In crypto, liquidation is the nightmare most traders talk about. But a liquidation leaves a trail: the price crosses your liquidation level, your position is closed, and you know exactly how the money disappeared.
There's something worse. No trades, no approvals, no suspicious clicks, and yet your wallet suddenly reads zero. You scroll through the history and find one transfer you never made.
At that moment, almost everyone says the same thing: "Nobody knows my seed phrase but me."
Is that really true?
Key takeaways
- A seed phrase can be exposed from the moment it's created: flawed random number generators and pre-configured devices are real risks.
- Cloud backups, screenshots, keyboard apps and the clipboard can all "see" your seed phrase without you noticing.
- SparkCat, malware exposed in 2025, used image recognition (OCR) to scan photo galleries for seed phrase screenshots.
- "Only I know it" is a feeling, not a guarantee. Real security comes from a process you can verify.
- A self-check list and migration steps are at the end. For large holdings, add a passphrase or multisig.
"Only I know it" usually has an audience
A seed phrase goes through a life cycle: generated, displayed, recorded, backed up and used. Every stage can add another party who knows it:
| Stage | Who else might know | Typical scenario |
|---|---|---|
| Generation | Flawed wallet software | Weak randomness lets attackers "guess" seed phrases in bulk |
| Generation | A seller or middleman | The device arrives with a "pre-filled" recovery card |
| Display | Screen recorders, remote-access tools | Malware captures the screen while you copy the words |
| Recording | Keyboard apps, clipboard | Cloud-based predictive typing or clipboard monitors read it |
| Backup | Cloud photos, drives, chat history | A screenshot auto-syncs; a hacked account exposes the seed |
| Use | Phishing sites, fake apps | You're asked to enter it to "verify" or "upgrade" |
Risk one: a seed phrase that's unsafe from birth
Many people don't realize that a seed phrase is only as secure as the randomness behind it. A 12-word seed phrase has 2¹²⁸ possible combinations, which can't be brute-forced in practice. But only if the words were truly random.
Things have gone wrong in the real world:
- Milk Sad (disclosed in 2023): a tool called Libbitcoin Explorer generated seed phrases with extremely weak randomness, shrinking the possibilities to about 2³², or roughly 4.3 billion. A computer can try them all in a short time, and many users were drained as a result.
- Randomness bugs in wallet extensions: in 2023, Trust Wallet disclosed a randomness flaw in its browser extension that put some wallets created during a certain period at risk. The company patched it and compensated affected users.
- Unknown "seed phrase generators": some websites and tools offer to generate a seed phrase for you. You have no way to confirm they aren't quietly uploading the result.
Another trap is the pre-seeded device. Scammers sell hardware wallets through unofficial channels with a recovery card already filled in and tell you to "just use it." A legitimate hardware wallet never comes with a seed phrase. You always generate it yourself, on the device.
Risk two: your phone remembers more than you think
Even with a properly generated seed phrase, every shortcut you take afterward can leak it.
Screenshots: in early 2025, Kaspersky exposed malware called SparkCat hidden inside apps that had made it into official app stores. Once granted gallery access, it used OCR to find seed phrases in images and upload them. That "backup" screenshot you took may be exactly what it was looking for.
Cloud backups: in 2022, some users lost funds after their Apple IDs were phished. Wallet app data had been included in their cloud backups, so attackers with the cloud account and wallet password could restore the wallet. MetaMask later reminded users to review those settings.
Keyboards and the clipboard: if you ever typed your seed phrase on your phone, a keyboard app with cloud-based prediction may have sent that text to a server. Researchers have also found security flaws in how several keyboard apps transmit data. And when you copy and paste a seed phrase, other apps may be able to read the clipboard.
Risk three: requests disguised as help
Some leaks happen because you handed the seed phrase over yourself:
- "Support" says your wallet needs verification and asks for your seed phrase.
- An "airdrop" page asks you to import your wallet to claim tokens.
- The "official wallet site" you found through search is a clone.
- A friend or self-described expert offers to "take a look" at your wallet.
Any person or site that asks for your seed phrase is running a scam, every single time. Legitimate wallets, exchanges and support teams never need it.
Even how providers themselves handle seed phrases has been debated. In 2023, Ledger launched its optional Recover service, which can split an encrypted seed phrase into shards held by third parties. It sparked a heated debate about whether hardware wallets can export seed phrases at all. The takeaway: understanding how your product handles your seed phrase is part of staying secure.
Self-check: is your seed phrase still yours alone?
| Question | What to do |
|---|---|
| Did you buy the device from an official source and generate the seed on it yourself? | If not, migrate right away |
| Have you ever photographed or screenshotted your seed phrase? | If yes, migrate to a new wallet now |
| Have you typed or copied it on a phone or computer? | If yes, migrate to a new wallet now |
| Is it saved in a cloud drive, email or chat? | If yes, delete it and migrate to a new wallet |
| Have you entered it on any website or in any app? | If yes, migrate to a new wallet now |
| Has anyone else seen it? | Judge by how much you trust them; migrate large holdings |
"Migrate" means: generate a brand-new seed phrase on a trusted hardware wallet, write it down offline on paper or metal, then move all your assets to the new addresses. An old seed phrase can't be considered safe again, even after you've deleted every copy.
FAQ
I deleted my seed phrase screenshot. Is there still a risk?
Yes. It may have synced to the cloud, may still sit in a "recently deleted" folder or may have been read by an app before you deleted it. Deleting reduces future risk but can't undo a leak that already happened. Migrating is the safest option.
How can I tell whether my wallet generated a truly random seed phrase?
Ordinary users can't easily verify it. The practical approach is to use widely adopted, open-source, audited wallets downloaded from official sources. For large holdings, use a reputable hardware wallet that generates the seed phrase on the device.
Is it safe to split my seed phrase into two halves stored separately?
It isn't recommended. Splitting 24 words in half dramatically reduces how hard each half is to crack. If you need to distribute your backup, use a scheme designed for it, such as multisig or Shamir backup (SLIP-39).
If I set a passphrase, can I be relaxed about storing my seed phrase?
No. A passphrase adds a layer; it doesn't replace good storage. Keep the seed phrase offline, store the passphrase separately, and remember that a forgotten passphrase can't be recovered.
Summary
You can see a liquidation coming. A leaked seed phrase usually makes no sound at all. "Only I know it" is a feeling. Real security means every step holds up to scrutiny. From generation to recording to backup, each shortcut can add an invisible witness.
If you answered "yes" anywhere on the self-check, migrate your assets soon. To learn why even cold wallets get drained, read how 80 bitcoin vanished overnight and our crypto wallet guide. This article is for education only and isn't investment advice.
Covers security and beginner guides: wallet safety, key management, phishing and approval risks, helping readers avoid the most common ways to lose funds.
Our editorial principles →
David Mitchell
Sarah Collins