KoinlyticsA seed phrase (usually 12 or 24 words from BIP-39's 2048-word list) is a compressed representation of the master key that generates every private key in your wallet. Anyone with those words owns everything the wallet controls.
The rules that never change
- Never type it into a phone or computer that has ever touched the internet.
- Never take a photo of it.
- Never store it in a password manager, cloud drive, email, or notes app.
- Never share it with support, a project's team, or a stranger.
Where to actually put it
Physical, offline, and redundant. Two levels of options:
- Paper. Cheap. Vulnerable to fire, flood, and a snooping roommate.
- Metal. Cryptosteel, Billfodl, or a self-stamped titanium plate. Fire-, water-, and blast-resistant. This is the standard for anything worth $10k+.
Store in at least two geographically separated locations. Home safe + bank safety deposit box is a common setup.
Sharding: SSS and Shamir
Split the seed into N shards, require M to reconstruct. Trezor Model T and some software wallets support Shamir Secret Sharing (SLIP-39). Popular schemes: 3-of-5, 2-of-3. Downside: you now have to secure N pieces instead of one.
Multi-sig or MPC as alternative
For serious amounts, an on-chain multisig (Safe) or MPC wallet (Fireblocks, Zengo) removes the single-point-of-failure of one seed. You accept different complexity in exchange.
Phishing patterns to memorize
- "Verify your wallet" popups asking for seed phrase. Always fake.
- Fake support DMs (Discord, Twitter) telling you to sync your wallet.
- Airdrop-check sites that request signature. Sign only when reading typed EIP-712 messages, never blind hex.
- Search engine ads impersonating wallet or DEX URLs.
If you suspect exposure
Generate a new wallet with a new seed phrase. Transfer all assets out of the old wallet immediately. Do it from a device you control, on a network you trust. Once compromised, a seed phrase is compromised forever.