KeyStone
← All articles

Urgent · Compromised phrase

What to do if you think your phrase is compromised

Act first, analyse later. If there is any reasonable chance someone has seen your phrase, the wallet is no longer exclusively yours, and the only thing that matters now is getting the money out before the other person does.

October 8, 2026 · 4-minute read

The sequence, now

  1. Create a new wallet, from scratch, in an app you install yourself from the official site. Let the new phrase appear only on your screen.
  2. Write the new phrase on paper, by hand. Not on your phone, not in the cloud.
  3. Send all your funds to the new wallet, starting with the most valuable.
  4. Check every network and every account of the compromised wallet. Whatever you leave there, consider lost.
  5. Never use the old phrase again to receive anything.
Don’t change the password believing that fixes it. The password protects the app on your device; the phrase opens the wallet from anywhere in the world. Whoever has your phrase gets in no matter how many times you change the password.

When to consider it compromised

  • You typed it into a website, a form or a chat.
  • It is in a photo, your phone notes or an email.
  • You stored it in the cloud or in a shared document.
  • Someone helped you set up the wallet and saw it.
  • You shared your screen while opening the wallet.
  • It was on paper in a house that has been burgled.
  • The device and the paper were in the same place and you lost both.
When in doubt, treat it as compromised. Moving funds to a new wallet costs a network fee and half an hour. Getting it wrong the other way costs everything.

If you don’t have a balance to pay the fee

It is the hardest situation. You need a small amount to move the money and don’t have it. Send that amount knowing it is a race: there are programs that empty a compromised wallet the same second it receives anything. If it happens twice, stop: you will not win that race, and every attempt is money given away.

Afterwards, calmly

Review how it leaked so you don’t repeat it: a link in a private message, a search advert, a fake app, a cloud copy. And if the money is already gone, the honest answer is in why «we recover stolen crypto» is almost always a lie: what comes next is the second scam, not the solution.

Keep reading