Start here: I need to back up my wallet now

Beginner Intermediate refresher Next steps

Take a breath. Most backup disasters come from rushing. This page gets you from "I have no idea if my backup is any good" to a sound, tested backup in about an hour — without ever exposing your words to a computer.

Last fact-checked 24 October 2026 (time-sensitive claims re-checked against the linked sources).

How this page is layeredBeginner: follow steps 0 to 6 in order, or spread them over your first week, and keep the "what to do if…" quick answers handy. Intermediate refresher: jump to testing your backup, pros, cons and pitfalls of today's choices and real mistakes to avoid, with the table of mistakes and real cases. Expert / next steps: after today and primary sources.
Before anything elseIf anyone — a "support agent", a website, an app pop-up, a DM, an email, a phone caller — is asking you to enter or read out your recovery phrase right now, stop. That is a theft attempt. Real wallet makers never ask. See Safety & scams.

Step 0: Which situation are you in? Beginner

A. I just bought a hardware wallet

Follow every step below. Generate the seed on the device itself — never use a pre-printed seed card that came in the box (that is a known scam).

B. I have a seed written on paper only

Go to Step 3 to make a durable copy, then Step 5 to test.

C. My seed is in a photo, note app, email, cloud or password manager

Treat that wallet as potentially compromised. Create a new wallet on a hardware device, back that up properly, and move the funds. Then securely delete the digital copies. See below.

D. I hold funds on an exchange

You do not have a seed phrase for those — the exchange holds the keys. Decide whether to move to self-custody; read Custody & services first.

Step 1: Gather your kit (offline) Beginner

  • Your hardware wallet, bought direct from the maker or an authorised reseller (check the maker's list). Check tamper seals and follow the maker's genuineness check.
  • The paper recovery card from the box, and a pencil or archival pen.
  • Optional but recommended: a stainless steel backup (plate or capsule) — see metal backups.
  • A private room. Phones, smart speakers and cameras out of sight. Curtains closed.

Step 2: Create the seed on the device Beginner

  1. Set up the device as a new wallet. Choose a strong PIN (not your bank PIN, not 1234).
  2. Choose backup type: 24-word BIP39 is universal; Trezor offers SLIP-39 single-share (20 words) or multi-share. If unsure, read splitting schemes first, or simply choose a standard single backup.
  3. Write each word carefully, in order, with its number. Print clearly in capitals. Double-check spelling against the screen. In the English BIP39 list, the first four letters identify every word uniquely (a few words have only three letters).
  4. Complete the device's word-confirmation check.
1. WORD2. WORD3. WORD4. WORD5. WORD6. WORD7. WORD8. WORD9. WORD10. WORD11. WORD12. WORD… 24. WORD

Layout illustration only. This site never displays a usable seed phrase.

Step 3: Make it survive a disaster Beginner

  • Paper burns and rots. For anything you would hate to lose, copy the words to stainless steel or titanium. Independent torch, acid and crush tests (Jameson Lopp's reviews) show simple centre-punched or stamped plates generally perform best.
  • Keep the paper copy too, in a different place, sealed in a plastic bag inside an envelope.
  • Store away from the device. A burglar who finds both has everything.

Step 4: Decide whether to add a passphrase Beginner Intermediate

A BIP39 passphrase ("25th word") means a stolen seed alone is useless. But if you forget the passphrase, the money is gone forever. Beginners with modest amounts often skip it; if you use one, back it up separately from the seed, on its own durable medium. See passphrase guide.

Step 5: Test your backup (do not skip) Beginner

  1. Receive a small test amount and note the first receive address.
  2. Reset the device (or use a second device) and restore from your written backup. Many devices also offer a "check backup" / dry-run mode which avoids wiping.
  3. Confirm the same first address appears. If you use a passphrase, confirm the passphrase wallet appears too.
  4. Only then send larger amounts.

Step 6: Tell someone (the right amount) Beginner

Write a short letter of instruction saying that crypto exists, which device and wallet type you use, roughly where the backup lives, and who to contact — but not the words themselves. Lodge it with your will or a trusted person.

Your first week, day by day Beginner

You do not have to do everything in one sitting. Spreading the set-up over a week gives you time to check each step and stops you rushing. This is one sensible order. The steps link back to the detail above.

DayWhat to doWhy it matters
1Order the device from the maker's own shop or a reseller the maker lists. Order a metal backup too, if you want one (Step 1).Second-hand and marketplace devices have been sold with recovery phrases already set up by the seller (see the 2018 eBay Ledger and counterfeit Trezor case files).
2When it arrives, compare the box and contents with the maker's photos and run the maker's genuineness check. Trezor, for example, says a device that arrives with firmware already installed should not be used (Trezor: is my device safe to use?). If a recovery card arrives already filled in, do not use the device, and contact the maker through its website.A device you did not set up yourself may have a recovery phrase someone else knows.
3Install the wallet app from the maker's website only. Set up the device as a new wallet, write the words on the card and finish the device's word check (Step 2).Fake wallet apps in app stores ask for your words (see real mistakes).
4Receive a small test amount, then do a test restore (Step 5). If you bought a metal backup, copy the words onto it and test from the metal copy.Until you have restored once, you do not know whether your backup works.
5Move your first real amount. Copy the receive address from the device's Receive screen and check it on the device. Send a small amount first, and send the rest only once it arrives. Trezor's guidance on moving funds uses the same "test the receive address first" step (Trezor). If you use a UK exchange, it may ask you about the transfer: since 1 September 2023 UK crypto firms have had to collect, verify and share information about transfers under the "Travel Rule" (FCA). In the US, FinCEN's "Funds Travel Rule" (31 CFR 1010.410(f)) applies to transmittals of $3,000 or more, and FinCEN's 2019 guidance says crypto transfers can fall within it (eCFR; FIN-2019-G001). A 2020 proposal to add reporting and record-keeping for transfers involving self-custody ("unhosted") wallets was never finalised and was formally withdrawn on 6 October 2026 (Federal Register). See moving coins off an exchange.Addresses copied from your history can be "poisoned" look-alikes (Ledger; case file).
6Store the copies in separate places, away from the device. Delete any photo, note or cloud copy you made (if your seed was ever digital). Write a short letter of instruction without the words.A burglar who finds the device and the words together has everything. Families have given up on crypto they could not find (see the UK family case).
7Put a yearly restore check in your calendar (annual review). Read the quick answers below and the three scams most likely to reach you: fake support, letters asking for your words and fake apps.Most losses come from scams, not from broken cryptography.
At the end of the week you should have
  • A device you set up yourself, from a source you trust
  • At least two copies of the words, in two places, neither of them digital
  • One successful test restore, and a small test transfer that arrived
  • A letter of instruction that says what exists and where to start, but not the words
  • A date in your calendar for the next check

Pros of a slower first week

  • Time to spot a mistake before real money is involved
  • The test restore happens before you move larger sums

Cons

  • Funds stay on the exchange a few days longer, with the firm risks described on custody & services

Pitfalls

  • Skipping day 4 because the device "obviously works"
  • Rushing day 5 because a message claims there is a problem with your account, a classic phishing tactic (FTC)

Community advice (labelled: experience shared by users, not official guidance)

  • Community advice: Sparrow Wallet's guide suggests starting simple and adding complexity only as holdings grow (Sparrow)
  • Community advice: many people keep the device's paper card as the first copy and add a metal copy once they have tested a restore

What to do if… quick answers Beginner Intermediate

Short first steps for the situations beginners worry about most. Each answer links to the full guidance. If someone is pressing you to act right now, that pressure is itself a warning sign.

…I lost my hardware wallet (or it was stolen)

Your coins are on the blockchain, not in the device. If you still have your backup, restore it on a new or spare device. Trezor advises treating a missing device as a threat and moving funds to a new wallet with a new backup (Trezor). Ledger "strongly" recommends the same, though it says this is not obligatory if your PIN is strong, as its devices reset after three wrong PINs (Ledger). If you used a passphrase, a thief also needs that.

…my written backup is missing, but the wallet still works

Act now, while you still have access. Assume someone may have the words. Create a new wallet with a new backup, test it with a small amount, move everything across, then wipe the old wallet (Trezor). A missing backup cannot be "re-issued": only a new wallet fixes it (Trezor).

…I have lost both the device and the backup

The maker cannot help: Ledger says that without the phrase or a device set up with it, regaining access is impossible (Ledger). Be very wary of anyone offering to recover it for a fee (see fake recovery firms). Check for other copies first, such as a spare device, a safe deposit box or a second written copy.

…I think I have been sent a phishing message

Do not click, reply or type anything. Contact the company through its official website or app, never the details in the message (FTC). UK: forward suspicious emails to [email protected] (NCSC). US: forward emails to [email protected], texts to 7726, and report to ReportFraud.ftc.gov (FTC).

…I typed my words into a website, app or form

Assume they are stolen. Using your hardware wallet, move everything to a wallet with a new recovery phrase straight away, then report it: Report Fraud (England, Wales and Northern Ireland, 0300 123 2040), Police Scotland on 101, or the FBI's IC3 in the US (NCSC, IC3). Full steps: if your seed was exposed and the worked example.

…I forgot my PIN

If you have your backup, the PIN does not matter for your coins: devices wipe themselves after a set number of wrong PINs (three on Ledger devices, ten on the DCENT X), and you restore from the backup (Ledger, DCENT). Without the backup, do not guess at random. Read the maker's guidance first.

…someone close to me has died and held crypto

Do not move anything yet, and do not type any words you find into an app or website. Keep devices, papers and computers together and private, and list what you find. Executors normally need legal authority first: probate in England, Wales and Northern Ireland, confirmation in Scotland, or a US court appointment. Start with GOV.UK: what to do when someone dies or USA.gov: death of a loved one, then the executor worked example and the UK or US estate guide.

…someone contacts me offering to help

Real support never contacts you first about your wallet and never needs your words. Hang up or stop replying, then contact the company yourself through its official site. See fake support, recovery scams and the Coinbase impersonation case.

Pros, cons and pitfalls of today's choices Beginner Intermediate

Paper only vs paper plus metal

Pros

  • Paper is free and fine as a first, temporary copy
  • Metal survives fire and water far better; Jameson Lopp's torch, acid and crush tests found simple stamped or punched plates generally do best (Lopp reviews)

Cons

  • Paper burns and rots
  • Metal costs money and takes care to stamp correctly

Pitfalls

  • Stamping the words wrongly and never checking
  • Storing metal plate and device in the same drawer

Community advice (labelled: experience shared by users, not official guidance)

  • Community advice: stamp or punch the plate, then test-restore from the plate, not the paper

Adding a passphrase today vs later

Pros

  • A stolen seed alone is useless

Cons

  • Forget it and the funds are gone; makers cannot recover it

Pitfalls

  • Adding one in a hurry and not backing it up separately

Community advice (labelled: experience shared by users, not official guidance)

  • Community advice: many people get a simple set-up working and tested first, then add a passphrase once they understand restores

Buying direct vs anywhere cheaper

Pros

  • Buying direct or from a listed reseller reduces tampering risk (Trezor)

Cons

  • Maker prices are not always the cheapest

Pitfalls

  • Second-hand or marketplace devices
  • A device that arrives already set up or with a recovery card filled in

Community advice (labelled: experience shared by users, not official guidance)

  • Community advice: check the seal and contents against the maker's photos before you open it

Real mistakes to avoid Beginner

  • Typing the words into a fake app. In 2023 a fake "Ledger Live Web3" app in the Microsoft Store asked for 24-word phrases and stole at least $768,000; one victim lost $26,500 minutes after typing them in, having gone looking for the app after reinstalling Windows (BleepingComputer). Get wallet software only from the maker's site.
  • Keeping the seed in the cloud. In 2022, attackers phished Apple IDs and pulled MetaMask vaults from iCloud backups (BleepingComputer).
  • Copying an address from history. Address poisoning relies on it; get the address from the Receive screen and check it on the device (Ledger).
  • Trusting someone who offers help. Real support never contacts you first and never needs your words. See fake support and recovery scams.

More beginner mistakes, each with a real case Beginner Intermediate

Every row links to a case file with its original sources. The figures are as those sources report them.

MistakeWhat happened to someoneDo this instead
Buying a cheaper device second-hand or from a marketplaceA buyer used the recovery phrase an eBay seller supplied, and about a week later coins worth over £25,000 by his account were gone (2018). A counterfeit "Model T" from a classifieds site handed out one of 20 pre-generated seeds (2023).Buy from the maker or a listed reseller. Always create a new phrase on the device.
Taking a photo or screenshot "just for now"SparkCat apps on official app stores used text recognition to find recovery phrases in photo galleries; infected Google Play apps had over 242,000 downloads (2025).Never photograph the words. If you already did, treat the wallet as exposed.
Saving the words in a password manager or the cloudResearchers linked wallet thefts to seed phrases kept in stolen LastPass vaults (2022–2025). Attackers pulled MetaMask vaults from iCloud backups (2022).Keep the words offline, on paper or metal.
Trusting a letter or a "replacement" device in the postLetters with Ledger branding asked owners to scan a QR code and enter their 24 words (2025). Tampered Nano X devices were posted to people whose addresses had leaked (2021).Makers do not send unrequested devices or ask for your words. Check through the official website.
Keeping a single copy on one electronic deviceA hard drive said to hold the keys to about 8,000 BTC went to a landfill. The owner's court claim was struck out in 2025 (James Howells).Keep at least two offline copies in separate places.
Adding a passphrase without backing it upWallet-maker forums regularly feature users who cannot reproduce a passphrase, often because of capitals, spaces or keyboard layout (case file).Skip the passphrase at first, or back it up separately on durable media and test it.
Connecting your wallet to a "claim" or "airdrop" siteInferno Drainer phishing kits ran on more than 16,000 domains. Victims only had to approve a transaction, and ScamSniffer estimated at least $80m was stolen (2022–2023).Do not connect your savings wallet to sites reached from adverts, DMs or emails.
Believing a platform is "insured like a bank"The FTC says Voyager told customers their money was FDIC-insured. It was not, and customers were locked out when it failed (2022).Read what protects you in the UK and USA.
Trusting a caller who knows your detailsCriminals bribed support contractors for data on about 69,000 Coinbase users, then phoned them posing as Coinbase (2025).Hang up and contact the firm through its app or website.

If your seed was ever digital Beginner

Assume it is exposedCloud photo libraries, chat apps, email and phone backups are frequently breached or phished. In 2022 attackers stole funds by phishing Apple IDs and pulling MetaMask vaults from iCloud backups (BleepingComputer). Create a fresh wallet on a hardware device, back it up offline, move funds, then delete the digital copies (including "recently deleted" folders and backups).

After today Intermediate Expert

What next?

Follow a learning path

Beginner, intermediate and expert reading orders.

Decision guide

Answer a few questions and get a suggested setup plus shopping list.

Backup checklist

Tick through everything, printable.

Exchange or self-custody?

What protects you in the UK and USA, and how to move coins off an exchange safely.

Primary sources for this page

Educational information only, not financial advice. Checked 24 October 2026.

Last reviewed: · Educational information only — verify current details with official sources.