Ilia Zavialov explains why asking for a seed phrase is the entire scheme

01What the recovery phrase actually controls

The recovery phrase is a sequence of ordinary words that encodes the master secret of a wallet. Every address the app displays and every key that signs a transaction is derived from that secret through a fixed procedure. The words are portable across brands, which is the whole point of the design, because a person who loses a phone can rebuild the same wallet on a new device. That portability has no direction and no owner, so it works exactly as well for a stranger.

Typing the phrase into any compatible application reconstructs the entire wallet, including accounts the owner may have forgotten. Balances on several chains, staked positions, and token approvals all come back with it. The reconstruction looks unremarkable from the network side, because signing with the correct key is precisely what the network expects.

Control therefore lives in the words themselves. The application, the account, and the email address attached to it hold none of it, and there is no password reset behind the phrase and no administrator above it. Once the sequence is known to a second person, both people hold identical authority over the same funds at the same moment. The faster of the two decides the outcome.

02Why a genuine desk has no use for it

A self custody provider builds software that runs on the customer device and keeps no copy of the customer secret. The company can read what is public on the chain, read what the application reports about itself, and reproduce a fault on its own hardware. It cannot freeze an address, reverse a settled transfer, or restore a wallet on behalf of a person who lost the words. Support is bounded by that architecture in every direction.

The practical shape of a real conversation follows from those limits. A genuine agent asks for a public address, a transaction hash, an application version, a device model, and a description of the failure. Each of those items feeds a diagnosis the agent can actually perform. The recovery phrase feeds nothing, because no internal system exists into which it could be entered for a legitimate purpose.

This is why the request works as a clean signal on its own, independent of tone, logo, or grammar. A fake desk can copy the visual identity of an application perfectly and still needs the words, because the words are the only thing worth the effort of the whole performance. Everything else in the conversation is staging for one line. The staging can be flawless, and the line still gives it away.

03How the fake desk arrives before the real one

Public distress is the raw material. A post in a forum, a reply under an official announcement, a message in a group chat, or a one star review all broadcast the same three facts: something valuable exists, it appears to be stuck, and the owner wants to talk. Automated accounts watch those channels and answer within minutes, often faster than the official queue. Speed alone builds credibility, because a person who is waiting reads it as attentiveness.

The other route runs through search. Paid placements and cloned pages sit above official results for queries about wallet errors, and cloned applications appear in store listings with plausible icons. The visitor reaches a page that looks like the vendor, opens a chat widget that looks like the vendor, and speaks to a person whose script mirrors the vendor. Nothing in that sequence required the attacker to know anything about the target in advance.

Scale explains why the effort is worth it. The Federal Trade Commission recorded more than a million reports of impersonation for 2025, with 3.5 billion dollars in reported losses, which is close to one report in three. Pretending to be a trusted institution now accounts for roughly a third of everything consumers report. A wallet support desk is one costume in that wardrobe.

04The script and its three moves

The conversation has a stable structure, because it is written once and run thousands of times. The first move mirrors the panic and names it precisely, which makes the agent feel like someone who has seen this exact failure before. The second move establishes authority through procedure: a ticket number, a case reference, a promise to escalate, a mention of a maintenance window. The third move narrows time, usually by attaching the fix to a deadline that exists only inside the script.

Vocabulary does most of the work. Terms such as «validation», «synchronisation», «node migration» and «re-indexing» sound like operations a wallet might genuinely require. None of them corresponds to anything an owner has to perform by hand, and all of them create a plausible reason to move the phrase from paper to a keyboard. The language is chosen to make an impossible request sound procedural.

The final framing is usually protective. The phrase is requested in order to secure the funds, to move them to a safe address, to complete a compulsory verification, or to restore access before a cut off. A person already convinced that their money is at risk hears that as rescue. The emotional logic of the ask is the reason careful people comply.

05The moment the theft happens

Entry is the event. The words can be typed into a validation form, pasted into a chat, photographed and sent as an image, read aloud on a call, or imported into a cloned application that presents an ordinary restore screen. Each of those paths ends in the same place, with the sequence in the hands of a stranger.

What follows is automated. Software watches for newly captured phrases, derives every address in the wallet, checks balances across chains, and moves whatever it finds. Locked or staked positions are queued for the moment they unlock, and existing token approvals are used wherever they help. The owner often watches the outflow while still on the call, which is why the agent keeps talking.

Storage habits open the same door with no conversation at all. A phrase saved in a notes application, a screenshot sitting in a cloud gallery, a photograph of a paper backup, or a copy pasted into a password store that syncs everywhere all create a duplicate that malware or an account takeover can harvest later. The support script is simply the fastest route to the words. Everything else is patience.

06The voice on the callback

Audio used to carry a rough proof of identity, because imitating a specific person took skill and time. Current tools build a convincing clone from about three seconds of recorded speech and reach roughly 85 per cent accuracy against the original. Three seconds is a voicemail greeting, a video caption, a conference clip, or a single answered call that ended in silence.

Listeners cannot compensate for this by paying closer attention. In controlled testing, people separated genuine speech from synthetic speech in only 37.5 per cent of attempts, which lands below the result guessing would give. Voice phishing built on cloned audio grew by 1633 per cent in a single quarter, which describes an industry adopting a tool rather than a laboratory experiment. The channel that feels most personal has become the cheapest one to fake.

For a wallet owner this changes what a callback proves. A number that displays correctly, a voice that matches the founder from a project video, and a caller who already knows the ticket number together prove nothing about who is speaking. Identity has to be established by walking to the official application or website independently and starting a fresh contact from there. Anything that arrives at the owner carries no verification with it.

07Fake support as an industry

The volume behind these calls is organized rather than improvised. The FBI Internet Crime Complaint Center counted call center fraud, which covers fake technical support together with impersonation of government services, at more than 80,000 complaints and over 2.9 billion dollars in reported losses for 2025. Those are staffed operations with shifts, scripts, quality control, and payment infrastructure. The wallet variant is one product line inside them.

Cryptocurrency is the settlement layer for the whole category. About half of all losses reported in the United States now involve cryptocurrency in some form, because it settles quickly, crosses borders without permission, and does not reverse. A support script that ends in a recovery phrase skips the payment step entirely and takes the account itself.

Age shapes the pattern of harm. Among reporting victims aged 60 and over, phishing, fake support, and investment schemes lead by number of complaints, while investment fraud leads by money with 3.519 billion dollars. The same call centers reach that group with a script that trades technical jargon for patience and politeness.

08Why most attempts fail

The same reporting contains something easy to miss. In four out of five impersonation reports there was no financial loss at all, which means the overwhelming majority of these approaches end with someone closing the chat. The model runs on volume, and the script is tuned for the small fraction of contacts that land at a bad moment. Nobody is being outsmarted at scale.

That changes what a defense needs to look like. Detection accuracy is a weak target, because the message that eventually works will be the one arriving while a person is tired, frightened, or genuinely stuck inside a real technical problem. A fixed rule that requires no judgment survives that moment better than any amount of scepticism. The rule has to be decided in advance, while nothing is at stake.

Reported figures also understate the ground truth. Losses are counted only when someone recognizes what happened and chooses to file, and a person who typed a phrase into a fake form often reads the outcome as personal carelessness and stays silent. The gap between attempts and reports is therefore wider than the gap between reports and successes. Planning around a low visible success rate would be the wrong reading of the same numbers.

09One rule that survives panic

The rule is short. The recovery phrase is entered in exactly one situation: into the wallet application on a device the owner controls, during a restore the owner started, with nobody watching and no conversation in progress. Every other context, without exception and regardless of who is asking, is a theft in progress. There is no legitimate counterexample worth memorising.

Structure makes the rule easier to keep. A small spending wallet used for daily activity limits what a single mistake can cost, while long term holdings sit behind a separate phrase that never touches a networked device. A hardware wallet keeps signing inside the device and keeps the words off the screen during ordinary use.

Verification runs in one direction only. Contact is initiated from the official application or from a bookmark saved earlier, never from a link, a search advertisement, a reply, or an inbound call. If a conversation began with someone else reaching out, it ends there and a new one starts through the owner's own route. This single habit removes the entire arrival channel the industry depends on.

Time is the last component. A genuine wallet fault does not get worse because a decision took a day, and no real process requires a recovery phrase inside a countdown. Treating urgency itself as the alarm converts the strongest part of the script into its weakest point.

10The first hour after the words are gone

Speed matters more than tidiness once a phrase has been exposed. Whatever assets remain under that phrase should move to a wallet created from a fresh phrase on a clean device, and every account derived from the compromised words should be treated as public from that moment. Anything that cannot move immediately, such as a locked position, is likely to be taken when it unlocks.

The exposure is usually wider than the single wallet in front of the owner. One phrase may back several accounts across several chains, and a hardware device restored from the same words shares the same fate. Token approvals granted earlier can be used to drain balances that still look untouched. The full set of derived accounts deserves the same attention as the visible one, because that is the difference between one loss and two.

Reporting is worth the time even when recovery is unlikely. A transfer that has settled on a public chain does not reverse, and no support desk, exchange, or recovery service can undo it. Reports still feed the datasets that shape enforcement priorities, and they create a record if the funds later surface at a regulated platform. Anyone who offers to reverse a settled transaction for a fee is running the second half of the same script.

11Questions and answers

12Read next

• Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
• Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
• Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
• Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
• Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
• Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
• Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
• Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers

Back to the blog