Chapter 6 of 6 / it already went wrong
I gave somebody a code or a phrase
Stop reading and act, then come back. This is one of the very few things on this site where minutes matter, and it matters because something has already happened rather than because somebody is offering you something.
Do this first
If it was a wallet recovery phrase, move whatever remains to a new wallet now, before anything else, including before looking at the market. If it was a second factor code, assume a session is live on the other side right now.
A code, in the first minutes
- Get in through an address you have checked yourself.
- Change the password to something used nowhere else.
- Reset the second factor entirely and save the new recovery material before closing the page.
- Read the message log, because a live session is being used for something.
- Move anything sitting as a balance out.
A wallet phrase, in the first minutes
- Create a new wallet on a machine you trust.
- Move everything to it now. Not after checking anything else.
- Assume the old wallet is not yours any more, because in every sense that matters it is not.
- Then work out which channel asked, since that is the part that will happen again.
Why nothing legitimate ever asks
| Task | What is actually needed | What is never needed |
|---|---|---|
| Receiving funds | A receiving address | Anything private |
| Sending funds | Access to your own wallet software | Nothing shared with anybody |
| Proving you control an address | A signed message | The key itself |
| Restoring your own wallet | The phrase, typed into your own software | It never leaves your machine |
The last row is the only legitimate use of a recovery phrase, and it happens on your own machine with nothing transmitted anywhere. Any process that involves sending it, pasting it into a page or reading it to somebody sits outside that, in every framing, without exception.
The framings these arrive in
- Migration. The wallet system is changing and yours needs moving.
- Verification. Confirm the wallet is yours before a withdrawal clears.
- Recovery. You reported a problem, and this is presented as the fix.
- Support. Somebody presenting as staff, on a channel that does not exist.
- A form on a page. Sometimes with no human involved, which makes it feel procedural rather than personal.
Every one of them is built to be reasonable, which is why the rule has to be about the category rather than about how the request feels. Assessing reasonableness is exactly the faculty being aimed at.
Why this works on people who know better
Because the request usually arrives after a real problem rather than out of nowhere. Somebody is locked out, or a deposit has not appeared, and they have said so somewhere public. The message that follows is not persuading them that something is wrong. They already believe that, and the message is simply offering the fix they were looking for.
Which is why the rule has to be about the channel rather than about the content. By the time you are reading the words, the part of your judgement that would have caught it is busy with the original problem.