How to prove a wallet is yours without handing over your key

What «proving it is yours» means (and why I ask for it)

A recovery service without proof of ownership is not a recovery service: it is a way to open someone else’s wallet. Proof is the one thing that separates this work from theft. And it also protects you: it is what lets me turn down a case that smells stolen.

The good news is that proving it is usually easy and safe, and it never means handing over your recovery phrase or your private key.

The best proof: signing a message

Your wallet holds a secret key. That key can place a unique «signature» on any text you choose, like a stamp that cannot be forged. Anyone can check, using only your public address, that the signature came from the owner of that address. The magic is that it proves you control the address without revealing the key and without moving a cent. It is the perfect proof.

The only requirement is being able to open the wallet in order to sign. If you have lost access completely, skip to the section below. But many people can still open it (they remember the app password even though they lost the phrase, or they have a related wallet): for them, signing is ideal.

Step by step: how to sign a message

The idea is always the same: I send you an exact text to sign (with today’s date in it, so that signature cannot be reused elsewhere), you paste it into your wallet’s «sign message» feature, you sign, and you send me back the result. Do not change the text by a single character. Here is how in the most common apps.

MetaMask and browser wallets

1. Go to etherscan.io/verifiedSignatures and click «Sign Message».
2. Connect MetaMask and choose the account (the address) you want to prove.
3. Paste the exact text I sent you, changing nothing.
4. Click «Sign» and confirm in the MetaMask window.
5. Copy the signature that appears.
6. Send me the signature together with the address and the message. MetaMask only asks you to confirm; it will never ask for your phrase. If a website asks for the phrase in order to «sign», it is a scam: close it.

Electrum (Bitcoin)

1. Open Electrum with your wallet.
2. Menu «Tools» → «Sign/verify message».
3. In «Address», put one of your addresses (or pick it from the «Addresses» tab).
4. In the large box, paste the exact text I sent you.
5. Click «Sign»; it will ask for the wallet password.
6. Copy the signature and send it to me with the address and the message.

Bitcoin Core

1. Open Bitcoin Core and go to «Window» → «Sign message» (depending on the version, it may be under «File»).
2. Paste an address of yours that starts with «1». Ones starting with «bc1…» do not work here; for those use Electrum or Sparrow.
3. Paste the exact text into the message box.
4. Click «Sign»; if the wallet is encrypted, it will ask for the password.
5. Copy the signature and send it to me with the address and the message.

Hardware wallets (Ledger, Trezor). You sign from their own app (Ledger Live, Trezor Suite) or by connecting the device to Electrum or MetaMask; you confirm the signature on the device’s little screen. The device never shows your key: that is why it is so safe.

Mobile wallets (Trust Wallet, Coinbase Wallet…). Many do not have «sign message» readily available. If yours can, it will be in settings or by connecting via WalletConnect to the Etherscan tool above. If it cannot, no problem: we use the alternative proofs at the end.

Careful: signing is not always harmless

Signing a plain, readable text is safe. What is dangerous is signing things you cannot read: a website that opens a «signature request» full of code may be authorising someone to take your tokens. The rule is simple: only sign a clear text that I sent you and that you can read in full, and do it from your wallet’s app, never from some random website that asked you to «connect to verify». If you do not understand what you are about to sign, stop and ask me.

If you can no longer get into the wallet

If you could sign, you probably would not have written to me. So proof is built by piling it up: no single piece has to be perfect on its own; together they leave no reasonable doubt.

• Where the money came from: the withdrawal receipt from the exchange you sent it from, with its date and the destination address.
• An address of that wallet with movements you recognise.
• Emails from the app or the manufacturer.
• The wallet file in its original place, with its dates.
• Another related wallet of yours that you can sign from.
• The device’s box or the recovery card.
• The purchase invoice.

What is never proof

Sending the recovery phrase. Having it does not prove the wallet is yours — a thief would have it too — and no serious service asks for it to «verify» anything. If a provider accepts your case without asking for any proof of ownership, read it the other way round: they have just shown you they would accept a stolen wallet all the same.

And the other way round: you verify me

Verification should not run one way only. Ask me for real identity — with the document in view on a video call —, the model contract and, at the end, the id of my fee transaction, to check on the chain that nothing else moved. I ask you for proof of ownership; you ask me for identity.

Keep reading

• I lost one word of my 24-word seed
• Why some passwords are unrecoverable
• The five recovery scams