Your crypto seed phrase and exchange logins: the scams built to take them
Cryptocurrency has no fraud department and no undo button — so the scams aimed at crypto holders do not hack anything. They get you to reveal a secret or approve a transfer yourself. Here is how they work and the one rule that stops them.
With a bank, a wrong transfer can sometimes be reversed and a fraud team can step in. With cryptocurrency there is no such safety net: a transfer, once made, is final, and whoever holds the keys holds the money. That is why the scams aimed at crypto holders almost never try to “hack” anything technical. They try to get you to hand over a secret or approve a transfer yourself.
The one secret that is everything: your seed phrase
When you set up a crypto wallet, you get a seed phrase (also called a recovery phrase) — a list of words that is the master key to everything in it. Anyone who has those words can take all your funds, from anywhere, instantly. There is no “forgot password”, no bank, no reversal.
So the rule is absolute: no legitimate wallet, exchange, or support team will ever ask you to enter, share, or “verify” your seed phrase, recovery phrase, or private key. The FBI notes that scam sites and apps get users to “input their login and security information, including seed phrases”, which is exactly what hands criminals the keys. Anyone who asks for it is a thief — full stop.
”Your account is compromised” — exchange impersonation
The most common pull is a fake emergency. The FBI describes it plainly: a scammer “contacts the victim via an unsolicited call or message and pretends to be a cryptocurrency exchange employee”, then “conveys urgency and may claim there is a problem with the victim’s account, or someone is attempting to compromise the victim’s account.” From there, “the scammer claims the victim must safeguard their account by providing log-in information, clicking on a link, and/or providing identification information.”
The FBI’s instructions are clear:
- “If you receive a call or message indicating any kind of account problem or compromise, do not respond, even if it appears official and indicates you must act immediately.”
- “Hang up. Call the cryptocurrency exchange’s official phone number to verify if there is a problem. Do not use any phone number the caller provides.”
- “Do not go to any websites or click on links the caller sends you. Navigate to the official cryptocurrency exchange website separately.”
- “If anyone asks for your account log-in information at any point, do not provide it."
"Move it to a safe wallet”
A close cousin is the instruction to transfer your crypto to a new “safe” or “secure” wallet to protect it from the supposed threat. This is the crypto twin of the bank “fraud department” call that tells you to move your money to a “safe account.” The safe wallet is the scammer’s, and the transfer is the theft.
Free rewards and airdrop wallet-drainers
Not every attack comes by phone. The FBI has warned about fake “free reward” airdrops — for example, NFT airdrops disguised as free rewards — used to drain non-custodial wallets. The bait is a token or prize; the catch is being asked to connect your wallet or approve a transaction on a site you did not navigate to yourself. Approving it can hand over access to your funds.
What to do
Every version of this comes down to one move: Go Direct, and never reveal the keys. Do not act on the inbound call, text, link, or pop-up. Open the exchange’s official app or type its address yourself; verify any “problem” there. Never share a seed phrase, never move funds to a wallet someone tells you to, and never connect your wallet to a site you did not seek out.
If a relationship or “investment coach” led you to a trading platform in the first place, that is the pig-butchering crypto-romance pattern. And if you have already lost crypto, be doubly wary of anyone promising to get it back for a fee — that is the recovery scam. For more, see the defense library or test your eye on the 60-second quiz.
- An unsolicited call, text, or email says there is a "problem" or "compromise" with your crypto account and you must act immediately.
- Anyone — "support", a "security team", even law enforcement — asks for your seed phrase, recovery phrase, private key, or a login code. No legitimate service ever needs it.
- You are told to move your crypto to a new "safe" or "secure" wallet to protect it — the wallet belongs to the scammer.
- A website or app asks you to "connect your wallet" and then to enter or import your seed phrase to claim a reward, airdrop, or fix an error.
- The support number came from a search ad, a pop-up, or the caller themselves — not from the exchange's official app or site.
- Never type, share, or "verify" your seed phrase, recovery phrase, or private key — anywhere, to anyone. It is the master key to all your funds, and no real wallet, exchange, or support team ever asks for it.
- Treat any unsolicited "account problem" contact as a scam. Hang up, then open the exchange's official app or type its address yourself — the FBI says "do not use any phone number the caller provides".
- No one legitimate will ever tell you to move your crypto to a different "safe wallet" to protect it. That wallet is the thief's.
- Do not connect your wallet or approve transactions on sites you did not navigate to yourself, even for a "free" reward or airdrop.
- Remember there is no undo: a crypto transfer is final and there is no fraud department to reverse it, so the time to stop a scam is before you act, not after.
Crypto removes the safety net most people do not realize they rely on: there is no fraud department that can claw a transfer back. That cuts both ways — it is what makes crypto appealing, and it is exactly why these scams aim at the one thing that can never be undone. The whole game is getting you to reveal a secret or approve a transfer yourself. Guard the seed phrase like it is your savings, because it is.
Sources
Frequently asked
Why does everyone say "never share your seed phrase"?
Your seed phrase (or recovery phrase) is the master key to your wallet — anyone who has it can move all your funds, with no bank able to reverse it. No legitimate wallet, exchange, or support team will ever ask you to type, share, or "verify" it. The FBI's guidance is blunt: "if anyone asks for your account log-in information at any point, do not provide it." A request for your seed phrase is, by itself, proof of a scam.
I got a call from my exchange's "security team" about a compromised account. Is it real?
Treat it as a scam until you prove otherwise. The FBI warns that scammers pretend to be a cryptocurrency exchange employee, "convey urgency", and may claim "there is a problem with the victim's account". Hang up. Open the exchange's official app or type its address yourself and check — and "do not use any phone number the caller provides".
Support told me to move my coins to a new "secure wallet" to keep them safe. Should I?
No. That "secure wallet" is the scammer's. No real security process asks you to transfer your crypto to a different wallet to protect it — it is the crypto version of the "move your money to a safe account" bank scam. Sending it there hands it straight to the thief.
A site offered me a free token airdrop if I connect my wallet — is that safe?
Be very careful. The FBI has warned about fake "free reward" airdrops used to drain non-custodial wallets. Connecting your wallet or entering your seed phrase on an unfamiliar site can hand over access. If you did not start the process from the official source, assume the reward is bait.