Did you accidentally enter your crypto seed phrase on a fake phishing site, and your coins haven't been transferred away yet? Don't panic, but you have to act immediately. You are racing against a thief that is already heading to your assets.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
As long as your assets are still in the old wallet, you can save them. The only core rule is: use a 100% safe device to create a brand new wallet, and transfer all assets from your old address to the new one in one go.
Step 1: Immediately cut off the old device's internet connection
Goal: Stop attackers from continuing to monitor your operations via malware or remote control tools.
How to do it: For the phone or computer you used to enter the seed phrase on the fake site, turn on Airplane Mode directly (for phones) or unplug the network cable and disconnect WiFi (for computers). This device is now confirmed "compromised" -- do not reconnect it to the internet until you fully scan and remove malware or reinstall the system.
Completion check: The device status bar shows no internet connection. Attackers can no longer get any new information from this device.
Common mistake to avoid: Many people think "I only entered the seed phrase and didn't click any links, so my device can't have malware". But phishing sites may implant malware or keyloggers in the background the second you open the page. Disconnecting the internet is not to prevent your seed phrase from leaking (it is already leaked) -- it is to stop attackers from seeing your next steps of creating a new wallet through the backdoor.
Step 2: Create a new wallet with a separate clean device
Goal: Generate a brand new address whose seed phrase only you control, to be the safe destination for your asset transfer.
How to do it: Find a spare phone or computer that has never visited any suspicious site, and never entered a seed phrase. Download your commonly used crypto wallet app only from the official website or official app store, create a completely new wallet, and write down your new receiving address.
Completion check: You get a brand new wallet address, whose seed phrase is only written on your physical paper, and has never been stored or transmitted on any internet-connected device.
Core reminder: The seed phrase is the only proof of ownership of your wallet. Anyone who gets it can transfer away all your assets directly. Never enter your seed phrase again on any webpage, chat box, email, or private message -- no matter who claims to be customer support or "official verification". There are no exceptions.
Step 3: Transfer all old assets to the new address on the clean device
Goal: Complete the asset transfer before the attacker does it first.
How to do it: Open the new wallet on that clean device. Initiate a transfer, and send all assets (main coins and all other tokens) from your old wallet address to the new address you generated in Step 2 in one transaction. Set the gas fee to the current average level of the blockchain network: too low a fee will make your transaction pending for a long time, and the attacker may front-run your transfer at any time during that window.
Completion check: You can find the transaction hash of this transfer on a blockchain explorer (such as Etherscan, Tronscan), the status shows "Successful", and you can see all corresponding assets arrived in your new wallet.
Note: If you have DeFi staked assets in the old wallet, you need to unstake them first before transferring. This type of operation has more steps and takes longer. Prioritize transferring all unlocked assets first, handle complex operations later, because every extra step you take increases the risk of being front-run by the attacker.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Step 4: Abandon the old address completely and use the new address going forward
Goal: Cut all connections of the old address, to ensure all your subsequent operations are safe.
How to do it: After confirming all assets are fully received in your new wallet, permanently discard the old seed phrase and private key of the old wallet. If you have used any DApp authorization on the old address, go to the "Authorization Management" tool on the blockchain explorer now, and revoke all authorizations for suspicious contracts. Even if the old address is empty now, revoking authorizations can prevent attackers from using remaining permissions to carry out malicious operations later.
Completion check: There are no unrecognizable suspicious contracts in your authorization list. You will no longer use the old address for any coin receiving or sending operations.
Final validation after all operations: All assets are received in the new wallet, and the transfer records are publicly verifiable on the blockchain explorer. All authorizations of the old address are cleared.
What to do next: Run a full malware scan on the old compromised device, or directly reinstall its system. Then share this guide with your friends who also use crypto wallets -- the more people know how to handle seed phrase leaks in advance, the fewer people will lose their crypto assets to phishing attacks.
