In 2013, a UK-based IT worker named James Howells threw away a hard drive during an office cleanup. He didn’t think much of it at the time.
In 2013, a Welsh computer engineer threw away a hard drive in a landfill. However, there was a private key to 8,000 #BTC on the hard drive, worth more than $750 million today.
The engineer sued the Newport City Council to gain access to the landfill – even offering to pay the… pic.twitter.com/tcQethnYBL
— UseTheBitcoin 🚀🌕 (@usethebitcoin) January 15, 2025
That hard drive held the private keys to a Bitcoin wallet holding around 8,000 BTC, and once it went into a landfill, the coins went with it. Howells has spent years seeking permission to excavate the site and recover the drive.
As of this writing, he still hasn’t gotten it back, and the coins remain exactly where he threw them the day he threw them out.
His story is often told because it’s dramatic, but the actual lesson is smaller and more useful than “don’t throw away your hard drive.”
The real problem was that Howells had no separate, secure backup of the one thing that could have restored his wallet on any other device.
That backup has a name. It’s called a seed phrase, and understanding what it is and how to protect it is the difference between a lost laptop being an inconvenience or a permanent, unrecoverable loss.
What a Seed Phrase Is
A seed phrase is a set of words, usually 12 or 24, generated the moment you create a crypto wallet.
It’s closely tied to that wallet’s private keys, produced through a standard cryptographic process that turns otherwise unreadable security data into a sequence of ordinary words you can write down.
That’s the whole point of it. Private keys are long strings of characters that nobody could reliably copy by hand, so wallets translate them into a phrase a person can record and use to restore access later.
The seed phrase can regenerate every private key connected to your wallet, which is why it’s often described as the root of wallet access rather than just another credential.
It isn’t stored on the blockchain, and it isn’t tied to any single app or device. Enter the same phrase correctly into a compatible wallet anywhere, and you get the same wallet back. That portability is what makes it powerful, and it’s also exactly why anyone who gets hold of your phrase gets your wallet too.
How This Is Different From a Password
It’s tempting to treat a seed phrase like a password with extra steps, but the two work in completely different ways. A password authenticates you to a single account, and if you forget it, a company somewhere can usually verify your identity and reset it for you.
A seed phrase has no such safety net. There’s no customer support line for a crypto wallet, no email verification, no “forgot your phrase” link. Lose it, and the wallet is gone the way Howells’ coins are gone.
A seed phrase also isn’t just a login. It generates and controls every address and private key tied to your wallet, which means it determines actual ownership, not just access.
You can’t change it or update it the way you would update a password after a breach. Whoever holds the phrase holds the wallet, full stop, which is exactly why it deserves a different level of caution than anything else in your digital life.
Why This Matters Beyond Just Recovery
The recovery function gets the most attention, and for good reason. If your phone breaks, your laptop dies, or your wallet app disappears entirely, your seed phrase lets you rebuild the exact same wallet somewhere else. Without it, a damaged or lost device doesn’t just cost you a device. It costs you everything the device could access.
But a seed phrase does more than let you recover a wallet after disaster. Most seed phrases follow BIP39, a standard recognized by most wallets and platforms. That means you’re not locked into whichever app you happened to start with.
You can move to a different wallet provider entirely and restore the same funds, as long as the new one supports the same standard. And because the phrase is generated through a highly randomized process, it’s effectively impossible for someone to guess or recreate, which is exactly why protecting the one copy that exists matters so much more than trying to make it harder to guess.
Keeping Your Seed Phrase Safe
Since there’s no recovery system standing behind you, how you store your seed phrase is the actual security layer, not a backup to some other layer. A few practices matter more than the rest.
Keep it completely offline. Never type your seed phrase into an internet-connected device, take a screenshot of it, email it to yourself, or save it in a notes app or cloud backup. Any of those creates a copy that someone could potentially reach remotely, which defeats the purpose of having a phrase that isn’t stored on the blockchain in the first place.
Write it down on paper or something more durable, like metal, and store it somewhere with limited access, like a locked safe. If you want redundancy, keep a second copy in a separate physical location so that a fire, theft, or accident at one location doesn’t wipe out your only backup.
Mistakes That Undo All of This
Most seed phrase losses don’t come from some sophisticated hack. They come from ordinary habits that feel harmless in the moment. Someone photographs their seed phrase “just to have a backup on their phone,” not realizing that photo now lives in a cloud backup they don’t control. Someone else types their phrase into a password manager, treating it like any other login, without stopping to consider that a password manager is still software running on an internet-connected device.
A different, quieter mistake is telling someone else your seed phrase, even someone you trust completely, without a clear plan for why. A support agent will never legitimately need it. No wallet company, exchange, or app will ever ask for it over chat, email, or phone.
Anyone asking for your seed phrase directly is, without exception, trying to take your funds, regardless of how official they sound or how urgent the request seems.
Why Randomness Is the Whole Game for Seed Phrases
Here’s a brute-force resistance chart showing how long a hacker would need to crack a password on a simple principle.
Every extra character multiplies the number of possible combinations, and once that number gets large enough, guessing every combination becomes computationally meaningless even for powerful hardware, stretching into thousands or trillions of years.
The flip side matters just as much. A password pulled straight from a dictionary gets cracked instantly regardless of its length, since there are only a limited number of real words to try rather than every possible combination of characters.
Seed phrases work on the same underlying principle, with one important difference. Every word in a standard seed phrase comes from a fixed, public list of 2,048 words. That’s expected and correct.
The security doesn’t come from the words being obscure, since anyone can look up the full list in minutes. It comes from which specific words get randomly selected out of that list, and how many words make up the phrase.
A properly generated 12-word phrase draws from a combination space large enough that guessing your specific sequence is no more realistic than guessing a long, fully random password. That security depends entirely on the device generating true randomness when it creates your phrase in the first place.
In late July 2026, a firmware flaw in a popular hardware wallet, Coldcard, showed what happens when that assumption breaks. A series of integration errors introduced in a 2021 firmware update caused the device’s software to fall back on a predictable method for generating randomness instead of using its intended hardware-based process.
The result was a collapsed combination space. Instead of drawing from an effectively uncountable number of possible seed phrases, affected devices were only pulling from a pool small enough that attackers could reproduce the same phrases through offline computation, without ever touching the physical device.
Attackers went on to drain more than 1,300 BTC from wallets created on the affected firmware, exactly the outcome a full-strength combination space is supposed to make infeasible.
The lesson isn’t that seed phrases are unsafe. It’s that their safety depends on a step you can’t personally verify just by looking at your recovery words, whether the device that generated them used real randomness in the first place.
If you use a hardware wallet, keep its firmware updated, and if a manufacturer discloses a randomness flaw like this one, treat the guidance to migrate to a freshly generated seed as urgent rather than optional, since updating the firmware alone fixes future seed generation but does nothing to protect a phrase that’s already compromised.
Why This Is the Whole Point of Self-Custody
Owning crypto directly, rather than leaving it with an exchange, is usually described as self-custody. The seed phrase is what makes that possible. It’s the root key that can rebuild your wallet at any time, on any compatible device, which is precisely why there’s no institution standing behind it the way a bank stands behind your checking account.
That trade-off is the whole deal. Traditional finance can reset your access because a bank controls the account behind the scenes. Crypto removes that middle layer entirely, giving you real ownership and making you the only line of defense if something goes wrong.
A seed phrase is what makes direct ownership work in practice, and how carefully you protect it is, in the end, what your crypto security comes down to. You can find more on protecting your funds in our wallets guide.
Be the first to comment