Block data
- A seed phrase is a random sequence of words that allows you to restore your crypto wallet if you lose it or your private key, according to the SEC.
- The SEC advises storing your seed phrase in a secure place and not sharing it with anyone.
- Once created, a private key cannot be changed or replaced; losing it means permanently losing access to the wallet’s crypto.
In traditional finance, a forgotten password is an inconvenience: you call the bank, prove who you are and reset it. In crypto, there is often nobody to call. The FTC warns that if you lose the password to your digital wallet, or it is stolen or compromised, you are likely to find that no one can step in to help you recover your funds. Wallet security comes down to protecting a few pieces of information very well.
What a seed phrase is
The SEC’s custody bulletin explains that many crypto wallets generate a seed phrase, also called a seed recovery phrase, backup seed phrase or mnemonic phrase. It is a random sequence of words that allows you to restore your crypto wallet if you lose it or your private key, or if its hardware or software is damaged or corrupted. The SEC’s instruction is short: store your seed phrase in a secure place and do not share it with anyone.
The reason is simple. Anyone who has your seed phrase can rebuild your wallet on their own device and move your crypto. Treat it as you would the wallet itself, not as a password you can change later.
If you use a hardware device for cold storage, the seed phrase is what lets you recover after the device is lost, damaged or stolen, risks the SEC names for cold wallets.
Private keys, again
Behind every wallet is a private key, which the SEC compares to a password. Unlike a password, once created it cannot be changed or replaced. If you lose your private key, you permanently lose access to the crypto in your wallet. The seed phrase is the backup that makes this survivable; without it, a lost key or a broken device can mean the end of the assets.
Storing a seed phrase
| Do | Avoid |
|---|---|
| Write it down offline and keep it somewhere secure | Typing it into websites, chats, forms or e-mails |
| Consider a second copy in a separate secure place | Taking a photo of it or storing it in cloud notes |
| Tell a trusted person how to find it if something happens to you | Telling anyone the words themselves |
| Check the copy is readable and complete | Keeping the only copy next to the device it restores |
The table applies the SEC’s principle, keep it secure and share it with no one, to everyday situations. Cold wallets, the SEC notes, can include something as simple as a piece of paper, which also means paper can be lost, damaged or stolen. Plan for fire, water and moving house, not only for hackers.
Tip: No legitimate exchange, wallet maker, support agent or government agency needs your seed phrase. Anyone who asks for it, for any reason, should be treated as a thief.
Account security for platform accounts
If you keep crypto with a platform, your login is the weak point. The SEC recommends using strong passwords and multi-factor authentication for access to all online crypto accounts, and keeping the amount and types of crypto you hold private. Telling people what you own makes you a target.
The scams aimed at your keys
- Impersonators. The FTC says scammers impersonate well-known companies and claim there is fraud on your account or your money is at risk. The SEC warns that fraudsters impersonate the SEC and its officials on social media and in text messages, sometimes using real names, photos or the agency’s seal.
- Fake recovery services. The SEC says impersonation scams include pretending to help you get your money back.
- Pop-ups and links. The FTC warns against clicking links in unexpected messages or calling numbers shown in pop-up alerts.
- Fake government letters. The IRS warns of a scam letter with a QR code asking people to register their cryptocurrency on a compliance portal; the IRS does not require registration of digital assets.
If you are unsure whether a message really comes from the SEC, the agency says to call it at (800) 732-0330 or e-mail Help@SEC.gov. Use contact details from the official website, not from the message itself.
If something goes wrong
Act fast, but do not pay anyone who promises to recover stolen crypto for a fee. Report fraud to the FTC at ReportFraud.ftc.gov, the CFTC at CFTC.gov/complaint, the SEC at sec.gov/tcr and the FBI’s Internet Crime Complaint Center at ic3.gov, as well as to the platform you used, the FTC advises. The CFTC adds that recourse for stolen virtual currency is not assured, which is why prevention matters so much.
Wallet types and custody choices are covered in Hot vs Cold Crypto Wallets, and Who Holds Your Keys. The broader list of scams is in Crypto Scams to Avoid: The Patterns Regulators See Most.