Why you should never share your seed phrase

CrabChain.org Team | Updated 13 October 2026

In the cryptocurrency ecosystem, there is a security rule that admits virtually no exceptions. The seed phrase, also known as the recovery phrase, should never be shared with another person. Its importance lies in the fact that it is not simply a password used to access an application, but a cryptographic element that can allow the private keys associated with a wallet to be reconstructed and, with them, control over the digital assets linked to certain addresses. Anyone who obtains that information may eventually have the same control capabilities as the legitimate owner, even without access to the phone, computer, or original application.

The confusion often begins because a wallet does not work like a conventional bank account. At a financial institution, the user identifies themselves to a centralized infrastructure that verifies their identity and applies additional mechanisms before authorizing a transaction. With a non-custodial wallet, control resides in the cryptographic keys. The blockchain records balances and transactions, but it does not recognize who a person is in legal terms and does not have a central mechanism capable of reversing a transfer made with the corresponding key. In that model, protecting the private key is a direct responsibility of the owner.

What it is and why it matters

A seed phrase is a human-readable representation of cryptographic information that allows a wallet to be recovered. Many systems use standards such as BIP-39, in which a sequence of words represents a certain amount of entropy and can be used as a starting point for deterministically deriving keys. From that seed, compatible software can reconstruct numerous accounts and addresses according to the applicable derivation rules. Therefore, giving the recovery phrase to a third party is, in practice, giving them the ability to reconstruct cryptographic access to the funds that depend on it.

This principle explains one of the fundamental differences between a seed phrase and a conventional password. A password can be changed if someone is suspected of having obtained it. A compromised seed phrase cannot simply be modified to make the same wallet secure again. Once another person knows the seed, the information is no longer secret. The user can later create a new wallet with a new seed phrase and transfer the assets, but the original secret must be considered compromised. Keeping funds in a wallet whose seed has been exposed means accepting a risk that does not disappear by changing devices or reinstalling the application.

It is also not necessary for the attacker to know the victim's public address for the leak to be potentially dangerous. If they have the phrase and use compatible software, they can attempt to discover the accounts derived from it and check their balances. The risk also increases when the wallet contains different assets, multiple networks, or several accounts derived from the same seed. A single leak can affect an entire self-custody structure, not only an address the owner uses most frequently.

What can be shared

One of the most common mistakes is confusing the seed phrase with other information visible in a wallet. Public addresses can be shared to receive funds. A transaction ID can also be made public, and certain activity data can be viewed in blockchain explorers. None of this makes those elements equivalent to the seed. A public address identifies a destination for a transfer, while the private key and the information needed to derive it allow transactions to be authorized. From a security perspective, the former can be compared to a receiving identifier, while the latter belongs to a completely different category.

Social engineering

The problem is that criminals fully understand this difference and use the confusion to develop social-engineering campaigns. A fake customer-service operation may claim that it needs the seed phrase to validate an account or solve a supposed technical problem. A fraudulent website may display an error message and request the recovery phrase to restore the wallet. There are also scams promising rewards, airdrops, security checks, or urgent migrations that present the field for entering the seed as though it were a normal procedure. In all these cases, the usual goal is to obtain directly the secret that allows control of the funds.

Psychological pressure is an essential part of these techniques. Scammers try to create a sense of urgency, warn of supposed suspicious activity, or present an opportunity that will disappear within minutes. The user may come to believe they are cooperating with a security mechanism when in reality they are providing the information that makes theft possible. One particularly important point is that a legitimate wallet may display warnings related to recovery management, but a request from a company or individual for the complete phrase in order to access the funds should be considered a critical sign of fraud.

Accidental exposure

Exposure does not have to occur through a direct scam either. Photographing the seed phrase and storing the image on a phone introduces unnecessary risks. It can also be dangerous to keep it in cloud-storage services, send it by email, copy it into synchronized note-taking applications, or store it in documents that may be automatically indexed or backed up. The problem is not only that someone might physically see the device. A compromised account, an infected computer, or a poorly protected backup can become indirect channels for obtaining the information.

For this reason, managing a seed phrase should be understood as a matter of protecting a secret, not as a simple administrative task. Offline storage reduces certain digital risks, while a physical copy protected against loss, moisture, fire, or third-party access can provide an additional layer of resilience. In situations where assets are highly valuable, some people use specialized physical-storage solutions or more sophisticated self-custody arrangements. However, even the most advanced system loses its usefulness if the seed phrase ends up circulating through a chat, a photograph, or a fraudulent website.

Another important point is understanding that the most vulnerable people are not always those who lack technical knowledge. An experienced user can become a victim precisely because they are familiar with real recovery and transaction-signing processes. Attackers can imitate the language used by legitimate applications quite accurately and build visually convincing pages. Technical knowledge helps, but it does not eliminate the basic security principle. No urgency, promotion, technical-support procedure, or verification process should justify giving a seed phrase to a third party.

If you think it has been exposed

If a person suspects that their recovery phrase has been shared, photographed, entered on a website, or stored in a compromised environment, the priority should be to assume that the secret is no longer secure. The appropriate response is to quickly assess the exposure and, where appropriate, create a new wallet from a trusted environment and move the assets to the new addresses. It is also important to review possible contract approvals and other authorization mechanisms when decentralized applications have been used, because the security risk is not always limited to the seed.

The true function of a seed phrase is to allow recovery of control over a wallet. Precisely because of that capability, it should be treated as one of the most sensitive pieces of information in self-custody. A public address can be shared to receive cryptocurrency, but the recovery phrase belongs to the category of secrets that must not be disclosed. In a system where there is no central authority capable of canceling a transfer signed by the corresponding key, protecting that information is not a secondary recommendation, but one of the fundamental conditions for maintaining control over digital assets.

Sources

• BIP-39: Mnemonic code for generating deterministic keys — Bitcoin Improvement Proposals
• Ethereum security and scam prevention — ethereum.org