Seed Phrase Compromised? What to Do Before You Trace Stolen Crypto

Assume total wallet compromise

Anyone with your seed phrase can derive all past and future addresses from that wallet. Revoking approvals helps on EVM, but the attacker can sign new txs at any time until you abandon the wallet entirely.

• Never enter your seed phrase on any website, Telegram bot, or “support” form — including fake Tracefunds look-alikes.
• Create a new wallet on a clean device with a new seed phrase you have never typed online.
• Do not store the new seed in the same cloud backup as the old one.

If funds are still moving

• Document outbound txs on the correct explorer immediately — hashes, times, recipients.
• Do not send more crypto to the compromised wallet hoping to “beat” the drainer.
• Priority is evidence for exchanges and law enforcement, not on-wallet recovery.

How seed phrase scams happen

• Fake wallet support DMs after you post about a hack.
• Phishing sites that look like MetaMask, Phantom, or hardware wallet updates.
• Malware or clipboard hijackers swapping paste addresses.
• “Validate” or “sync” wallet prompts on malicious dApps.

Tracing after key compromise

On-chain tracing still works — public outbound transfers are visible without your seed. Paste the compromised address into tracefunds.app/analyze (no wallet connect).

• $20 incident report for full outbound fund-flow graph.
• File IC3.gov (US) or local cybercrime report — include tx hashes.
• See exchange abuse guide if flows hit labeled CEX deposits.

Avoid the second scam

Recovery services that contact you first, ask for upfront crypto, or request your seed again are almost always fraud targeting victims twice.

Prevention for the new wallet

• Hardware wallet for large holdings.
• Separate hot wallet for experimental dApps.
• Periodic approval audits ($10) on EVM and SPL delegate review on Solana.