests but does not cancel approvals already recorded on-chain.
Revoke suspicious permissions
Use the wallet’s approval-management feature or a reputable block-explorer approval tool for the relevant network. Examine token, spender, allowance, and chain details before submitting a revoke transaction. Revocation itself usually costs a network fee and only affects the permission; it cannot undo a transfer that has already completed.
If the seed phrase was exposed, perform this review after moving the remaining assets. Revoking an approval is not a substitute for migrating to a wallet with a new phrase.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Secure exchanges and other linked accounts
A wallet compromise can expose more than on-chain assets if the same device or email account was used elsewhere. Change passwords for linked exchanges and financial services from a trusted device. Use unique passwords and enable two-factor authentication, preferably an authenticator app or security key where the service supports it. Review active sessions, API keys, withdrawal addresses, and login alerts; terminate sessions and remove credentials you do not recognize.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Secure the email account that receives exchange notifications or password resets before changing other passwords. Check whether an attacker changed recovery details, forwarding rules, phone numbers, or withdrawal whitelists. Contact the provider through the address or help center shown in its official application or website, not through a phone number or direct message supplied by the person who contacted you.
If funds are already missing
Do not assume a new wallet will bring stolen assets back. On-chain transactions generally cannot be reversed by a wallet provider, exchange, or police agency. Move any remaining funds first, then preserve evidence without clicking suspicious links again.
- Record the affected wallet addresses, destination addresses, transaction hashes, token contracts, network names, and timestamps.
- Save screenshots, emails, chat messages, domain names, advertisements, and the exact wording of any impersonated support request.
- Report the incident to the relevant exchange or wallet provider through its official channel and to local law-enforcement or cybercrime reporting services.
- Tell contacts who may have received a fraudulent message from your account, but do not publish your recovery phrase or private keys.
Anyone promising guaranteed recovery in exchange for an upfront fee, remote access, another phrase, or a “verification deposit” is presenting a classic recovery scam. A legitimate provider will not need your seed phrase to investigate a transaction.
How to choose between wallet setups after migration
| Setup | When it may fit | Important limitation |
|---|---|---|
| Software wallet on a newly trusted device | Small or frequently used balances where convenient signing is important | The device and operating system remain part of the security boundary |
| Hardware wallet with a new phrase | Longer-term or larger holdings where keeping keys away from the normal computer is valuable | It cannot rescue an exposed phrase or prevent you from signing a malicious approval |
| Wallet created on the possibly infected device | Not appropriate while malware or remote access is suspected | An attacker may capture the new phrase or transaction details |
Compare any future wallet by how it generates and stores keys, how it presents recovery phrases, which assets and networks it supports, how clearly it displays transaction and approval details, how recovery works if the device is lost, and whether setup requires trusting a potentially compromised computer. No wallet type removes the need to verify addresses and signatures.
Prevent another phrase exposure
- Keep the recovery phrase offline and separate from the device that uses the wallet.
- Never enter it into a website, form, chat, survey, screen-sharing session, or support ticket.
- Ignore unsolicited “account recovery,” “airdrop,” “security upgrade,” and “wallet verification” instructions.
- Bookmark official support pages and navigate to them yourself instead of following links in messages.
- Read transaction and approval details on the wallet’s trusted display before signing.
- Review connected dApps and token allowances periodically, especially after using unfamiliar applications.
- Maintain a written inventory of wallet addresses and networks without recording the secret phrase in the same place.
The decisive sequence is always the same: stop the suspicious contact, create a new wallet with a new phrase on a trusted device, migrate what remains, then clean up approvals and linked accounts. The exposed phrase is retired only in the sense that you stop using that wallet; it is never made secret again.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
