Protecting Your Crypto Assets: Recovering Your Non-Custodial Wallet

Breaking, losing or having your wallet device be stolen can be a particularly nerve-wracking experience, but there are important steps you must take in order to limit any damage.

In our last blog post in our series, we recalled tips to secure your private keys within your wallet as well as your seed phrase. In Part Five of our Protecting Your Crypto Assets series, we examine the steps to take in order to recover and secure your private keys when you lose access to your wallet, whether you lost your hardware wallet or your phone where your software wallet is installed.

This article focuses on non-custodial wallets. Custodial wallets, which are centralized exchanges like Coinbase or Kraken, can be recovered if you forgot your password or if it has been compromised with the platform in charge of your private keys.

While the recovery process for custodial wallets is simpler, owning a custodial wallet involves a trade-off—while it may be easier to use and easier to secure, you have to trust a third party to safeguard your funds, making them vulnerable to situations like the collapse of FTX. 

In Sum

• If your wallet is lost, stolen or compromised, recover your wallet using your seed phrase, monitor your wallet address and transfer any remaining funds to a new wallet to prevent potential theft.
• Your seed phrase is the principal way to recover a non-custodial wallet. If lost or exposed, your funds are at serious risk—store it securely and keep it offline.
• Only recover wallets on trusted, secure devices. Consider keeping a backup hardware wallet and revoke unneeded smart contract approvals to limit attack surfaces.
• Alert local authorities, your wallet provider and any exchange involved. Record all transaction details to support future investigations, though it is almost impossible to recover lost cryptocurrency. Even after the incident, stay wary of recovery scams.

Lost or Stolen Hardware Wallet

Physical hardware wallets are protected by a PIN, and often, they are programmed to wipe their contents clean after a certain number of failed attempts at guessing the password protecting them.

Despite this security measure, PINs are not infallible. If you have lost access to your hardware wallet—whether you misplaced it or whether someone stole it from you—, it is best to act immediately and not count on your PIN to secure the access to your private keys. Anyone who breaks into your wallet will be able to sign transactions on your behalf.

Confirm You Still Have Your Seed Phrase

Your seed phrase, a string of randomly generated 12 or 24 words, was given to you upon initializing your wallet. It serves as a master key to recover your wallet and all of its contents. While in theory, it is used to recover a wallet if your access to it is interrupted, anyone who discovers your seed phrase is able to use it in order to divert your funds. This is why it is primordial for your seed phrase to be kept secure—offline, protected from potential threats, yet easily accessible when needed.

If you do not have access to your seed phrase nor to your wallet, there is no way to recover your wallet nor the funds associated with its address on the blockchain, unless you have set up a backup like Ledger Recover, which enables you to recover access using your identity. 

Promptly Obtain A Replacement Wallet

If your seed phrase has been compromised, or if your wallet device has been stolen or misplaced, it is important you acquire a replacement wallet as quickly as possible from a reliable source such as the wallet provider itself. To save valuable time in such situations, it is a good idea to already have a backup hardware wallet on hand. If someone has access to your seed phrase, there is no time to lose in setting up a new wallet.

Though hardware wallets generally present a safer option than software wallets with Internet connectivity, if you are unable to quickly obtain a second hardware wallet, it might be a good idea to set up a temporary software wallet to transfer the contents of your lost wallet to and keep your funds from being diverted.

Monitor Your Lost Wallet Address

Using blockchain explorers like Etherscan or Blockchain, monitor your wallet address in order to track your funds. These ledgers are updated in real time and you will be able to follow any movement. If your cryptoassets are still on the ledger at the address of your wallet, or if there are still funds there, do not wait any further to recover your wallet access using your seed phrase.

Recover the Private Keys in Your Lost Wallet and Transfer Your Funds to a New Wallet

Using your seed phrase and following the procedure set out by your hardware wallet provider, recover your access and initiate a new transaction sending what remains on your recovered wallet to your new hardware wallet—or your temporary software wallet.

Even if there is no evidence on the blockchain explorer that someone gained unauthorized access to your wallet, if your wallet was either stolen or lost, there is no way to guarantee that someone won’t one day find it and gain access to it. It is important to transfer your funds out in order to ensure maximum security.

Do Not Reuse the Same PIN

When initializing your new wallet, choose a secure PIN. It should not be the same PIN as what you have used previously. If someone found your old wallet and used the right tools to discover your PIN—so as to not take any chances, this should always be assumed when you lose access to your wallet—, your new wallet would be vulnerable if another such event were to occur.

Alert Relevant Authorities

Though they may not have the power to recover your hardware wallet nor any stolen cryptocurrency, alerting relevant authorities could prove helpful. Like any valuable item, reporting the theft to your local police will allow them to start an official record on your case.

Alerting the Canadian Anti-Fraud Center’s cybercrime centre may also help them link a number of crimes together as they investigate a number of cases across the country, which might ultimately contribute to preventing fraud.

Similarly, while your wallet provider does not have your private keys in their custody and as such are unable to recover your funds or freeze your wallet, reporting the incident may prove to be otherwise useful.

If you were able to trace your cryptocurrency and see that they are moving to a known exchange wallet address, you can contact that exchange’s team and provide them with all transaction hashes and addresses involved. While it is not a guarantee, there is a chance that the exchange may cooperate by freezing or blacklisting a wallet as was the case during the Bybit heist.

If Relevant, Revoke Smart Contracts Access and Authorization

If your lost or stolen hardware wallet was part of a multisignature configuration, do not forget to revoke its ability to co-sign transactions.

Malfunctioning Hardware Wallet

Alternatively, if your hardware wallet is malfunctioning, or if you have lost your seed phrase but continue to have access to your wallet, it is best to obtain a new wallet and send its contents to a new crypto wallet.

In either case, as the hardware wallet still contains private keys, it is important that you dispose of your old wallet appropriately. This is the case even if you have transferred any owned cryptocurrency to a new address.

You may dispose of your wallet after factory resetting it according to the guide provided by your wallet provider, or you may destroy it so it is no longer usable by anyone who may come across it when you have disposed of it.

Lost or Stolen Hot Software Wallet

If you lose the phone or the laptop where your software wallet is installed, it is also best to act immediately—even if your device is protected by a PIN.

Secure Your Device Remotely

Use the Find My feature in order to remotely lock and locate your device. This way, you may get the opportunity to recover your device, or at the very least slow down the thief.

Even if you do find your device, it is worth considering transferring its wallet’s contents to a new wallet, since there is no way to know whether or not someone has tampered with it during the time you did not have access to it. Use your own judgment to determine the right course of action.

Confirm You Still Have Your Seed Phrase 

If your device is unrecoverable, it is best to proceed to setting up a new wallet. Ensure you still have your seed phrase. Although a software wallet is connected to an account you possess with your wallet provider, logging in using your credentials won’t be enough to recover your wallet on a second device. This is because the private keys within your non-custodial wallet are stored locally on your device rather than on any of their servers. 

Monitor Your Lost Wallet Address and When Relevant Revoke Smart Contracts Access and Approval

If you have a smart contract wallet, revoking the approvals your lost wallet had granted on DeFi platforms is important. Smart contract approvals remain even if your wallet app is gone—this could allow the thief to move tokens from your old wallet without your signature if you had allowed a DeFi app or token swap contract to spend your tokens.

Recover the Private Keys in Your Lost Device and Transfer Your Funds to a New Wallet

Using your seed phrase, recover wallet access on a second secure device, set up a new wallet and send all funds to this new wallet as soon as possible. Download the software directly from your wallet provider, and make sure it is from their official website—fake scam sites may pose as a known provider in order to fraudulently obtain your seed phrase, with subtle differences between the two. Entering your seed phrase into such a site could compromise it even further.

Do Not Reuse the Same Password

In the same way it is wise to change your active wallet—and therefore seed phrase—if it has been compromised, changing your account credentials would be a good idea. Do not use the same password that you used previously. Instead, compose a strong, new password.

Alert Relevant Authorities

Document everything, including dates, amounts, and if the thief takes over your account and diverts your funds, transaction hashes and wallet addresses using relevant blockchain explorers. File a police report about the theft in order to have a case in the event another incident arises from it.

Just as for a lost or stolen hardware wallet, you may take other steps like alerting Canadian Anti-Fraud Center’s cybercrime centre, your wallet provider and any centralized exchange where you trace your funds.

To Keep In Mind

Do Not Take Chances on a Compromised Wallet

In any case, it is best not to take any chances by using a compromised wallet. A thief or a hacker with access to your seed phrase and the contents of your wallet may not act now—creating a false sense of security—, planning to strike later, after you have added funds to your wallet.

Be Aware of Recovery Phishing

Once the situation is under control, it is still important you remain wary. Fraudulent actors may attempt to contact you under false pretenses—for example, if someone emptied your wallet, that same person may come to you pretending to be able to recover your funds for you. This is nearly always impossible, as transactions on the blockchain are irreversible, and as there is no centralized authority governing the crypto network.

This is an increasingly common tactic, preying on the despair of those who have already lost significant sums.

Plan for Backups and Emergencies

Like many things in life, when it comes to cryptocurrency, it is always better to be safe than sorry. Planning ahead for emergencies, by purchasing a second hardware wallet to use as a backup for example, may provide you with some peace of mind when urgent situations arise.

To learn more about ways you can secure your seed phrase and your wallet, read the previous article in our series Protecting Your Crypto Assets—Taking Your Security Into Your Own Hands.

‍

‍

Frequently Asked Questions

What should I do if I lose both my wallet and my seed phrase?

Unfortunately, without your seed phrase or a backup service like Ledger Recover, there is no way to regain access to your non-custodial wallet or the funds associated with it.

Can I recover my software wallet using just my account login?

No. For non-custodial wallets, your login credentials are not enough—recovery always requires the seed phrase, which is never stored by the wallet provider.

What if someone finds my seed phrase but hasn’t moved my funds yet?

Act immediately. Set up a new wallet and transfer all funds out. Just because the attacker hasn’t moved them yet doesn’t mean they won’t, and waiting increases risk.