What is a seed phrase? The BIP-39 standard, and how 30 wallets handle recovery
What is a seed phrase?
A seed phrase is a list of 12 to 24 words, defined by the BIP-39 standard, from which a wallet derives every key it holds. Anyone with the words controls the funds. Of 30 wallets on the register, 11 offer a cloud backup and 3 split recovery with the provider.
Piece published Reviewed by CryptoGuardz Register Desk, editorial desk
A seed phrase is a list of 12, 15, 18, 21 or 24 words, set out in the BIP-39 standard, from which a wallet derives every private key it holds. Whoever has the words has the funds, on any device, without a password. Of the 30 wallets on this register, 11 offer some form of cloud backup and 3 split recovery with the provider, which changes who can move the money.
The standard was read on 9 October 2026. The wallet figures come from each wallet's own terms and help pages, as recorded on the wallet register between 22 September and 7 October 2026. Nothing here is financial advice.
What is a seed phrase, by the BIP-39 text?
A human-readable encoding of random data. The BIP-39 abstract describes it as "a mnemonic code or mnemonic sentence -- a group of easy to remember words -- for the generation of deterministic wallets." Deterministic is the word that matters: the same words always produce the same keys, so the words are the wallet, and the app is only a window onto it.
The standard is a Bitcoin Improvement Proposal, assigned on 10 September 2013 and marked "Deployed". It is used well beyond Bitcoin. The other names a player meets, recovery phrase, Secret Recovery Phrase, mnemonic, backup phrase, are the same thing under a wallet's own label.
How many words is a seed phrase?
Twelve to 24, in steps of three. BIP-39 states that "The allowed size of ENT is 128-256 bits", where ENT is the initial random entropy. A checksum is added and the result is cut into word-sized pieces:
| Entropy (bits) | Checksum (bits) | Total (bits) | Words |
|---|---|---|---|
| 128 | 4 | 132 | 12 |
| 160 | 5 | 165 | 15 |
| 192 | 6 | 198 | 18 |
| 224 | 7 | 231 | 21 |
| 256 | 8 | 264 | 24 |
Each word stands for 11 bits. The standard splits the data "into groups of 11 bits, each encoding a number from 0-2047, serving as an index into a wordlist." So the list has 2,048 words, and the last word carries part of the checksum. That checksum is why a wallet can reject a mistyped phrase instead of opening an empty wallet.
How do the words become keys?
Through a slow, fixed hash. BIP-39 says: "To create a binary seed from the mnemonic, we use the PBKDF2 function", and "The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes)." The salt is "the string "mnemonic" + passphrase".
That passphrase is optional, and it is the part most people never set. Add one and the same 12 words produce a different 512-bit seed, so a different wallet. The standard notes this "also provides plausible deniability, because every passphrase" yields a valid wallet. The cost is that a forgotten passphrase is as final as a lost phrase: nothing in the standard recovers it.
Where should a seed phrase be kept?
Offline, in the user's own hands. The wallets' own documents agree on that much. Phantom's help centre: "Store it offline only." MetaMask's terms, as recorded on the register, go further and put the risk in writing:
You acknowledge that certain methods of securing your secret recovery phrase, such as storing it as a digital file anywhere, including on your personal device or on a cloud storage provider, increase the risk that your account or secret recovery phrase will be compromised.
The same clause says MetaMask takes "no responsibility whatsoever" for a phrase stolen from a device or a cloud provider. Eleven of the 30 wallets on the register now offer a cloud option anyway.
How do the 30 wallets on the register handle recovery?
Three ways, from the recovery fields of the 30 records:
| Recovery model | Wallets | Count |
|---|---|---|
| Phrase kept by the user only, no provider backup | Arculus, Atomic, Backpack, Blockstream Jade, Coldcard, D'CENT, Exodus, Keystone, Ledger Live, MetaMask, OKX Wallet, Rabby, SafePal, Sparrow, Tangem, Tonkeeper, Trezor, Wasabi | 18 |
| Cloud backup in the user's own iCloud or Google account, custody unchanged | Bitget Wallet, Coinbase Wallet, Robinhood Wallet, Solflare, Trust Wallet, Uniswap Wallet, Xverse, Zerion | 8 |
| Recovery or signing split with the provider | Keplr, Phantom, Zengo | 3 |
| Provider holds the keys | Wallet in Telegram | 1 |
The 11 wallets offering a cloud backup are the 8 in the second row plus the 3 in the third. OKX Wallet's terms, as read, do not describe recovery at all, and Rabby's describe only local storage; both sit in the first row on that basis, not on a statement that no backup exists.
What goes into the cloud differs. Trust Wallet, Uniswap Wallet, Zerion and Xverse describe an encrypted copy of the phrase, protected by a password the user sets. Robinhood Wallet's support page says "You can back them up manually via your secret recovery phrase or through iCloud/Google Drive", and the pages read do not say whether that copy is encrypted: not verified.
Which wallets hold a key share?
Three, plus one MPC wallet whose shares are split in an unusual way.
Zengo's agreement states that "our servers hold a key share ("Server Share") to sign transactions", with the other share on the phone, and that "Only when both Shares interact, a Transaction can take place." Its recovery file sits in the user's iCloud or Google Drive. There is no seed phrase to write down at all.
Phantom, for wallets created with a Google or Apple login, encrypts the recovery phrase and splits the key:
One part is held by Phantom. The other part is stored across the decentralized Juicebox network.
Keplr's help centre says its social login uses Web3Auth, which "securely generates a private key using DKG technology", and the register records Keplr's terms describing Keplr and Keyshare Nodes cooperating on signatures.
Bitget Wallet's MPC mode splits the key three ways: one share "bound to the user's centralized email account", one on the phone, and "The final key share will be backed up using your iCloud or Google Drive." The register records custody as unchanged for Bitget, because the provider is not named as holding a share, but the terms do not name who controls the email-bound one.
At the far end, Wallet in Telegram holds the private keys itself. Its agreement asks the user to secure "your Telegram account to prevent unauthorised use", which is a password model, not a seed phrase model. Ledger Live sits at the other end: "Unless you subscribe to a third-party recovery service, no one is in a position to help you retrieve wallet access."
All 30 wallets, sorted by what their own documents say about custody and blocking, are on the 30-wallet sorting page. The hot and cold split is on cold vs hot wallets.
The support scam: who asks for a seed phrase?
Thieves, and nobody else. Both large wallets say it in one line. MetaMask: "We will never ask you to provide your SRP." Phantom: "Phantom Support will never ask for your recovery phrase." MetaMask also lists the only two legitimate moments to type the phrase, creating the wallet and restoring it on a new device or after a reset, and warns: "There are, however, scammers that try to simulate these two situations."
The pattern repeats across the cases the FBI publishes. A June 2025 public service announcement on fake airdrops describes a malicious site where "this connection often requires the user to input their login and security information, including seed phrases", and advises: "Do not respond to requests to provide personally identifying information, like passwords, seed phrases".
Applied to a casino deposit, the pattern the two wallets warn about looks like this. A deposit is stuck. A "support agent" replies by DM before the real one does. A link asks the player to "validate" or "sync" the wallet by entering the phrase. Within minutes the wallet is empty. Nothing in that sequence needs the casino or the wallet company to be involved, and neither can reverse it: Phantom's help centre says "Phantom cannot access, freeze, or recover your funds."
Can a stolen seed phrase be recovered from?
Not by the wallet. Once the phrase is out, the only move is to create a new wallet with a new phrase and move whatever is left, before the thief does. Then comes the second wave. The FBI's July 2026 announcement describes "manipulative schemes where scammers target individuals who have already been defrauded", posing as law enforcement, banks or cybersecurity firms that "promise to recover the victim's lost money". Its tip is short: "IC3 will never ask for payment to recover lost funds." The legitimate routes, and the warnings from the FBI, FTC, CFTC and FCA about the paid ones, are on the crypto scam recovery page.
What this does not show
Whether any wallet's cloud backup has been breached: no incident is recorded against the backup feature itself. How Robinhood Wallet's cloud copy is protected. Who holds the email-bound Bitget share. How OKX Wallet handles recovery. Each is not verified. No wallet was set up and restored by this desk; the table records what each wallet's documents say.
Quick answers
What is a seed phrase?
A list of 12 to 24 words, defined by BIP-39, from which a wallet derives all its keys. Each word encodes 11 bits from a 2,048-word list. Anyone with the words controls the funds. See the wallet register.
Is a 12-word or 24-word seed phrase safer?
BIP-39 allows 128 to 256 bits of entropy, which is 12 to 24 words. Both are beyond guessing; the risk is the phrase being copied, not cracked. Self-custody checklist.
Which wallets back up the seed phrase to the cloud?
Eleven of 30 on the register offer a cloud backup, and 3 of those, Keplr, Phantom and Zengo, split recovery with the provider. Each wallet entry quotes the source.
Will wallet support ever ask for my seed phrase?
No. MetaMask: "We will never ask you to provide your SRP." Phantom says the same. Anyone asking is attempting theft, and paid "recovery" offers are covered on the scam recovery page.
If gambling has stopped being a choice, the responsible gambling page lists the helplines and self-exclusion schemes by market. Outside those markets, Gambling Therapy offers free support at gamblingtherapy.org.
Sources
- BIP-39, Mnemonic code for generating deterministic keys, status Deployed, retrieved 2026-10-09
- MetaMask help centre, basic safety and security tips, retrieved 2026-10-09
- Phantom help centre, I was phished, scammed or hacked, retrieved 2026-10-09
- FBI public service announcement I-060325-PSA, 3 June 2025, retrieved 2026-10-09
- FBI public service announcement I-072026-PSA, FBI Warns of Scammers Impersonating the IC3, 20 July 2026, retrieved 2026-10-09
- MetaMask terms of use, as recorded on the wallet register 2026-09-22
- Phantom help centre, create a wallet with Google or Apple, as recorded on the wallet register 2026-09-22
- Bitget Wallet terms, as recorded on the wallet register 2026-09-28
- Zengo recovery kit help article, as recorded on the wallet register 2026-10-07
- Zengo user agreement, as recorded on the wallet register 2026-10-07
- Keplr help centre, privacy and security, as recorded on the wallet register 2026-10-07
- Trust Wallet, is Trust Wallet safe, as recorded on the wallet register 2026-09-22
- Robinhood Wallet FAQs, as recorded on the wallet register 2026-10-07
- Ledger Live terms of use, as recorded on the wallet register 2026-09-28
- Wallet in Telegram user agreement, as recorded on the wallet register 2026-09-28
- CryptoGuardz wallet register, recovery fields for 30 wallets
- CryptoGuardz crypto scam recovery page
- CryptoGuardz safer gambling file
About this piece
Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.