In many crypto wallets, a wallet’s hidden signing keys are represented as a readable 12-word sequence often called a recovery phrase or seed.
Each wallet you set up comes with its own private key—think of it as the password to a specific account. Different wallets use different secrets, and that confidential key is what authorizes access to funds and approves transactions.
Because tracking many distinct keys is impractical, when you create your Onchain wallet, individual coin keys are processed with a standardized algorithm to derive a single master private key. That master key is then converted, via another widely used algorithm in the blockchain ecosystem, into your 12-word recovery phrase.
Why Your Phrase Matters
That 12-word list effectively stands in for the master private key that unlocks your assets inside Onchain. It’s generated by the wallet (you don’t get to pick the words), and the words must be kept in the exact order—one incorrect word, misspelling, or swapped position can prevent a successful restore.
Unsolicited requests for your phrase, “verification” prompts, or offers to “fix” an issue in exchange for access are common scam patterns.
Anyone who obtains the phrase can control your wallet from anywhere and move money.
Basic safeguards include:
- Write down your recovery phrase during wallet setup.
- Store the phrase offline (not on a computer or phone).
- Keep the phrase in a secure, physical location (such as a safe).
- Do not share the phrase with anyone.
Legitimate support can walk you through app steps, but it should not ask to view your recovery phrase.
You can also learn how to import or restore a wallet by using the phrase during the recovery process.
To regain access on a new device, install a compatible wallet app, choose the restore or import option, and enter the 12 words exactly as written and in the correct order. After restoring, confirm you’re viewing the correct address and network before making new transfers.
If you’ve lost the recovery phrase and you’re fully locked out, self-custody wallets generally can’t be recovered. If you still have access to the wallet on any device, prioritize moving funds to a new wallet you control and confirming you can restore it before you lose access.
Where Are My Private Keys Stored?
Your private keys are created and encrypted locally on your device. They are not uploaded to the cloud or kept on our servers, so you retain full control and ownership.
If you think you’ve been scammed, act quickly: stop communicating with the scammer, secure your accounts and devices, and preserve evidence such as chat logs, addresses, and transaction identifiers. If a platform or exchange was involved at any step, report the incident through its official support channel and ask whether it can flag related addresses or transactions. Consider filing a local police report and submitting a report to relevant cybercrime reporting channels in your region, especially if you have identifiable suspects or large losses.
Crypto “recovery” scams often use urgency and authority to push victims into taking irreversible actions. Common scenarios include fake support accounts, impostor “investigators,” advance-fee demands, and instructions to install software or grant remote access to a device. Red flags include guaranteed recovery promises, pressure to act immediately, requests for payment up front, and attempts to move the conversation off official channels.
Practical ways to reduce risk include verifying you’re using the platform’s official app or site, double-checking usernames and contact methods before responding to messages, and treating unsolicited offers to “recover” funds as high-risk. For transfers, use careful address checking (and small test sends when appropriate) to reduce the chance of sending to the wrong destination.
So-called crypto recovery services range from legitimate digital investigations to outright fraud. Examples of established providers in the space include Kroll, CipherBlade, and Unciphered. When evaluating any service, look for a verifiable business presence, a clear written scope of work, realistic statements about limitations, and a process that does not depend on secrecy or rushed payments. Be cautious of providers that promise guaranteed results, refuse contracts, demand large up-front fees with no deliverables, or instruct you to install unknown tools or grant remote control of your device.
For support and recovery guidance, start with official channels for the product or platform involved (such as the wallet’s in-app support and official help center, or the exchange’s official support desk). Community resources can also help you understand what happened—for example, public block explorers can help you review transaction history and confirm addresses and networks, while reputable security communities can help you recognize common scam patterns. If the incident involves theft or fraud, reporting to appropriate authorities can support broader investigations, even when direct recovery isn’t guaranteed.
If you are in the United States and want to report crypto-related crime, you can submit a complaint to the Federal Bureau of Investigation via its Internet Crime Complaint Center. You should expect to provide transaction identifiers, involved addresses, dates, amounts, and a clear narrative of events. Law enforcement may use reports to identify patterns, pursue investigations, and, in some cases, work with partners to seize assets, but there are important limitations: cases can take time, attribution is difficult, and recovery is not assured—especially when funds have moved through multiple hops or cross-border services.
