A wallet phrase handed over
Ranks here rather than higher only because it is uncommon. When it happens it takes everything, immediately, with no partial outcome.
- How often
- Uncommon
- Typical size
- The whole wallet
- Recoverable
- Never
- Cost to prevent
- Nothing
The framings it arrives in
- Migration. The wallet system is changing and yours needs moving.
- Verification. Confirm the wallet belongs to you before a withdrawal clears.
- Recovery. You reported a problem, and this is presented as the fix.
- A support process. Somebody presenting as staff, on a channel that does not exist.
- A form on a page. Sometimes with no human involved, which makes it feel procedural rather than personal.
Why the answer has to be flat
Because every version is designed to be reasonable, and assessing reasonableness is what the pressure is aimed at. A rule that says never requires nothing of you in the moment. A rule that says only if it seems legitimate requires exactly the judgement being attacked, at exactly the moment it is weakest.
If it already happened
Move whatever remains to a new wallet immediately and do nothing else first, including looking at the platform. This is one of the very few places in this table where genuine urgency applies, and it applies because something has already gone wrong rather than because somebody is offering you something.
Afterwards, work out which channel put the request in front of you. Almost always it arrived somewhere that cannot prove anything about itself, and almost always it was believed because of where it was found rather than because of anything it demonstrated.
Why the request works at all
Because most people do not hold a clear model of what a recovery phrase is. It reads like a password, and passwords get typed into things routinely. It is not a password. It is the wallet, in a form that can be written down, and handing it over is handing over the contents rather than permission to look at them. Once that sentence is understood, no framing survives it.
What legitimate processes actually ask for
| Task | What is needed | What is never needed |
|---|---|---|
| Receiving funds | A receiving address | Anything private |
| Sending funds | Access to your own wallet software | Nothing shared with anybody |
| Proving you control an address | A signed message | The key itself |
| Restoring your own wallet | The phrase, typed into your own software offline | It never leaves your machine |
The fourth row is the only legitimate use of the phrase, and it happens on your own machine with nothing transmitted anywhere. Any process that involves sending it, pasting it into a page, or reading it to somebody is outside that.
Storage, since it has to live somewhere
- Written down, offline, which is the boring answer and the right one.
- Not in a photo. Photo libraries sync automatically and software reads text in images.
- Not in notes that sync, for the same reason.
- Not typed into anything that did not come from your wallet software, including anything claiming to check whether a phrase is valid.