A BIP-39 seed phrase is a human-readable wallet backup, usually 12, 18, or 24 words, that encodes the entropy needed to recreate a cryptocurrency wallet. In the BIP-39 standard, the words are not the funds themselves; they are the master recovery secret used to derive the wallet’s private keys and addresses. Anyone who learns the phrase can usually restore the wallet on another device and spend its assets.
This makes seed phrases a prime target in cyber attacks. Criminals steal them through phishing pages, fake wallet recovery prompts, malicious browser overlays, infostealer malware, and social engineering that tricks users into entering words online. Defenders should treat the phrase as an offline-only secret: write it down securely, never type it into a website or chat, and keep it away from screenshots, cloud notes, and synced backups. Hardware wallets and careful backup procedures reduce the risk of remote theft.