Seed phrases and “connect wallet” traps
A recovery phrase is the master key to a wallet. Whoever has it controls everything in it, permanently. Most wallet thefts come down to someone being persuaded to hand it over.
What a seed phrase is
It is a list of 12 or 24 words that can recreate your wallet on any device. It is also called a recovery phrase, secret phrase or mnemonic. Your wallet app shows it to you once, so you can back it up. It is never needed for everyday use.
Who may ask for it
Nobody. Not wallet support, not an exchange, not an airdrop, not a “validation” page and not someone in a Telegram message. The only time you type it is when you restore your own wallet into an app you installed from the official source yourself.
The two traps
1. The page that asks for the phrase
A page copies a wallet's look and shows a form: “Import wallet”, “Validate”, “Recover access”. Anything you type goes straight to the attacker. Signs: a field asking for 12 or 24 words, a form that sends your data to a different site, a brand-new domain, or a name that is slightly off.
2. The “connect wallet” prompt on a fake site
Connecting a wallet does not hand over your phrase, but a fake site can then ask you to sign a transaction that empties your wallet or grants an attacker permission to move your tokens. Read what you are asked to approve. If a site you reached through a message promises a bonus for connecting, treat that as a warning.
If you already entered a phrase somewhere
- Assume the wallet is compromised. Create a new wallet in your wallet app, which gives you a new phrase.
- Move whatever is left to the new wallet right away, starting with the most valuable.
- Do not keep using the old wallet. Anything sent to it later can be taken by whoever has the phrase.
- If funds were taken, keep the transaction details. You can report the address to the relevant exchange or wallet provider. Recovery is rare, so speed matters more than anything else.
Never share a recovery phrase with anyone, including Plumbline. If a message or page asks for one, stop.
Where Plumbline fits
When you send a link, Plumbline reads the page's HTML (without running its scripts) and reports if it has a field asking for a recovery phrase or private key, a wallet-connection prompt, a password form, or a form that sends data to another site. It also notes when the page imitates a known service. A page with none of those can still be harmful, so read the list of what was checked.