.png){kind=logo}
A seed phrase is not a backup of a crypto wallet. It is the wallet. Every design discussed in this article, from a sheet of paper to a certified hardware device, is a different answer to one question: who can reach that secret, and by what route? This reference sets out the threat model behind seed phrases and hardware wallets, states what each design defends against according to specifications, government vulnerability records and peer-reviewed research, and marks the places where the evidence is thin.
The short version is uncomfortable for anyone presenting a single product as the answer. A hardware wallet defends well against one class of attack, remote malware reading keys from a general-purpose computer, and does little or nothing against phishing of the seed phrase, physical coercion, loss of the backup or a poorly understood signature. This article is a factual reference. It does not constitute investment or financial advice, and nothing here is a recommendation to buy, hold or sell any asset or device.
What is a seed phrase, and what does it actually protect?
A seed phrase is a human-readable encoding of the random number from which every private key in a wallet is derived, so anyone who holds the phrase holds the funds. The format most wallets use is defined in Bitcoin Improvement Proposal 39 (BIP-39), dated 10 September 2013 in the BIP repository and authored by Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe. The specification takes 128 to 256 bits of entropy, appends a short checksum, and maps each 11-bit group to one word from a fixed list of 2,048 words.
The companion standard, BIP-32, authored by Pieter Wuille and created on 11 February 2012, describes "a system for deriving a tree of keypairs from a single seed". That is why one phrase can restore a very large number of addresses. It is also why a single leaked phrase exposes all of them at once.
| Entropy (bits) | Checksum (bits) | Total (bits) | Words in phrase |
|---|---|---|---|
| 128 | 4 | 132 | 12 |
| 160 | 5 | 165 | 15 |
| 192 | 6 | 198 | 18 |
| 224 | 7 | 231 | 21 |
| 256 | 8 | 264 | 24 |
To turn the words into the binary seed, BIP-39 runs PBKDF2 with HMAC-SHA512 and an iteration count of 2,048, using the string "mnemonic" plus an optional passphrase as the salt, and outputs 512 bits. An iteration count of 2,048 adds little cost to each guess. The design therefore relies on the entropy of the phrase itself. With 128 bits of entropy, a 12-word phrase from a sound random number generator is one of 2 to the power of 128 possible values, a number with 39 digits. The qualifier about the random number generator matters, as the incident record below shows.
What does each wallet design defend against, and what does it leave open?
Each design moves the secret to a different place, and so changes which attacker can reach it. A software wallet keeps keys on a phone or computer that also runs a browser, email and downloaded apps. A hardware wallet keeps keys on a separate device that signs transactions internally and shows the details on its own screen. A passphrase, a Shamir backup or a multisignature setup then changes what a single stolen item is worth.
The US Securities and Exchange Commission's Office of Investor Education and Assistance drew the same basic distinction in its investor bulletin of 12 December 2025, Crypto Asset Custody Basics for Retail Investors. As summarised by the insurance trade publication Beinsure, the bulletin says hot wallets connect to the internet, cold wallets stay offline, and cold wallets "can be lost, damaged, or stolen". We could not open the bulletin directly during research because the investor.gov page refused automated access, so the wording here comes from secondary coverage.
| Threat | Software wallet on a phone or PC | Hardware wallet with seed on paper | Added BIP-39 passphrase | Multisig or Shamir backup |
|---|---|---|---|---|
| Remote malware reading keys from the computer | Exposed | Largely addressed, keys stay on the device | No change | No change |
| Phishing that asks the user to type the seed phrase | Exposed | Exposed | Partly addressed if the passphrase is not disclosed as well | Partly addressed, one share or key is not enough |
| Weak random numbers when the wallet is created | Exposed, see CVE-2023-31290 and CVE-2023-39910 | Depends on the device's generator, which the user cannot easily audit | Little help if the passphrase is short | Multisig across vendors reduces reliance on one generator |
| Thief with physical access to the device | Depends on phone or disk encryption | Depends on the chip, see the 2019 and 2020 extraction research | Addressed for the passphrase wallet, the passphrase is not stored on the device | Addressed if the other keys or shares are elsewhere |
| Malicious or tampered firmware | Comparable risk from a malicious app | Exposed, see Dark Skippy | No protection | Multisig needs a quorum of compromised signers |
| Physical coercion of the owner | Exposed | Exposed | Decoy wallet possible, benefit unproven | Separation of keys may delay access, benefit unproven |
| Loss, fire or death of the only person who knows | Exposed | Exposed | Made worse, one more secret to lose | Tolerates loss of some parts by design |
| Signing a harmful transaction the user does not understand | Exposed | Exposed unless the device can display the full meaning | No change | No change |
Two rows deserve emphasis. No design in the table protects a user who types the seed phrase into a website, and no design protects a user who approves a transaction they do not understand. The second point matters most for tokens and collectibles, where the thing being signed is often a contract interaction and not a simple payment. Readers who hold such assets can find background in our piece on fractional NFTs and digital collectibles.
How have seed phrases actually failed in the documented record?
The best documented technical failures involve broken randomness at the moment the phrase was created, not broken cryptography. The US National Vulnerability Database (NVD), maintained by NIST, records two cases published in 2023 in which wallet software produced phrases from only 32 bits of entropy. A 32-bit space holds about 4.29 billion values, against the 39-digit number above.
CVE-2023-31290, published on 27 April 2023, states that Trust Wallet Core before version 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, "allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023". CVE-2023-39910, published on 9 August 2023 and known as Milk Sad, covers Libbitcoin Explorer 3.0.0 to 3.6.0, where a Mersenne Twister generator "restricts the internal entropy to 32 bits regardless of settings". The record notes exploitation in June and July 2023. It also notes that the vendor's position is that its documentation advised against using the affected command, and that others disagree. Neither record gives a loss total, so we do not quote one.
| Incident | Year | What failed | Reported scale or condition | Source type |
|---|---|---|---|---|
| Trust Wallet browser extension, CVE-2023-31290 | 2022 to 2023 | 32-bit entropy at phrase creation | Exploited in the wild in December 2022 and March 2023, CVSS 3.1 base score 5.9 | Government database (NVD) |
| Libbitcoin Explorer bx seed, CVE-2023-39910 (Milk Sad) | 2023 | Mersenne Twister generator limited entropy to 32 bits | Versions 3.0.0 to 3.6.0, exploited in June and July 2023, CVSS 3.1 base score 7.5 | Government database (NVD) |
| Trezor USB stack fault injection | 2019 | Electromagnetic glitch leaked memory that included the recovery seed | Physical possession, enclosure unopened, success rate under 0.1% per attempt according to the author, fixed in firmware | Peer-reviewed workshop paper (USENIX WOOT 2019) plus the author's blog |
| Trezor One and Model T read-protection downgrade | 2020 | Voltage glitch exposed the encrypted seed, followed by PIN brute force | About 15 minutes of physical access, not fixable by firmware according to Kraken | Company security lab blog, not peer-reviewed |
| Ledger e-commerce and marketing database breach | 2020 | Customer contact data, not keys or phrases | About 1 million email addresses and about 272,000 detailed records according to Ledger | Vendor statement |
| Dark Skippy | 2024 | Malicious firmware can leak the seed through signatures | Two signatures in the proof of concept, not seen in the wild as of August 2024 | Researchers' own disclosure, not peer-reviewed |
The pattern in Table 3 is that the phrase format held and the system around it failed. None of the entries involves an attacker guessing a properly generated 12-word or 24-word phrase. For a user, the awkward part is that the quality of a random number generator cannot be checked by looking at the words it produces.
Can someone with physical access extract the seed from a hardware wallet?
On some devices yes, and the published demonstrations are specific about the conditions. In a paper at the 13th USENIX Workshop on Offensive Technologies in August 2019, Colin O'Flynn of Dalhousie University used electromagnetic fault injection against the USB stack of a Trezor wallet and read back memory that included the recovery seed. The attack did not require opening the enclosure. On his own blog O'Flynn put the success rate below 0.1% per attempt, which he said translated into a few hours of trying, and noted that a passphrase-protected seed could not be dumped this way. He reported that Trezor fixed the flaw in firmware 1.8.0 for the Trezor One and 2.1.0 for the Model T.
In January 2020 Kraken Security Labs, the research arm of a crypto exchange, reported that it could extract the encrypted seed from a Trezor One or Model T with about 15 minutes of physical access by voltage glitching the STM32 microcontroller. Kraken said a four-digit PIN could then be brute-forced in under two minutes, and that the weakness was in the hardware and could not be patched by firmware. It estimated that a purpose-built glitching device could be sold for about 75 US dollars, although its own proof of concept used several hundred dollars of equipment. This is a company blog, not a primary or peer-reviewed source, and we cite it because the mitigation Kraken recommended, and which search results indicate Trezor also recommended, follows directly from the specification: enable the BIP-39 passphrase, which is not stored on the device.
Devices built around a secure element aim to resist this class of attack, and some carry a government-issued certificate. According to certificate ANSSI-CSPN-2023/13 from the French cybersecurity agency ANSSI, as indexed by search during our research, the Ledger Nano S Plus with firmware SE 1.0.4 passed a first-level security evaluation by the EDSI laboratory, signed on 21 July 2023 with a validity of three years. A certificate of this kind covers one product at one firmware version for a limited period, so it is evidence about a tested configuration and not a permanent guarantee for the device in a reader's drawer. On its stated terms, that three-year validity ended in July 2026. We were unable to parse the certificate PDF directly, so this paragraph rests on the search index of an official document.
Can the hardware wallet itself leak the seed?
In principle yes, if its firmware is malicious, and this is the threat a hardware wallet is structurally worst at handling because the user has to trust the device's own screen. Arapinis, Gkaniatsou, Karakostas and Kiayias gave the first formal model of Bitcoin hardware wallet operations at Financial Cryptography 2019. They proved security under standard cryptographic assumptions when every component follows the protocol, and then examined attacks that arise when commercially available wallets deviate from it. The practical reading is that a hardware wallet is a system of device, host software and user, and the guarantee holds only when all three behave.
Dark Skippy, disclosed privately to about 15 vendors on 8 March 2024 by Lloyd Fournier, Nick Farrow and Robin Linus, shows what a misbehaving device could do. Malicious firmware chooses weak signing nonces that embed pieces of the seed, so the seed leaves the device inside ordinary signatures broadcast to the network. The researchers say earlier versions of the idea needed dozens of signatures and theirs needs two. They also say the attack "has not yet been seen in the wild", and their FAQ dated August 2024 repeats that. The mitigations they list are anti-exfiltration signing protocols, which their FAQ says two devices supported at the time, and multisignature wallets, where a quorum of signers would need to be malicious.
The evidence here is a working proof of concept on the researchers' own disclosure site, not a peer-reviewed paper and not an observed theft, so it shows possibility and says nothing about frequency. The precondition is also demanding. An attacker must get modified firmware onto the device, through a tampered supply chain or through a user tricked into installing it.
Why is asking for the seed phrase still the cheapest attack?
Because it bypasses every technical control at once, and the user cannot be patched. If an owner types the phrase into a fake support page, the attacker restores the wallet on their own device and the hardware wallet is never touched.
The 2020 breach of Ledger's e-commerce and marketing database shows how attackers find people to ask. In a message dated 21 December 2020, Ledger's chief executive said about 1 million email addresses had been stolen and that a database released publicly contained detailed records, including postal addresses and phone numbers, for about 272,000 customers. No keys or recovery phrases were involved. The company acknowledged that customers had been targeted by email and SMS phishing and wrote: "NEVER ever share your 24 words with ANYONE. Not even Ledger." This is a vendor statement about its own failure, which we treat as reliable on the scale of the leak and as no evidence at all about how much was later stolen.
Official loss figures give context but do not isolate seed phrase theft. The FBI's Internet Crime Complaint Center published its 2025 annual report in April 2026. As reported by The Record, it logged 1,008,597 complaints and more than 11.3 billion US dollars in losses tied to cryptocurrency. The ABA Banking Journal reported the crypto figure as a 22% increase on 2024 and put investment fraud of all kinds at more than 8.6 billion US dollars. These are losses reported by complainants to a US agency, and investment fraud typically involves victims sending funds themselves, not a broken wallet. We found no official dataset that separates losses caused by stolen seed phrases from other crypto losses, so any precise share quoted elsewhere should be treated with caution.
What can any wallet design do about physical coercion?
Very little, according to the only peer-reviewed study we found. Ordekian, Atondo-Siu, Hutchings and Vasek presented what they describe as the first comprehensive study of so-called wrench attacks at the 6th Conference on Advances in Financial Technologies in 2024. They drew on 10 interviews with victims and experts, 146 news articles and 37 online forums. They found attackers ranging from organised crime groups to friends and family, acts ranging from blackmail to murder, and under-reporting driven by fear of revictimisation. They also state that users with advanced security experience were not immune.
The sample is built from interviews, news reports and forums, and the authors themselves say the attacks are under-reported, so the counts are a floor and not a rate. Our reading is that a hardware wallet converts a remote attack into a local one without removing the incentive. A BIP-39 passphrase allows a decoy wallet, because in the words of the specification "every passphrase generates a valid seed". Whether decoys work against a violent and informed attacker has not been tested in any study we could find, and we grade that claim as weak.
Do passphrases, Shamir backups and multisig close the gaps?
They close some gaps and open others, and we found no controlled study comparing their real-world outcomes. Each one reduces the value of a single stolen object. Each one also adds something the owner can lose or get wrong.
A BIP-39 passphrase is mixed into the salt when the seed is derived, so a thief with the 24 words and no passphrase opens a different wallet from the one that holds the funds. The specification is explicit that there is no wrong passphrase, which means a typing error silently opens another empty wallet and a forgotten passphrase cannot be reset. SLIP-39, published by SatoshiLabs, applies Shamir's secret sharing to wallet backups. It splits the master secret so that any T of N shares rebuild it, supports up to 16 groups of up to 16 members, and uses 20-word shares for a 128-bit secret and 33-word shares for a 256-bit secret from its own list of 1,024 words. The specification states that knowledge of fewer than the required number of shares leaks no information about the secret, the property Adi Shamir described in Communications of the ACM in 1979. Its word list and share lengths differ from BIP-39, so the two formats are not interchangeable.
Multisignature wallets require several independent keys to sign, so a single compromised device or phrase is not enough. The Dark Skippy authors name multisig as a meaningful defence for that reason. The trade-off is operational: every extra key, share or passphrase is another item that must survive fire, forgetfulness and inheritance, and the US Federal Trade Commission's consumer guidance says that if a wallet is lost or compromised the owner is "likely to find that no one can step in to help you recover your funds".
Does any regulator or insurer stand behind a self-custodied wallet?
No. Self-custody sits outside deposit insurance and largely outside licensing regimes, which is the legal mirror of its technical independence. The FDIC's fact sheet of 28 July 2022 states that deposit insurance "does not apply to financial products such as stocks, bonds, money market mutual funds, other types of securities, commodities, or crypto assets". It adds that FDIC insurance does not protect against the failure of any non-bank entity, "including crypto custodians, exchanges, brokers, wallet providers, and neobanks".
In the European Union, recital 83 of the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, says licensed custodians should be held liable for losses from ICT incidents including cyber-attacks and theft, and then states: "Hardware or software providers of non-custodial wallets should not fall within the scope of this Regulation." A recital explains intent and is not an operative article, but the direction is clear. A customer of a regulated custodian has a liable counterparty, and a self-custody user has none. NIST made the underlying technical point in its 2018 Blockchain Technology Overview (NIST IR 8202): a lost private key cannot be regenerated, and blockchain networks have no account recovery function.
This is the background to the custodial alternative. Our coverage of banks gaining approval to hold bitcoin in custody, the Basel III capital treatment of crypto exposures and the US Treasury's stablecoin guidelines describes the other side of the trade. Custody moves the key-management risk to an institution and replaces it with counterparty, insolvency and access risk. Investors who hold exposure through funds or brokerage-style apps, as discussed in our pieces on ESG crypto funds and social trading platforms, never see a seed phrase at all. Neither model is safer in the abstract, because each one removes a different set of threats and accepts another.
How strong is the evidence behind each claim in this article?
It is uneven, and the table below grades it claim by claim. Specifications and government records support the statements about how seed phrases work and how they have failed. The statements about how often each attack happens, and about which mitigation works best, rest on much weaker ground.
| Claim | Type of evidence | Strength |
|---|---|---|
| A BIP-39 phrase encodes 128 to 256 bits of entropy with a checksum | Primary specification | Strong |
| Weak random number generation has led to real theft | Government vulnerability database, two CVE records that state exploitation in the wild | Strong on occurrence, no loss totals |
| Seeds have been extracted from specific hardware wallets with physical access | One peer-reviewed workshop paper and one company lab blog | Moderate, limited to named models and to older firmware or hardware |
| A secure element certificate shows a device is safe | Official certificate seen only through a search index, scoped to one firmware version and three years | Weak as a general claim |
| Malicious firmware can leak a seed through signatures | Self-published proof of concept, no observed attacks as of August 2024 | Moderate for possibility, none for prevalence |
| Asking for the seed phrase is the cheapest attack on a hardware wallet user | Design reasoning, one vendor statement, general FBI fraud totals that do not isolate it | Weak, a reasoned view and not a measured fact |
| Physical coercion affects experienced users too | One peer-reviewed study using 10 interviews, 146 news articles and 37 forums | Moderate, qualitative, under-reporting acknowledged |
| Passphrases, Shamir backups and multisig reduce single points of failure | Specifications and design reasoning, no outcome studies | Moderate on mechanism, weak on real-world benefit |
| Decoy wallets help under duress | A feature of the specification only, no empirical test found | Weak |
| Self-custodied assets have no deposit insurance or liable custodian | FDIC fact sheet, MiCA recital 83, FTC guidance | Strong for the US and EU, not checked for other jurisdictions |
| Hardware wallets cannot protect against signatures the user does not understand | Design reasoning and the trust assumptions of the formal model, no dedicated primary study opened | Weak to moderate |
Three gaps stand out. We found no peer-reviewed measurement of how often hardware wallet owners lose funds compared with software wallet or custodial users. We could not open several primary PDFs, including the FBI report and a user survey from Financial Cryptography 2016 whose loss figures we therefore left out. Readers should treat any article that ranks wallet types by safety without such data, including this one, as offering an argument and not a result.
What do readers most often ask about seed phrases and hardware wallets?
The answers below are short versions of the sections above.
Is a 12-word seed phrase weaker than a 24-word one?
On paper yes, but the difference has not mattered in any incident documented here. BIP-39 gives 12 words 128 bits of entropy and 24 words 256 bits. The thefts recorded in the NVD came from generators that supplied only 32 bits, which would have undermined a 24-word phrase just as easily.
Does a hardware wallet make the seed phrase unnecessary?
No. The device is a signing tool and the phrase remains the master copy of the wallet. If the device breaks, the phrase restores the funds on a new one, and if the phrase leaks, the device offers no protection.
Should a seed phrase be stored digitally, for example in a photo or a cloud note?
Every digital copy brings back the remote attacker that a hardware wallet was bought to exclude. The SEC bulletin, as summarised by Beinsure, warns that anyone with the phrase can take control. We found no study that measures the loss rate of paper or metal backups against digital ones, so the usual preference for offline storage rests on threat reasoning and not on outcome data.
Does a passphrase protect a stolen hardware wallet?
It protects the passphrase-derived wallet, because the passphrase is not stored on the device. Both the author of the 2019 USENIX paper and Kraken Security Labs noted that their extraction methods did not recover it. The cost is that a forgotten passphrase is as final as a lost seed phrase.
Is updating firmware a risk or a protection?
It is both. The 2019 Trezor flaw was fixed by a firmware update, which is the argument for updating. Dark Skippy shows that firmware is also the channel through which a device could be turned against its owner, which is why the origin and authenticity of an update matter.
Is keeping coins with an exchange or a bank safer than self-custody?
It is a different risk, not a smaller one by default. A custodian removes the chance of losing a seed phrase and adds the chance that the custodian fails, freezes withdrawals or is hacked. In the US, the FDIC states that its insurance does not cover crypto assets or the failure of crypto custodians, and in the EU, MiCA's recitals say licensed custodians should be liable for losses from ICT incidents. This article does not recommend either route.
Which sources does this article rely on?
Sources are grouped in the order of the hierarchy used for this article: government and standards documents first, then peer-reviewed research, then trade press, then vendor and self-published material. Every link in the first list was opened during research on 21 September 2026.
Opened during research
- NIST National Vulnerability Database, CVE-2023-31290, Trust Wallet Core entropy flaw, record read through the NVD API
- NIST National Vulnerability Database, CVE-2023-39910, Libbitcoin Explorer Milk Sad issue, record read through the NVD API
- FDIC, Fact Sheet: What the Public Needs to Know About FDIC Deposit Insurance and Crypto Companies, 28 July 2022
- US Federal Trade Commission, What To Know About Cryptocurrency and Scams, consumer guidance dated May 2022
- EUR-Lex, Regulation (EU) 2023/1114 on markets in crypto-assets, recital 83
- NIST IR 8202, Blockchain Technology Overview, Yaga, Mell, Roby and Scarfone, October 2018
- BIP-39, Mnemonic code for generating deterministic keys, primary specification
- BIP-32, Hierarchical Deterministic Wallets, primary specification
- SLIP-39, Shamir's Secret-Sharing for Mnemonic Codes, primary specification published by a wallet vendor
- Ordekian, Atondo-Siu, Hutchings and Vasek, Investigating Wrench Attacks: Physical Attacks Targeting Cryptocurrency Users, AFT 2024, peer-reviewed
- Arapinis, Gkaniatsou, Karakostas and Kiayias, A Formal Treatment of Hardware Wallets, Financial Cryptography 2019, peer-reviewed
- O'Flynn, MIN()imum Failure: EMFI Attacks against USB Stacks, USENIX WOOT 2019, peer-reviewed workshop
- Colin O'Flynn, Glitching Trezor using EMFI Through The Enclosure, author's blog, not a primary publication
- The Record, report on the FBI IC3 2025 annual report, trade press
- ABA Banking Journal, FBI: Cybercrime losses increased 26% in 2025, trade press
- Beinsure, SEC explains crypto custody basics for retail investors, trade press summary of the SEC bulletin
- Kraken Security Labs, Kraken Identifies Critical Flaw in Trezor Hardware Wallets, 31 January 2020, company blog
- Dark Skippy disclosure and its FAQ, self-published by the researchers
- Ledger, message from the chief executive on the July 2020 data breach, 21 December 2020, vendor statement
Referenced but not opened directly
- SEC Office of Investor Education and Assistance, Crypto Asset Custody Basics for Retail Investors, 12 December 2025, page refused automated access and was confirmed through search results and the Beinsure summary
- FBI Internet Crime Complaint Center, 2025 annual report, PDF downloaded but could not be parsed, figures taken from the trade press above
- ANSSI, certificate ANSSI-CSPN-2023/13 for Ledger Nano S Plus firmware SE 1.0.4, details taken from the search index of the official document
- Shamir, How to share a secret, Communications of the ACM, volume 22, issue 11, 1979, bibliographic details confirmed through search results
- Trezor, Our Response to the Read Protection Downgrade Attack, vendor blog, page refused automated access and its passphrase recommendation was seen only in search results
