Trezor recovery seed stolen: what to do immediately

25 September 2026

If your Trezor recovery seed has been stolen, move your funds to a new wallet right now. Do not wait. Do not assume the thief cannot use it. Anyone with your 12, 18, 20, or 24 seed words can take full control of every cryptocurrency wallet derived from that seed, including any hidden wallets protected only by a passphrase you have already set. The only safe response is to generate a new seed on a wiped or different Trezor device and transfer all assets to the new wallet before the thief does.

Step One: Do Not Use the Old Wallet for Anything

Stop all transactions from the compromised wallet immediately. Every new outgoing transaction you broadcast reveals the public key to anyone watching the blockchain. That does not help the thief directly, but it wastes time you could spend moving funds. More importantly, do not send funds to the compromised wallet. Any coins arriving there are already under the thief’s control if they have the seed.

Step two: create a new, clean seed

You need a Trezor device that has never held the stolen seed, or you need to wipe your current device and generate a fresh seed. The process:

1. If you have a second Trezor, use that. If not, you will wipe the one you have.
2. Connect the device to Trezor Suite. If you are wiping, go to Settings → Device → Wipe device. Confirm the wipe. The device will restart.
3. Trezor Suite will prompt you to set up as new. Choose “Create a new wallet.”
4. The device will generate a new recovery seed. Write it down on the card provided with the device. Store it somewhere the original thief cannot find. Do not photograph it, type it into any computer, or save it in a cloud service.
5. Set a new PIN. Do not reuse the old PIN.

You now have a wallet the thief cannot access.

Step Three: Move All Funds from the Old Wallet

You still have access to the old wallet through Trezor Suite or another supported interface. That access will last only until the thief moves the coins first. Work quickly.

1. In Trezor Suite, switch to the old wallet by entering its PIN (or by connecting the device if you have not wiped it yet).
2. Send every balance to the new wallet’s receiving address. For each cryptocurrency:
3. Click Receive in the new wallet to get a fresh address. Verify the address on the Trezor screen.
4. In the old wallet, click Send. Paste the new address. Send the full balance. If the wallet allows “max” or “send all,” use that to avoid leaving dust.
5. Confirm the transaction on the device.
6. Repeat for every coin type the old wallet held. Do not forget tokens on networks like Ethereum or Binance Smart Chain. You may need to add those accounts manually in Trezor Suite if they do not appear by default.
7. Check for hidden wallets created with a passphrase. If you used a passphrase (sometimes called a 25th word), the thief also needs that passphrase to access those wallets. But if the thief has the seed and knows or guesses the passphrase, those funds are also at risk. Move them too by entering the passphrase on the old wallet, sending to a new passphrase-protected wallet derived from the new seed.

Step four: revoke approvals and change passwords

After the funds are safe, address the secondary risks:

• Smart contract approvals. If you used the old wallet with decentralized exchanges or DeFi apps, those apps may still have approval to spend your tokens. Since the wallet is now empty, this is less urgent, but a thief who controls the wallet could still interact with those contracts. Use a revoke tool (such as Etherscan’s token approval checker or Revoke.cash) to cancel all approvals on the old addresses.
• Exchange accounts and services. If you ever deposited from the old wallet to a centralized exchange, the thief cannot take those deposited funds. But if you reused addresses or linked personal information, consider whether the thief could use the seed to impersonate you on services that allow recovery via signed messages. Change passwords and enable two-factor authentication on any exchange accounts that were connected to the old wallet.
• Passwords stored in the wallet. Some people keep passwords or notes in the Trezor Suite “Notes” feature. Those are not on the blockchain and are not accessible with just the seed, but if the thief has your Trezor device and PIN, they can read them. Change any sensitive passwords stored there.

Step five: investigate how the seed was stolen

Once the crisis is handled, figure out what went wrong so it does not happen again. Common causes:

• You typed the seed into a website, email, or software wallet. No legitimate service ever asks for your seed.
• You stored the seed digitally - in a photo, a cloud document, a password manager, or a text file. Any device connected to the internet is a risk.
• Someone physically saw or photographed your seed card.
• You bought a pre-owned or counterfeit Trezor. Always buy directly from the manufacturer.
• You entered the seed into a recovery tool on a compromised computer.

Fix the root cause before you trust the new seed with significant value.

What if you cannot move funds in time?

If the thief has already drained the wallet, there is nothing you can do. Cryptocurrency transactions are irreversible. No bank, no exchange, no hardware wallet company can reverse a blockchain transaction. File a report with local law enforcement if the amount is large, but do not expect recovery. The experience is a hard lesson in seed security: the seed is the wallet. Guard it as you would cash.

Can you recover the old wallet after wiping?

No. Once you wipe the Trezor device and generate a new seed, the old wallet is gone from that device. You could recover the old wallet again if you still have the stolen seed written down, but that would put your funds back at risk. Do not do that. The old wallet is compromised permanently. Destroy the stolen seed card after you confirm all funds have moved successfully to the new wallet.

Back to trezor