{"id":71,"date":"2026-09-02T09:25:58","date_gmt":"2026-09-02T09:25:58","guid":{"rendered":"https:\/\/getbitcoin.guide\/articles\/your-recovery-phrase\/"},"modified":"2026-10-18T09:28:20","modified_gmt":"2026-10-18T09:28:20","slug":"your-recovery-phrase","status":"publish","type":"post","link":"https:\/\/getbitcoin.guide\/articles\/your-recovery-phrase\/","title":{"rendered":"Your Recovery Phrase: The Ways People Actually Lose It"},"content":{"rendered":"\n

Your recovery phrase is the wallet. Lose it and no company can restore it, because none of them hold a copy. People lose phrases in two ways: the backup is destroyed, misplaced or written down wrong, or somebody talks them into revealing it. The second is now far more common than the first.<\/strong><\/p>\n\n\n\n

Trezor calls it a wallet backup, Ledger calls it a Secret Recovery Phrase, most software wallets call it a seed phrase. Same thing, same consequence when it goes. What follows is drawn from vendor security documentation and from law enforcement filings, not from a checklist somebody rewrote.<\/p>\n\n\n\n

What is a recovery phrase actually doing?<\/h2>\n\n\n\n

It is not a password on an account. There is no account. The words are a human readable encoding of the number that every private key in your wallet is mathematically derived from, under the BIP39 standard published in the Bitcoin Improvement Proposals repository.<\/p>\n\n\n\n

BIP39 uses a list of 2,048 words, so each word carries 11 bits. A 12 word phrase encodes 128 bits of entropy plus a short checksum, and a 24 word phrase encodes 256 bits. That is why the phrase alone rebuilds the wallet on any compatible device, and why anyone who reads it can do the same from anywhere in the world without touching your hardware.<\/p>\n\n\n\n

Two consequences follow. No support desk can recover a lost phrase, because it never leaves your possession in the first place. And a copy of the phrase is a copy of the money. Those two facts are the whole of what self custody actually asks of you<\/a>.<\/p>\n\n\n\n

Which ways do people actually lose a recovery phrase?<\/h2>\n\n\n\n

The failure modes are unglamorous and they repeat.<\/p>\n\n\n\n

What people do<\/th>What goes wrong<\/th>Any way back?<\/th><\/tr><\/thead>
Photograph the words<\/td>The photo syncs to a cloud account defended by a password and a phone number<\/td>No, once copied<\/td><\/tr>
Save it in a password manager or cloud note<\/td>It becomes an online secret and inherits every breach of that service<\/td>No, once copied<\/td><\/tr>
Type it into a website or a support chat<\/td>The wallet is usually emptied within minutes<\/td>No<\/td><\/tr>
Leave the card in the device box<\/td>The box gets thrown out, or given away with the device<\/td>Only if the card turns up<\/td><\/tr>
Write it badly<\/td>Unreadable handwriting, wrong order, or a word that fails the checksum<\/td>Sometimes, with patience<\/td><\/tr>
Store one copy only<\/td>Fire, flood, a house move or a burst pipe ends it<\/td>No<\/td><\/tr>
Split it in half across two places<\/td>Losing either half loses everything<\/td>No, if a half is lost<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Notice how many of those have nothing to do with hackers. A great deal of permanently lost coin went into bin bags during house moves. The other cluster, the growing one, is people being persuaded.<\/p>\n\n\n\n

\"A
Moving houses is one of the most common times physical backups go missing.<\/figcaption><\/figure>\n\n\n\n

Why is a password manager the wrong place for it?<\/h2>\n\n\n\n

This is the advice everyone repeats and almost nobody evidences, so here is the evidence. In August and November 2022, attackers stole backups of customer vaults from the password manager LastPass. The vaults were encrypted, but they were now in the attackers hands to crack offline, at leisure, for as long as they liked.<\/p>\n\n\n\n

A United States Secret Service forfeiture complaint, reported in March 2025, sets out what happened to one of those customers. On 30 January 2024, roughly 150 million US dollars in cryptocurrency was taken from a wallet belonging to Ripple co founder Chris Larsen, named as Victim 1 in the filing. Investigators state he had stored his seed phrase in the Secure Notes section of his LastPass account before the 2022 breaches. About 24 million US dollars had been seized back by 6 March 2025. Analysis published by TRM Labs in December 2025 tied a longer run of thefts to the same vault data.<\/p>\n\n\n\n

The point is not that one password manager was bad. It is the shape of the problem. A phrase stored in any online service is only as safe as that service, your master password, and the next few years of that company existing. It has no expiry date, so a vault stolen in 2022 was still paying attackers in 2025.<\/p>\n\n\n\n

The same reasoning rules out email drafts, notes apps, screenshots and any messaging app you might use to send it to yourself. Trezor documentation states it plainly: do not keep digital copies of your wallet backup, and that explicitly includes screenshots, photographs, emails and Dropbox.<\/p>\n\n\n\n

What do the wallet makers themselves say about where it can be entered?<\/h2>\n\n\n\n

Trezor guidance on using a wallet backup says never enter your wallet backup anywhere unless prompted by your Trezor device, and adds that Trezor will never ask for it even if you are speaking to their own customer support. Ledger support material is equally blunt: there is never a good reason to type your recovery phrase into a computer, and you should never enter the 24 words on any device other than the Ledger hardware wallet itself.<\/p>\n\n\n\n

So the legitimate places a phrase is ever typed are vanishingly few: onto your own hardware wallet during a recovery, or into a software wallet you are deliberately restoring on a device you control. That is the list. A browser page, a support agent, an app from a search result, a QR code on a letter, none of them qualify. Which is why the confusion about which Coinbase product even has a phrase<\/a> matters, because a searcher who does not know which product they are in will type words into whatever asks.<\/p>\n\n\n\n

\"Flat
Verify the words against the device itself, never against a website that offers to check them for you.<\/figcaption><\/figure>\n\n\n\n

How are recovery phrases being phished right now?<\/h2>\n\n\n\n

The current wave is notable because it is not digital. Through 2025 and into 2026, owners of Trezor and Ledger devices received printed letters through the post, laid out to look like official correspondence, telling them to complete an urgent security procedure by scanning a QR code. The code leads to a page that imitates a wallet setup screen and asks for the recovery phrase. The digital route has not gone away: in August 2026 a fake Trezor setup page bought the top sponsored Google result, and the check for the real Trezor address before downloading anything<\/a> shows what that page collected.<\/p>\n\n\n\n

The 2026 version leans on quantum computing, demanding a post quantum security upgrade by a deadline. Ledger publicly stated in June 2026 that the letters are fraudulent, and it maintains a running list of active phishing campaigns plus a support article on letters claiming to come from Ledger. Neither page would load while this was written, so treat the campaign detail as reported rather than quoted. Ledger standing position is not in doubt: it never asks for the 24 words, anywhere, ever.<\/p>\n\n\n\n

Postal phishing works because a letter feels verified. Someone had your name, your address and the knowledge that you own a wallet. But buyer records have circulated since the 2020 Ledger e commerce data leak, so a letter proves only that a list exists.<\/p>\n\n\n\n