Seed Phrase Requests: Every Version of the Ask

A seed phrase request is any message, page or conversation that asks you to type, read out, photograph or upload the twelve or twenty-four words that control a wallet. There is no legitimate version of it. Every request of this shape is either an attempt to take the wallet or a system so badly designed that it should not be trusted with one.

The reason the seed phrase request keeps working is that it rarely arrives looking like what it is. It arrives as a support ticket, a security alert, a firmware update, a migration notice or a helpful stranger in a direct message. Recognising the ask as a category — rather than trying to spot each new script — is what makes you resistant to versions that have not been written yet.

• No legitimate party needs the words. Not a wallet developer, not an exchange, not a support agent, not a hardware manufacturer.
• Urgency is the tell. Almost every version manufactures a deadline so you skip verification.
• The channel is part of the attack. Search results, ads, community moderators and cloned domains are all used to make an illegitimate request look official.
• The defence is procedural, not clever. A fixed rule about who may see the words beats trying to out-think a script.

What every seed phrase request has in common

Every version applies the same three levers in some order: authority, urgency and fear of loss. A request claims to come from someone who can act on your account, sets a deadline, and describes what you will lose if you do not comply. Once you can name the lever being pulled, the script loses most of its power.

Authority

Authority is borrowed from a name you already trust — a wallet, an exchange, a hardware brand, a person with a moderator badge. It is manufactured cheaply: a similar domain, a copied interface, a display name with a support prefix. The claim cannot be verified inside the channel where it arrives, which is why the request insists you stay there.

Urgency and loss framing

Deadlines are the mechanism that prevents you from checking. Common framings include a migration window, a security patch that must be applied now, a withdrawal freeze, or an airdrop that expires. The content changes; the structure does not. Anything that requires you to act before you can verify is a request to act without verification.

The versions you are likely to meet

The recurring shapes, described so you can recognise the pattern rather than memorise a list.

Support impersonation

You post a question publicly, and a reply arrives within minutes offering to help by direct message. The account has a matching avatar and a plausible handle. The conversation moves quickly to a “validation” page where the words are entered. Real support channels do not migrate to private chat and do not need your secret to look at an account.

Wallet migration and upgrade notices

A page or email announces that a wallet is being retired and funds must be moved by importing the phrase into a new interface. The interface is the attack: it accepts the words and forwards them. Genuine software updates are distributed through the channel you already use, and a legitimate migration never requires exposing the phrase to a website.

Recovery services

A paid recovery service offers to restore access for a fee and asks for the phrase to “confirm ownership”. Anyone who can use the phrase to restore access can also take what it controls. Recovery of a lost phrase is not a service anyone can reliably sell.

Physical and social versions

The request does not have to be digital. It can be a housemate offering to help set up a new device, a trader at a meetup, or a relative asking you to write the words down “in case something happens”. The last one is worth handling deliberately: decide in advance who may ever see the phrase, and design an inheritance plan that does not require handing it over casually.

Seed phrase request patterns and the correct response

Match the shape of the ask to the response, and apply the response without negotiating.

None require judgement in the moment. That is the point of writing responses down: decide once, in calm conditions, and reuse under pressure.

The only safe answer to any request for the words is no, delivered without explanation, because explaining opens a conversation and a conversation is where the pressure lives.

What to do when one arrives

1. Stop responding. Do not confirm what you hold, which wallet you use, or whether the message was accurate.
2. Do not click further links in the same thread, including “unsubscribe” and “verify” links.
3. Reach the organisation through a destination you typed yourself, never one supplied in the message.
4. Report the message inside the platform where it appeared, so the account is removed for the next person.
5. If you already entered the words, treat the wallet as compromised: create a new wallet and move the assets immediately.
6. If the wallet holds long-term savings and the phrase was entered once, assume it is known permanently and act accordingly.
7. Tell anyone who shares access with you, because the same script is usually sent to everyone in a contact list.

Step five is the one people delay. It is also the only action that still helps: a compromised phrase lets an attacker wait indefinitely, and waiting is free.

Reducing how often this reaches you

Most requests arrive because something about your setup invites them: a public post naming your wallet, a reused username across forums, an address published with your identity. Reducing exposure is quieter and more effective than learning to spot each new script.

Keep the phrase offline in a form you can read but a camera cannot easily capture, and never photograph it. Use a hardware signer so the words are entered once, on the device, never into a browser. Add a passphrase where supported and store it separately. Test recovery on an empty wallet so you know the backup works before you need it. Then decide who is allowed to know a wallet exists, and keep the number of people who can reconstruct it small and deliberate.