Store a seed phrase safely and spot the common ways people lose one.
Farah is putting a wallet app on her phone. During setup it displays twelve ordinary words and tells her to copy them onto paper, but she screenshots them because that is faster, then carries on.
Those words are Farah's seed phrase, which some wallets call a recovery phrase. Every wallet produces one when you set it up, usually 12 or 24 words long. Each word is taken from a fixed list that anyone can look up, and the sequence they appear in stands for a very large random number. The wallet uses that number to work out every private key it will ever need, for every address it ever creates. The phrase is therefore the master copy of the wallet.
If your phone is lost or broken, you can install a compatible wallet on a new device, enter the phrase, and get back your wallet without the original phone or its password. If you also set a passphrase, which is explained below, the words alone are not enough, and you must enter the passphrase as well. A stranger can do exactly the same. Someone who enters your words, plus your passphrase if you set one, gets identical access from any country, and needs neither your phone nor your password nor your face ID. Anything they then send away stays sent; lesson 1.2, "Why proof of work makes the ledger hard to rewrite", explains why such transactions cannot be undone.
Certain wallets let you set an extra passphrase as well as the words, so that knowing the words is not enough by itself. That gives you more protection, and it also gives you something else to forget, so a passphrase needs a safe place of its own.
Each way people lose a seed phrase comes down to breaking one of four rules.
Rule 1: enter the phrase only into the wallet itself, and only when you are restoring that wallet. Never type it into a website, a form or another app. Pages that look like a wallet, or that ask you to "verify your wallet", are built for one purpose, which is gathering phrases.
Rule 2: keep no digital copy at all. Photos, screenshots, notes apps, emails to yourself and files in cloud storage all count. Malware can reach any of them, and so can anyone who breaks into the account holding them. This is the rule Farah broke. Her gallery uploads to the cloud on its own, so her picture of the only thing that controls her coins can now be seen by every device and account that can open her photos, and she has no idea.
Rule 3: never hand the phrase to another person. A real exchange, wallet company or support agent has no use for it when helping you, so none of them will ask. If someone does ask, whatever logo or job title they show, they want your coins. That includes people who contact you after you post online about a problem with your wallet.
Rule 4: keep it offline, in two or more secure places. Paper can catch fire or get soaked, and one notebook kept in one drawer may go out with the rubbish when someone tidies up. With two copies in different locations, say one at home and one with someone you trust or somewhere else you trust, a single fire, flood or clear-out cannot remove your access. Some people engrave the words onto metal plates, which hold up against fire and water better than paper does. Write nothing on the outside of any copy that says what it is.
Most losses are everyday slips against the four rules, and dramatic hacks are rare. The usual ones are:
taking a photo of the phrase "just for now" and then forgetting it exists saving it in a password manager or notes app that syncs to the cloud clicking a search ad, landing on a copy of the wallet's real page, and typing the phrase there passing it to a "support agent" in a chat group writing it on a single sheet of paper that goes missing during a move guarding it so closely that after the owner dies, no one in the family knows there is a phrase at all
In the first four, the phrase ends up with someone else. In the last two, it slips out of your own reach. Your storage has to protect against theft and against loss at the same time, since a phrase hidden where nobody can find it leaves you as locked out as one that was stolen. Lesson 4.4, "Write your custody and inheritance plan", covers how to make sure your family can find it after your death.
Deleting the picture would not help Farah, as the image may already sit in cloud backups and on her other devices. The careful approach is to assume the phrase is compromised, start a new wallet and transfer the coins across. The same applies to you if a phrase of yours has ever been photographed, stored in an app, entered on a website or shared with someone.
Farah creates a new wallet, which gives her a fresh phrase. She copies it onto paper by hand and does not take a picture of it. Next she sends her coins from the old wallet to the new one and waits for the transfer to be confirmed. From that point, the old phrase opens a wallet with nothing in it. She writes a second paper copy of the new phrase and keeps it apart from the first. Nothing on the outside of either copy shows what it is, and both she and one trusted person know where to find them.
If you hold crypto in a wallet you control, a seed phrase for it exists somewhere, even if you do not remember writing one down. If everything you own sits on an exchange, you may not have a seed phrase at all, and that is fine. Your next step is to work out which of these describes you, and then, for each phrase you have, to find where every copy of it actually is.
If you have seed phrases, write down where each one is stored today. Check each method against the four rules and mark it safe or unsafe.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).