What to Do If You Entered Your Seed Phrase on the Wrong Website
What to Do If You Entered Your Seed Phrase on the Wrong Website
Assume your seed phrase is compromised and act immediately. If you entered your seed phrase on the wrong website, treat it as if you handed your keys to a stranger, because you may have. Move your bitcoin to a fresh wallet with a brand new seed phrase as fast as you can, then retire the old phrase for good.
If you entered your seed phrase on the wrong website, here is why it is an emergency
A seed phrase is the master key to your bitcoin. Anyone who holds the full set of words can restore your wallet on their own device and move your funds, with no password and no second factor standing in the way. When you type those words into a website, the site owner receives them in plain text, and there is no way to take them back. The Never Lose Bitcoin guides explain the wider backup practices that show why this rule exists.
The wrong website usually looks like the right one. Fake wallet restore pages, phishing links sent by email or chat, scam “support” portals, fake firmware update pages, and giveaway sites that promise free coins all exist to collect one thing: your words. Some are run by humans, others by scripts that sweep funds from a compromised phrase within minutes. The moment you realize what happened, you are in a race.
One important rule for the future: a legitimate wallet never asks for your seed phrase on a website. Real wallets ask for the words only inside the trusted app during a restore you started yourself. Any website asking for your seed phrase is either a scam or so broken you should not trust it anyway.
Step 1: Move your bitcoin to a fresh wallet immediately
Do not wait to confirm whether the site was a scam. Speed matters more than certainty. Open a trusted wallet, ideally a hardware wallet, generate a brand new seed phrase, and write it down on paper or stamp it into metal. Then send your full bitcoin balance from the compromised wallet to a receive address on the new wallet. If the device you used to visit the phishing site feels tainted, create the new wallet on a different device instead. The move itself is explained in detail in how to move bitcoin to a new wallet with a fresh seed phrase.
Move everything, not just the bitcoin. If the same seed phrase also holds other coins or tokens, transfer those too. An attacker with your words controls every address derived from them. While you are moving funds, do not reuse the old seed phrase anywhere. Do not type the old words into any tool, site, or service to verify anything. Every place you enter the words is another place they could leak.
Step 2: Check whether a passphrase changes the picture
If your wallet used a passphrase, the extra 25th word, and you did not type it into the site, your funds may still be protected. A passphrase creates a separate hidden wallet that cannot be derived from the seed words alone. If the phishing site never asked for it and you never entered it, the attacker only has half the secret.
Do not treat this as a reason to relax. Move your bitcoin to a fresh wallet anyway. The seed phrase alone still controls the default wallet, and any funds sitting there are exposed. If you typed both the seed phrase and the passphrase into the site, consider everything fully compromised.
Step 3: Retire the old seed phrase for good
Once your funds are safe in the new wallet, the old seed phrase is garbage. Never use it again for real money. A compromised seed phrase can never be uncompromised, and there is no expiry date on the knowledge an attacker has.
Destroy the old backups properly. Paper copies should be shredded or burned, and metal backups should be melted or disassembled beyond recovery. The point is not to erase your memory of the words, it is to make sure no one else can ever use them. For the full method, read how to safely destroy an old seed phrase backup.
How to tell if the website was a scam
Some sites are obvious fakes in hindsight. Check the URL character by character, since phishing domains swap letters, add hyphens, or use unfamiliar endings. Ask yourself how you arrived there. If it came from an email, a direct message, a search ad, or a link someone sent you, that is a strong signal it was not legitimate.
Watch for the classic pressure tactics. Promises of free bitcoin, bonus coins for “verifying” your wallet, warnings that your funds will be frozen unless you act now, and support agents who ask for your words to “fix” something are all scam markers. No real support team ever needs your seed phrase.
Report the phishing site
Once your funds are safe, help protect the next person. Report the phishing URL to the brand being impersonated, since most wallet makers publish a security contact or a scam reporting address. You can also report the site through your browser’s phishing report tool. Do not try to investigate the scammers yourself. Your only job was securing your bitcoin, and that job is done.
How to prevent it from happening again
Make phishing attempts physically harder to fall for. Bookmark the real websites of the wallets and services you use, and open them only from those bookmarks. Never click a wallet link from an email, a direct message, or a comment section. If someone sends you a link that looks official, type the address yourself instead.
Download wallet software only from the maker’s official site, and verify the download against the published checksums or signatures when the maker provides them. Updates arrive inside the app or through your normal package manager, never through a link in an email. A “firmware update” page that asks for your seed phrase is a scam, always.
Type your seed phrase only into your own trusted wallet software, only during a restore you chose to start. If anything unexpected asks for the words, stop and close the page. Keep your backup offline, on paper or metal, stored somewhere the internet cannot reach. A seed phrase that never touches a keyboard cannot be phished.
Quick answers
I entered my seed phrase on the wrong website. What is the first thing to do? Move your bitcoin to a fresh wallet with a new seed phrase right now. Do not wait to confirm the site was a scam, and do not type the old words into anything else in the meantime.
The site looked real. Was it still a scam? Probably. Real wallet sites never ask for your seed phrase. Treat any site that collected your words as compromised, and secure your funds before investigating the site.
I used a passphrase the site never asked for. Am I safe? The passphrase-protected wallet is likely still safe, but the default wallet is not. Move everything to a fresh wallet anyway, since the seed words alone are enough to drain the default wallet.
Can I change my seed phrase instead of moving everything? There is no way to change a seed phrase in place. The only fix is to create a new wallet with a new seed phrase and transfer the bitcoin to it, then retire the old phrase.
Should I try to get the site taken down? Yes, report it to the impersonated brand and through your browser’s phishing report. But do this after your funds are safe, not before.
