Seed phrase phishing
Seed phrase phishing is a fake wallet, support or "recovery" page that asks the victim to type the 12- or 24-word recovery phrase, which gives the attacker the whole wallet.
How it works
The page imitates a wallet app, a browser extension pop-up or a support form and claims the wallet needs to be validated, synced or restored. The words are sent to the operator, often through a Telegram bot, as soon as they are typed.
With the phrase the attacker restores the wallet on another device and moves everything; no signature from the victim is needed.
Example from the PhishDestroy database
- fkmvault.info: Seed-phrase phishing domain, first detected 2026-10-22.
- ethlaunch.fun: Seed-phrase phishing domain, first detected 2026-10-22.
- findfundes.icu: Seed-phrase phishing domain, first detected 2026-10-21.
How to protect yourself
- No legitimate service ever asks for a recovery phrase. Type it only into the wallet itself when you restore it.
- If you entered it anywhere else, move the funds to a new wallet with a new phrase immediately.