Ledger, MetaMask, and seed-phrase phishing: what to do if you leaked a seed

Attackers impersonate wallet brands and support staff. Typical vectors: search ads for “Ledger Live download,” fake Chrome extensions named like MetaMask, phishing sites that ask you to “validate,” “sync,” or “fix” a wallet by typing 12/24 words, and Discord/Telegram “support” that sends a link after you post about a problem.

• Pages that require typing or pasting a recovery phrase into a browser form.
• Pop-ups claiming your wallet will be deleted unless you verify the seed.
• Fake Ledger Live installers from unofficial domains.
• Support agents who ask for screen share plus seed “to unlock” an account.
• Airdrop and mint sites that push blind signing or unlimited approvals.

Hardware wallet vendors and MetaMask will not ask you to enter your seed on a website to fix a problem. Legitimate recovery is offline, into a wallet you control — never into a stranger’s form.

Seed theft gives the attacker lasting control of every address derived from that phrase. They can wait, sweep new deposits, and bypass device PIN prompts by importing elsewhere. Drainers often abuse token allowances or malicious signatures without ever seeing the seed — assets leave while the phrase stays on your device.

Containment differs. For drainers, revoke approvals and move funds if the seed is still secret (see our revoke guide). For seed exposure, the phrase itself is burned: create a brand-new wallet, new seed, clean device, then sweep whatever remains from the old addresses — understanding the attacker may race you.

Even without a leaked seed, approving opaque contract calls can empty accounts. Read what your wallet or hardware screen shows. Reject transactions you do not understand. Unlimited ERC-20 allowances to unknown spenders are a classic prelude to drains.

If you signed something suspicious but did not share a seed, prioritize revoke flows and a quick inventory of remaining balances. If you both signed and typed a seed into a phishing form, assume full compromise.

1. Disconnect the compromised machine from the internet if malware is suspected; continue recovery from a known-clean device.
2. Generate a new wallet offline with a new recovery phrase you never type into a website.
3. From the clean device, transfer remaining assets out of the old addresses to the new wallet as fast as you safely can.
4. Never reuse the old seed — not for “recovery services,” not for a “new install,” not as a backup label.
5. Revoke token approvals on the old addresses if anything remains and you still control a session — then abandon those addresses for storage.
6. Change passwords on email and exchanges tied to that identity; enable 2FA.
7. Preserve phishing URLs, tx hashes of outgoing drains, and timestamps for reporting.

Attackers often leave a small balance to bait re-deposits. Do not keep using the burned seed. Our first-24-hours guide covers broader day-one hygiene.

After phishing, inboxes and DMs fill with helpers who need the phrase “to reverse the hack” or “to generate a refund transaction.” That is how wallets get emptied a second time — or how remaining dust is swept. Guaranteed recovery and key requests are hard red flags. Read our recovery-scams guide.

MBTrace never asks for seeds or private keys. Path analysis uses public addresses and transaction hashes you already know.

Once funds leave, on-chain tracing can follow hops toward mixers, bridges, or labeled custodial clusters. That PDF supports police reports and compliance letters; it does not restore balances. See how tracing works and our police / exchange-freeze guides for process boundaries.

• Provide network, drained tx hashes, source addresses, and time window.
• Do not upload seed phrases, keystore files, or remote-desktop access.
• Expect honest limits: unlabeled cash-outs and mixers happen.

MBTrace quotes per case (from $50+), delivers typically 24–48h after payment, and accepts only after analyst review. Soft CTA: report a case if you need a letter-ready path. Sample: /sample-report.pdf. Not a recovery service. Not legal advice.

• Download wallet software only from official vendor URLs you type or bookmark.
• Never type a seed into a web page; hardware wallets show receive addresses on-device.
• Prefer verifying receive addresses on the hardware screen before large transfers.
• Treat unsolicited support DMs as hostile until proven otherwise through official tickets you open yourself.
• Separate browser profiles for daily browsing vs wallet use when possible.

This article is general information, not legal advice. Outcomes of reporting vary by jurisdiction. No honest vendor can promise to reclaim drained funds.