This page answers the specific questions that come up when you hold crypto yourself: what to do when something is wrong with the seed phrase, where to keep the backup, how to buy and use a hardware wallet, how to read approvals and signature requests, and how to set up an exchange account. Figures and rules in the answers follow the linked originals, checked in October 2026.

Seed phrases and private keys

Can I recover a wallet if one or two seed phrase words are missing?

Often, yes, provided the remaining words and their order are certain and you still know one receiving address from that wallet. Under BIP-39 the wordlist has 2,048 words and a 12-word seed phrase carries 4 checksum bits: with one word missing at a known position there are 2,048 candidates, about 128 of which pass the checksum; with two words missing there are about 4.19 million combinations, about 260,000 of which pass. That is far too many to import one by one, so use the open-source tool btcrecover's seedrecover.py, which tests each candidate against the receiving address or extended public key you give it. Run it only on a computer that is offline; never type an incomplete seed phrase into a web page or hand it to anyone who offers to recover it for you. How the checksum works is explained in the BIP-39 section of Private Key vs Seed Phrase.

Can I recover a seed phrase if I wrote the words in the wrong order?

If all 12 words are certain and only their order is lost, the search is still feasible. Twelve words can be arranged in about 479 million ways and roughly one in sixteen passes the checksum, which leaves around 30 million: too many to try by hand, so a program has to test each one against an address you remember. This works only if the 12 words are exactly right, with none missing, none extra and none misspelled. With 24 fully scrambled words the number of arrangements is too large to search unless you remember roughly how they were grouped. Do this on an offline device too; see the part on word order in Private Key vs Seed Phrase.

Can a seed phrase be in Chinese or another non-English language?

The standard includes wordlists in other languages, Chinese among them, but I advise against using one. The BIP-39 text says the vast majority of BIP-39 wallets support only the English wordlist and that using non-English wordlists to generate seed phrases is strongly discouraged. The wordlists are independent of one another, so a Chinese seed phrase cannot be converted word by word into English, and a wallet that only recognizes the English list will not import it. If you already created a wallet with a non-English seed phrase and want to switch, create a new wallet with an English seed phrase and move the assets over.

Is a 24-word seed phrase safer than a 12-word one?

Under BIP-39, 12 words encode 128 bits of random entropy and 24 words encode 256 bits, so on paper 24 is the larger number. But 128 bits is already beyond anything brute force can guess, and either length is enough for an individual. The difference that matters is the backup: a miscopied word, a lost sheet or someone seeing it are risks that have nothing to do with length, and more words mean more chances to copy one wrong. Use whichever length your wallet gives you and put the effort into the backup; see How to Store Your Seed Phrase Safely.

Can I import the same seed phrase into a different wallet?

Yes, as long as both wallets generate the seed under BIP-39 and derive addresses along the same derivation path; you will then see the same set of addresses. If the import succeeds but no balance shows, the usual cause is a different derivation path, or the chain holding your assets has not been added in the new wallet. It does not mean the seed phrase was stolen: look for a derivation path option under advanced settings, or check the path given in the original wallet's official documentation. After the import both wallets control the same private keys, so a leak from either one is a leak. Enter a seed phrase only in a wallet app downloaded from the official source, never in a web page. Why paths differ is explained in the section of Private Key vs Seed Phrase on addresses that differ after switching wallets.

I forgot my passphrase (the 25th word). Can it be recovered?

There is no reset or recovery option. Under BIP-39 the passphrase is part of the seed calculation and every passphrase leads to a valid wallet, so a wrong one produces no error, only an empty wallet. Trezor's documentation is direct about it: a passphrase cannot be changed, removed or recovered, the device does not store it, and losing it means losing the funds in that wallet. If you remember roughly what it was, try the likely variants on your own device, since capitalization, spaces and punctuation all count, and check each time whether the first receiving address matches. Ignore anyone who says they can recover it for an upfront fee or in exchange for your seed phrase. A passphrase needs a written backup just as the seed phrase does, kept in a separate place; see the passphrase section of How to Store Your Seed Phrase Safely.

Where to keep the backup

I advise against it. To print it, the private key or seed phrase first has to exist in plain text on a computer, and if that computer is online it already counts as exposed: the clipboard, temporary files and the print queue can all keep copies. The printer is no better, because you cannot confirm whether a networked printer or an all-in-one with storage keeps what it prints. For a paper backup, copy by hand from the wallet device's screen and check every word. Where to keep it is covered in the paper section of How to Store Your Seed Phrase Safely.

Can several people share one seed phrase?

I advise against it. A complete seed phrase is full control, so each additional holder is one more person who can move everything alone and one more opening for scams, theft or coercion; if something goes wrong you cannot tell who did it. Cutting the phrase in two by hand and giving each half to a different person is no fix either, because losing either half makes recovery impossible. For shared custody use a scheme designed for it: a SLIP-39 split backup, where an agreed number of shares must be combined to recover, or multisig, where a transaction needs signatures from several keys. Both are covered in How to Store Your Seed Phrase Safely, in the sections on split backups and multisig.

Is an encrypted ZIP of my seed phrase safe in cloud storage?

It is better than plain text in the cloud, but I would not treat it as a backup. The archive is only as strong as its password: once someone downloads the file they can keep guessing offline, the cloud service's login limits no longer apply, and short passwords or ones built from birthdays and common words will not hold. The other problem is that you eventually have to unzip it, and on an online device that puts the plain-text seed phrase on that device. Keep the backup on an offline medium such as paper or metal; see the section on photos and cloud drives in How to Store Your Seed Phrase Safely.

Is wallet data in an iCloud backup safe?

Two things need to be kept apart. One is the phone's full iCloud Backup: according to Apple, under the default Standard Data Protection the keys for that backup are held in Apple's data centers and Apple can decrypt it; it becomes end-to-end encrypted only after you turn on Advanced Data Protection. The other is passwords in iCloud Keychain, which are end-to-end encrypted under both settings. Either way, the safety of anything in the cloud is tied to your Apple Account. So keep the seed phrase out of Notes, Photos, Keychain and every cloud drive, and go by your wallet's official documentation on whether its app data is included in a device backup.

Can a family member using my computer steal my seed phrase?

The risk is usually less the family member than what a shared computer lets in: cracked software, game cheats, dubious cleanup tools and browser extensions that someone else installs run on the same system as your wallet and can read the clipboard and keystrokes. A login password does nothing about that; it only stops people who are not logged in. So keep the wallet off a shared computer: give it a device of its own, and never store the seed phrase on a computer in any digital form. Once the amount is more than you can afford to lose, move the private keys into a hardware wallet and use the computer only as its interface; see Cold Wallet vs Hot Wallet.

Hardware wallets

Do I need a hardware wallet?

Not necessarily; it depends on the amount and how you use it. A software wallet keeps the private keys on an online phone or computer, where malware on that device may be able to read them; a hardware wallet keeps them inside the device, and each transaction has to be confirmed on it. My advice is to buy one once your holdings are more than you can afford to lose, and until then to get the seed phrase backup right. Owning one does not end the work: the seed phrase still has to be looked after, and you still have to read the device screen before signing. For choosing a model see Hardware Wallet Comparison; for dividing funds between cold and hot see Cold Wallet vs Hot Wallet.

Is it safe to buy a second-hand hardware wallet?

No, and the same goes for a “brand new, sealed” one from a seller you cannot trace. The risk is a device that has been tampered with: Kaspersky analyzed in May 2023 a fake Trezor Model T bought through a classifieds website whose firmware had been modified so that the supposedly random seed phrase was one of 20 saved in the firmware in advance, which let whoever held those phrases move the coins at any time. The same article's advice is to buy only from the official vendor and to reset a new device to factory settings before using it. And if the box comes with a ready-made seed phrase, do not use the device.

Should I replace my hardware wallet every year?

There is no need to replace one on a schedule. The times to consider it are when the manufacturer stops releasing firmware updates for the model, when the device itself fails, or when it does not support a chain or feature you need. Switching devices usually does not mean moving coins: restore the existing backup on the new device and the addresses stay the same. Only a suspected seed phrase leak calls for a new seed phrase and a transfer. Day to day, update the firmware from the official source and have the backup within reach before you do. Restoring on another brand is covered in What If Your Hardware Wallet Company Fails?, and what to prepare before an update in the firmware update guide.

My hardware wallet was stolen from home. Is my crypto gone?

If only the device is gone and the seed phrase backup was not taken with it, you usually still have time to move the coins, but do not treat it as nothing. The device is protected by a PIN and wipes itself after a set number of wrong attempts; that limit and the resistance to physical attack both vary by model. Trezor states that the Model One and Model T do not include a secure element and recommends a long, random PIN for stronger resistance to physical attacks. So after a theft, restore from the seed phrase on another device as soon as you can and move the assets to addresses under a new seed phrase. The wrong-PIN limits by model and the order to work in are on the separate page Hardware Wallet Stolen: Is My Crypto Gone?

Forgot a Ledger or Trezor PIN?

Ledger resets on the 3rd wrong PIN, Trezor after 10 or 16 by model, OneKey on the 10th or 5th. Stop guessing, find the seed phrase, restore and set a new PIN. Full guide: Forgot Your Hardware Wallet PIN? Find the Seed Phrase Backup First

Software wallets day to day

What if I forget my wallet password?

If you still have the seed phrase, nothing is lost. A self-custody wallet's unlock password only encrypts the wallet data stored on that device; it is not on-chain and the wallet maker does not keep it, so no support agent can reset it for you. Delete and reinstall the wallet, import the seed phrase and set a new password: the addresses and assets are unchanged. Without the seed phrase there is no other way back in. Treat anyone offering to reset a wallet password or recover a wallet as a scam, and do not install password-recovery software of unknown origin. The restore steps are in the guide to moving a wallet to a new phone.

Can other people monitor my wallet address?

The balance and every transfer on an address are public by design: anyone can enter the address in a block explorer and see them, with no special access. Seeing an address's activity is not the same as knowing whose it is; the link usually comes from clues you leave yourself, such as withdrawing to it from an exchange account in your real name, posting a screenshot that shows the address, or using the same name for a domain and a social account. To expose less, keep the address you use for everyday interactions separate from the one for long-term holdings, and do not share screenshots showing addresses or balances. Having your address seen does not lose you coins; what to guard against is targeted phishing from someone who has made the connection.

Is a wallet safer on iOS or on Android?

The difference lies mostly in how you install and use it, not in the brand. The same rules apply on both: install the wallet app only from the official app store or from the link on the wallet's own website, never from an install file someone sends you; do not jailbreak or root the phone; keep the system and apps updated; and do not grant high-level permissions such as accessibility access to apps of unknown origin. On either system a phone wallet keeps its private keys on an online device, which makes it a hot wallet, so hold only an amount you could lose without it affecting your life; see Cold Wallet vs Hot Wallet.

How do I keep accounts on several chains organized?

Divide by purpose, not by chain. One seed phrase gives the same address on every EVM chain, so opening a separate wallet for each chain does not separate any risk. A more useful split is one address that connects to dapps and signs approvals, holding small amounts only, with the main holdings under a different seed phrase at addresses that never connect to any dapp. If the everyday address signs a bad approval, the loss is capped at what it holds. Approvals are recorded chain by chain, so check every chain you have used; see the section on leaving fewer approvals behind in How to Check and Revoke Token Approvals.

Is it safe to use a wallet on public Wi-Fi?

Wallet apps and exchange websites use encrypted connections, so other people on the same Wi-Fi generally cannot see what is transmitted. What to watch for is a fake hotspot: someone sets up Wi-Fi with the same name as the venue's and steers you to a fake version of the site you wanted, or shows a login page asking for your email and password. When you are out, stop if the browser warns about a certificate, check the domain character by character without relying on the padlock, and never enter any account password in a Wi-Fi login page. For transfers or logging in to an exchange, mobile data is the safer choice.

Why did a random token appear in my wallet?

Someone sent it to your address; sending a token to any address needs no consent from the recipient. Sitting in your list it does no harm. The loss comes from what you do next: going to the website in the token's name to “claim” or “swap” it and, once there, signing an approval for your real USDT or USDC or typing in your seed phrase. So leave it alone: no clicking links, no swapping, no sending it out, and hide it in the wallet if it bothers you. A related trick is address poisoning: a zero-value transfer meant to plant a fake address, matching the start and end of one you use, in your history for you to copy next time. How to tell the two apart and defend against each is on the separate page Why Did a Random Token Appear in My Wallet?

Approvals and signatures

I connected to a phishing dapp but signed nothing. Am I at risk?

If you only clicked Connect and confirmed none of the requests that followed, all the site has is your address, which is public anyway and cannot move assets. Moving your coins takes a transaction or signature that you confirm yourself, including gasless off-chain signatures such as Permit, so the test is whether you clicked confirm in a wallet pop-up, not whether you paid gas. If you typed your seed phrase into that page, treat it as a leak. To be safe, disconnect the site in your wallet and look in an approval checker for anything recent you do not recognize; disconnecting does not revoke any approval. The steps are in the disconnect section of MetaMask Security Settings and in How to Check and Revoke Token Approvals.

Do token approvals expire or get revoked automatically?

No. ethereum.org's guide to revoking token access states that token approvals do not expire: an allowance stays valid until you send a transaction setting it to 0, whether or not you ever return to the site and whatever balance the address held at the time. The exception is the allowance that Permit2 passes on to individual apps, which carries an expiry time and lapses when it is reached. The deadline inside a Permit signature only limits how late that signature can be submitted on-chain; it is not a lifetime for the approval once it is active. An address that signed a malicious approval can stay in use once that approval is revoked; only a leaked seed phrase calls for new addresses. Checking and revoking are covered in How to Check and Revoke Token Approvals.

Why are Permit signatures dangerous?

Permit (EIP-2612) lets you approve a token by signing an off-chain message, with no transaction and no gas. The danger is that it does not look like an approval: the pop-up shows a block of structured data, and after you sign nothing appears on-chain until the party holding the signature submits it, so until then neither your transaction history nor your approval list shows it. Before signing check three things: the spender address, the amount and the deadline, and reject the request if any of them is not what you expected. If you think you signed a bad one, Revoke.cash explains that you can try to cancel a signature that has not been submitted yet from its Signatures tab, and that one already in effect is an ordinary approval, revoked the usual way; move the affected token to another address as well. More in the Permit section of How to Check and Revoke Token Approvals.

I clicked an airdrop claim and my tokens were taken. What now?

What has left cannot be brought back; what you can do is stop further loss. First look at the outgoing transfer in a block explorer. If it was sent from someone else's address calling transferFrom, they used an approval you signed: revoke it and the address remains usable. If the sender is your own address, or you typed your seed phrase into that page, treat it as a seed phrase leak, create a new seed phrase and move what is left; if you cannot tell which case it is, treat it as a leak. Keep the transaction hash, the URL and screenshots for a police report. Anyone who then contacts you offering on-chain recovery for an upfront fee is running a second scam aimed at you. Both paths are laid out in Seed Phrase or Private Key Leaked? What to Do.

Exchange accounts

Can you still use Binance in mainland China?

Under the regulations now in force, no. Notice Yinfa [2026] No. 42 (Chinese-language official text), in effect since 6 February 2026, states that business activities related to virtual currencies are illegal financial activities and that overseas entities and individuals may not, in any form, illegally provide virtual-currency-related services to parties inside China; the same notice repealed Yinfa [2021] No. 237. This site offers no way around it. The other relevant passages of the notice are on the separate page Can You Still Use Binance in Mainland China?

I withdrew to the wrong address. Can exchange support get it back?

Once an on-chain transfer is confirmed it cannot be reversed, and exchange support cannot alter the chain's record. There is a chance in one kind of case only: the address was right and the network was wrong, or the coins landed on an address controlled by an exchange. Then take the transaction hash to that platform's official help center and file a recovery request; whether it succeeds, and whether there is a fee, is up to them. Coins sent to a stranger's address are almost never recovered, and anyone who messages you offering to recover them for an upfront fee or your seed phrase should be treated as a scammer. The next time you withdraw to a new address, send a small amount first, check the full address character by character and confirm the network. Handling by case is in Sent USDT to the Wrong Network? What to Do.

Can SMS two-factor authentication really be defeated?

Yes, and it has nothing to do with how strong your password is. Where an SMS code goes depends on which SIM card your number is attached to at that moment; an attacker who impersonates you and gets the carrier to reissue or transfer the number to a SIM they hold receives the codes, which is called SIM swapping. A February 2022 announcement from the FBI's Internet Crime Complaint Center says it received 1,611 such complaints in 2021 alone, with adjusted losses of more than $68 million. So turn SMS off wherever you can and use an authenticator app or a passkey; where a platform requires SMS, follow its official instructions and add the stronger method too. The four methods are compared in Is SMS 2FA Safe? Authenticator vs Passkey.

What is a withdrawal allowlist, and should I turn it on?

A withdrawal allowlist (labeled “whitelist” on many exchanges) is an exchange account setting: once it is on, coins can be withdrawn only to addresses registered and verified in advance, and withdrawals to any other address are refused. It guards the step after someone gets into your account: they cannot simply withdraw to a fresh address of their own and have to add one first, which gives you time to notice and act. I recommend turning it on and adding only addresses you have confirmed with a small test transfer. It is no substitute for two-factor authentication, and it will not hold if your email and account are both compromised. Where the setting lives, and whether a newly added address has a waiting period, differs by platform; go by the platform's security settings page.