Breaches & scams
Shared your recovery phrase? Where to get the right next steps
By Jolly Ledger editorial · Published · Reviewed · 4 min read
Short answer
Treat recovery words disclosed to another person, website or untrusted application as compromised. Stop interacting with the recipient and urgently use your wallet manufacturer’s official response instructions from a separate trusted device.
Respond first, using official sources
Go to your wallet maker’s official support by typing its address yourself. Do not use links or contacts from the message that worried you.
- Identify phishing scams — BitBox (opens in a new tab)
- Security incident at Brevo, our third-party email provider — Trezor (opens in a new tab)
- How to verify a message claims to be wallet support
If you have just shared recovery words, stop the conversation or close the page. Do not send the remaining words, a photograph of the backup or an optional passphrase. Use a separate trusted device to open your wallet manufacturer’s official website and find its compromised-backup or phishing-response instructions now.
Exposure matters before a balance changes
Recovery words can allow someone to recreate access to wallets derived from that backup. The person does not necessarily need your physical hardware wallet or its PIN. Treat a disclosed phrase as compromised even if the wallet still opens normally and the balance appears unchanged.
That is a response to known secret exposure, not proof that a theft has already occurred. An unchanged balance cannot establish that nobody copied the words. Deleting a message, asking the recipient to forget them or changing a device PIN does not establish that the exposure has been undone.
Find instructions without returning to the scam
- Use a separate trusted device if suspicious software ran, remote access was allowed or the original device may be unsafe.
- Open the manufacturer’s website from a trusted bookmark or carefully checked address, not the original message or a search advertisement.
- Locate its official guidance for exposed recovery words or a compromised wallet backup.
- Start a new support inquiry if the instructions do not clearly cover your device, backup format or wallet arrangement.
For BitBox users, the official phishing guide has a specific recovery-words branch and directs readers to its response procedure. It says to treat exposed words as compromised and explains that a newly created wallet may be necessary, subject to prerequisites. Trezor’s Brevo incident notice likewise directs users who entered their backup to its official new-backup procedure.
Follow the instructions for your own setup rather than borrowing another product’s steps. A safe response depends on the available trusted equipment, assets and backup arrangement. A generic transfer checklist can leave something behind or introduce an attacker-controlled destination.
Tell support the circumstances, not the secrets
- Say when and where the disclosure happened.
- Identify the wallet model and whether suspicious software was installed.
- Say whether a full backup, partial words, photograph or backup file was shared.
- Mention whether an optional passphrase or shared-backup arrangement exists, without revealing its contents.
- Provide only redacted evidence; never send words, keys, PINs or authentication codes.
An optional passphrase can affect which wallet an exposed backup makes accessible, but do not improvise conclusions about safety. Explain that one is used and ask for setup-specific guidance. Our guide to PINs, passphrases and recovery phrases explains their different roles.
Avoid a second exposure
Do not enter the words into a website, software checker, chat or AI tool to confirm that they work. Do not accept a recovery service’s promise to freeze a self-custody wallet. BitBox states that its support cannot access, freeze, move or recover customers’ funds.
Replacing hardware is not automatically the same as replacing exposed keys: see device replacement versus a new wallet. If you are unsure whether words were actually disclosed, reconstruct the actions using the phishing interaction guide, without revisiting the suspicious site.
Sources
Reported facts are attributed to their sources. Spotted an error? Read our corrections approach.
Later: prepare calmly
This checkup cannot diagnose a current compromise or tell you whether funds are at risk. It helps you prepare: backups, official instructions and a family briefing.
Start the free preparation checkup