Phishing the seed

The cheapest way to get a seed phrase is to ask for it. Every large theft of wallets from ordinary holders in the last six years has worked that way, and the cases are worth knowing by name, because the next one will look like them.

Three real ones

The device in the post, 2021. In June 2020 someone got into Ledger's e-commerce database. In December the data, 272,853 names, postal addresses, phone numbers and emails, was posted to a hacking forum. Six months later customers on that list began receiving parcels: a Ledger Nano X in authentic-looking packaging with a letter saying it was a replacement sent because of the breach. The device had a flash drive soldered inside. Plug it in, run the app that appears, and it asked you to enter your 24-word recovery phrase "to import your wallet to the new device." The breach was real, which is what made the letter believable.

The fake update, 2022. In April 2022 an insider at Mailchimp used a support tool to pull subscriber lists from more than 300 accounts, with crypto companies the target. Trezor's newsletter list was one of them. Subscribers got an email saying Trezor had suffered a security incident and should download a new version of Trezor Suite. The link went to a look-alike app whose only job was to collect the seed.

The clipboard, 2023. Not a seed theft, but the same family. Kaspersky found a trojanised Tor Browser installer, spread through third-party download sites, that sat silently on Windows machines watching the clipboard. When a bitcoin address was copied, it was replaced with the attacker's. Nearly 16,000 victims in 52 countries, about $400,000 taken, $381,237 of it in bitcoin. The malware made no network connections and showed no sign of itself until the day it swapped an address.

The shape they share

Take out the names and all three are the same message:

1. Something has gone wrong (a breach, an incident, an expired version).
2. There is a fix, and it comes from the company you trust.
3. The fix requires you to type your words, or to trust the screen in front of you.

Variations you will see:

• "Validate your wallet," "sync your wallet," "migrate to v2," usually a web page with a form for 12 or 24 words.
• Support that reaches out to you. A reply in a forum thread, a direct message from a "Ledger Support" account, a phone call about "suspicious activity."
• Browser extensions and mobile apps with the right logo and a slightly wrong name.
• Search ads above the real download link.
• A QR code or a link in a parcel, an invoice, a conference lanyard.
• Fake recovery services for people who have already lost access, who are asked for the words they still have.

The message is always urgent, and urgency is the tell. A real wallet vendor has no action that requires your seed, ever, because the seed never needs to leave the paper.

The rule

There is one action that is never legitimate, and it is the one every phish needs: typing your seed words anywhere except into the device that will hold them, during a restore you chose to do.

Not into a website. Not into an app that asked. Not into a support chat. Not into a replacement device that arrived unasked. Not to prove anything, verify anything, claim anything, or fix anything.

This site follows its own rule. We will never ask for a seed word or a passphrase. Never type one into this site or any tool it links to. The encode and decode pages in the vault are plain lookup tables you read with your eyes; there is no box to type into, by design. If you ever see one on a page claiming to be ours, it isn't ours.

Habits that make you a hard target

Downloads. Get wallet software from the vendor's own site, typed by hand, and check the signature or hash they publish. The 2023 clipboard malware spread entirely through third-party download sites. For our own files, the signing key page shows how to check a tome against our public key.

Addresses. Read the receiving address on the hardware wallet's screen and compare the first and last characters with what the computer shows, every time. That single habit defeats clipboard malware.

Mail and parcels. Anything that arrives because of a breach is suspect, especially if it arrived at the address that leaked. Ledger did not send replacement devices. No vendor will.

Support. You contact them, through the address on their site. They never contact you first, and nobody at any company needs your words to help you.

Lists. Buy hardware with a name and address that isn't your home, or from a shop in person. Use a separate email for anything bitcoin. The 2020 and 2022 breaches turned customer lists into target lists; the less you are on, the less you are targeted.

Two wallets. Keep the wallet whose address you share small, and keep the long-term wallet behind a passphrase you have never typed into a computer.

If you already typed them

Treat the seed as gone. Make a new seed on a clean device, move the coins to it now, and only then work out what happened. Speed matters more than understanding; the phisher's script sweeps wallets automatically within minutes of a submission.

Sources