{"success":true,"data":{"id":"crypto-wallet-seed-phrase-phish","label":"Fake wallet security notice claiming the target's seed phrase or recovery phrase has been compromised and requiring them to enter their 12-word or 24-word phrase to migrate to secure storage — no legitimate wallet vendor ever requests a seed phrase via email; entering a seed phrase anywhere other than the physical device results in complete wallet drain.","description":"Fake wallet security notice (impersonating MetaMask, Trust Wallet, Phantom, Coinbase Wallet, Ledger, or generic \"wallet provider\") claiming the target's seed phrase or recovery phrase has been compromised and requiring them to enter their 12-word or 24-word seed phrase to migrate their funds to secure storage — a SACRED-class signal; no legitimate wallet vendor ever requests a seed phrase via email, web form, or any channel other than the physical device during initial setup. Entering a seed phrase anywhere other than the physical hardware device or the original wallet app during first setup gives the attacker complete irrevocable control over the wallet and all its assets. This is the direct seed-phrase-harvest variant of wallet phishing, as opposed to the firmware-update pretext (hw-wallet-firmware-update-spoof-lure) or the hardware-wallet-specific modality (hw-wallet-seed-phrase-reveal-phish) — this targets the general software-wallet / seed-phrase-compromised / migrate-to-secure-storage pretext. Detection: seed phrase/recovery phrase compromised/exposed/stolen + enter 12-word/24-word phrase to migrate to secure storage vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +5. Source: GC1-R27; Chainalysis wallet drainer report 2024; MetaMask anti-phishing guidance; FBI IC3 crypto seed phrase harvest advisory.","tier":"danger","category":"phishing","isThin":false}}