How to store your seed phrase safely

Your seed phrase, also called a recovery phrase, is a list of 12 or 24 words that can rebuild your wallet on any compatible device. If you lose your phone or your hardware wallet breaks, those words bring your funds back. If someone else gets them, your funds can be gone in minutes. Storing them well is probably the most important thing you'll do in self-custody.

The rules that matter most

1. Never share it. No wallet, exchange, developer or support agent ever needs it.
2. Never type it into a website, a form or a chat, or anywhere except the wallet when restoring.
3. Never store it digitally. That rules out photos, screenshots, cloud notes, email, password-protected documents and messages to yourself.
4. Keep the exact order and spelling. Include the word numbers.

Where to store it: options compared

How to back it up, step by step

1. Create your wallet somewhere private, away from cameras and other people.
2. Write down the words clearly, by hand, with a pen.
3. Check the words against the screen, one by one.
4. Store a second copy in a separate safe location if the amount justifies it.
5. Test the backup by restoring it before you deposit a large amount.
6. Don't label it "crypto seed phrase". Use a plain envelope or a label only you understand.

Extra protection for larger amounts

Passphrase (the "25th word")

Many wallets let you add a passphrase on top of the seed. Someone who finds your words still can't reach funds without it. The risk is real, though: if you forget the passphrase, your funds are lost. Back it up separately from the seed phrase.

Multisig

A multisig wallet requires several keys to approve a transaction, for example 2 of 3. One lost or stolen key doesn't lose the funds. Keys from different manufacturers also protect you from a fault in one product.

Shamir backup

Some wallets can split a backup into several shares, of which only a certain number are needed. It's different from simply cutting your phrase in half, which you shouldn't do. Half of a phrase is a weak and fragile backup.

A warning from 2026: a backup only protects a good seed

Keeping your words safe assumes that they were generated securely in the first place. In July 2026 attackers began draining Bitcoin wallets created on Coldcard hardware wallets. According to TRM Labs, a build error in firmware released in March 2021 caused some devices to generate seeds with far weaker randomness than intended, which let attackers work them out. About 1,816 BTC, worth around $116 million, had been taken in the preliminary count.

The broader lesson isn't that hardware wallets don't work. It's that no single product is perfect. Keep your firmware and apps up to date, read security notices from your wallet's maker, and think about multisig across different brands for large amounts.

Plan for the people you leave behind

If something happens to you, your family may have no way of reaching your crypto. Think about writing instructions that explain what you own and where to find the backup, without including the phrase itself in that note. Keep them with your legal documents, and consider speaking with a lawyer for larger holdings.

What to do if your phrase may be exposed

Treat it as compromised, even if nothing has happened yet. Create a new wallet with a new phrase and move your funds right away, starting with the most valuable ones. Changing the wallet app's password or PIN doesn't help, because the phrase itself is what gives access.

Sources

• TRM Labs: Inside the $116 million Coldcard hack
• Fortune: Bitcoin owners lose $116 million in Coldcard exploit