At 7 a.m., Tom checked his phone like he did every morning. Then he froze. The 80 bitcoin in his wallet showed a balance of zero.
It didn't make sense. He'd bought his hardware wallet directly from the manufacturer and kept it locked in a drawer. His seed phrase was handwritten and hidden in a bookshelf, and he'd never told anyone. He believed he'd done everything right.
The block explorer told the story in cold detail: at 3:12 a.m., a single transaction moved every coin to an unfamiliar address, where it was split into dozens of smaller transfers heading in different directions.
Note: "Tom" is a composite character. This walkthrough is assembled from theft patterns that come up again and again in public reports and victims' requests for help. It illustrates the risks and doesn't describe one specific incident.
He had a cold wallet and a written seed phrase. So why couldn't he protect his bitcoin? The answer usually hides in small, harmless-seeming habits.
Key takeaways
- A cold wallet protects the private key inside the device. It can't protect a seed phrase that has left it.
- Nearly every "cold wallet theft" traces back to a seed phrase that touched an internet-connected device or was seen by someone.
- Photo backups, importing the seed into a phone wallet "just to check the balance" and fake wallet software are the three most common holes.
- Securing a large fortune with a single seed phrase puts all your eggs in one basket.
- A passphrase, multisig and separate storage locations stop a leaked seed phrase from meaning total loss.
The bottom line: the cold wallet wasn't "hacked"
When people hear "cold wallet stolen," they assume someone cracked the hardware. In the vast majority of cases, the device itself was never compromised.
Hardware wallets are designed so the private key never leaves the device. Transactions are signed inside it, and your computer or phone only receives the signed result. As long as your seed phrase also stays on paper, hackers have almost no way to steal your bitcoin remotely.
The catch: your seed phrase is a complete backup of your private key. The moment it's photographed, typed in or seen, anyone can restore your wallet on any device, and the hardware wallet's security becomes irrelevant.
Retracing the leak: where could the coins have escaped?
We went through every seed-phrase-related action Tom could remember from the past few years and mapped the most likely leak paths:
| Possible leak | What Tom was thinking | The risk |
|---|---|---|
| Took a photo of the seed phrase "just in case" | Paper gets lost; a photo is extra insurance | Photos auto-sync to the cloud; if that account or phone is compromised, so is the seed phrase |
| Imported the seed phrase into a phone wallet to check the balance | The hardware wallet is a hassle; the phone is easier | The seed phrase entered an online device, turning a cold wallet into a hot one |
| Downloaded wallet software from a search result | The official site wouldn't load, so he grabbed another link | It may have been a counterfeit app designed to collect seed phrases |
| Got a "firmware update" or "security verification" email | It looked official | Phishing that leads to a page asking for your seed phrase |
| Left the seed card on a table during home repairs | Just for a moment; nobody would notice | A physical leak; someone could see or photograph it |
Eventually, Tom remembered. Two years earlier, while switching phones, he'd worried about losing the paper and snapped a photo. His camera roll had been syncing to the cloud ever since. And a few months before the theft, his email password had shown up in a data breach. He never changed it.
That's a complete attack chain: leaked email password → access to the cloud account → scroll through synced photos → find the seed phrase → restore the wallet → move the funds. The hardware wallet was never touched.
Why writing down your seed phrase isn't enough
Most security guides stop at "write your seed phrase on paper." They rarely stress the other half: once it's written down, it must never touch an internet-connected device again.
Any of these habits strips a seed phrase of its "cold" status:
- Photographing, screenshotting or scanning it.
- Saving it in a notes app, cloud drive, email or chat, including messages to yourself.
- Importing it into a software wallet on your phone or computer, even "just to look."
- Typing it into any website, no matter how official it seems.
- Texting a photo of it to a family member for "safekeeping."
Do any one of these, and your cold wallet isn't cold anymore.
The lesson from 80 bitcoin: big money needs more than one lock
Even if you avoid every mistake above, betting millions on "this one seed phrase will never leak" is a risk in itself. For large holdings, add at least one more layer:
| Approach | What it does | Best for |
|---|---|---|
| Seed phrase + passphrase | The seed phrase alone can't open your real wallet | Medium to large holders |
| Multisig (e.g. 2-of-3) | Several keys must sign; one leaked key can't move funds | Large holders; anyone planning inheritance |
| Separate storage | Keep the seed phrase, passphrase and backup copies in different places | Everyone |
| Regular checkups | Confirm backups are intact; watch for unusual approvals and transactions | Everyone |
Had Tom set a passphrase, and not kept it in the same photo as his seed phrase, an attacker who found that photo would have opened an empty wallet.
If your cold wallet has been drained
- Check your other wallets immediately. If any use the same seed phrase or the same backup method, move them to a freshly generated wallet.
- Find the source of the leak. Search cloud photos, drives, email and chats for any copy of your seed phrase. Change those passwords and turn on two-factor authentication.
- Preserve evidence. Record the theft transaction hash, time and destination addresses.
- Report it and alert exchanges. In the US, file at ic3.gov; elsewhere, contact local police. If funds reach an exchange, law enforcement can request a freeze.
- Beware recovery scams. Someone will contact you offering to get your coins back. It's almost always a second scam.
FAQ
Can hardware wallets really be hacked remotely?
For mainstream hardware wallets bought from official sources and used normally, remote attacks are extremely difficult. Real-world thefts overwhelmingly come from leaked seed phrases, tampered devices or signing malicious transactions.
I once took a photo of my seed phrase but deleted it. Am I safe?
Not necessarily. The photo may have synced to the cloud, may still be in a "recently deleted" folder or may have been read by an app. The safest move is to create a brand-new wallet, transfer everything and back it up properly.
I only imported my seed phrase into a phone wallet to check the balance. Is that risky?
Yes. Once a seed phrase enters an online device, malware may be able to read it. If you've done this, migrate to a new wallet too. To check balances in the future, add your public address as a "watch-only" wallet, which doesn't need your seed phrase.
Can stolen bitcoin be recovered?
It's very difficult, but not always impossible. Bitcoin transactions are public, and if the funds end up at a regulated exchange, law enforcement may be able to coordinate a freeze. Fast reporting and complete evidence make a real difference.
Summary
When 80 bitcoin disappear, it's rarely because the cold wallet wasn't secure enough. It's because the seed phrase went "warm" at some careless moment: one photo, one import, one phishing email. A cold wallet guards the key inside the device. Only you can guard the seed phrase.
Check right now: has your seed phrase ever been photographed? Is it stored anywhere online? If so, migrate to a new wallet today. For more storage tips, read our crypto wallet guide. This article is for education only and isn't investment advice.
Covers Bitcoin: the protocol, mining, the halving cycle and network development, writing from the white paper and verifiable on-chain data.
Our editorial principles →
David Mitchell
Michael Carter