Rabby Wallet Seed Phrase Compromised? What to Do Immediately and How to Migrate Without Losing Assets

A user discovers that their Rabby Wallet recovery phrase may have been exposed—perhaps through a phishing email, a malicious browser extension, a screenshot left on a shared device, or a cloud backup that was not properly secured. The immediate reaction is often panic followed by paralysis. The practical question is not whether the wallet is now worthless, but what needs to happen in the next hour, the next day, and over the following weeks to preserve assets and establish a secure recovery. Speed matters, but so does accuracy. A rushed migration to a new wallet can result in forgotten assets, failed transactions, or funds sent to the wrong address.

Rabby’s architecture as a self-custodial, open-source wallet means that whoever controls the recovery phrase controls the private keys, and whoever controls the private keys can move any asset stored in that wallet. A compromised seed phrase is therefore a critical threat that requires immediate action. This is not a situation where “changing your password” is sufficient, because the recovery phrase is not a password. It is the cryptographic root of all private keys derived from it, across all EVM-compatible blockchains that Rabby supports. The response must treat the exposed wallet as already compromised and shift all assets to a new, properly secured wallet before a malicious actor does.

Assess the scope and timeline of the exposure

Before taking action, clarify exactly what may have been compromised and when. A recovery phrase consisting of 12 or 24 words is the complete key to the wallet. If those words—in the correct order—fell into an attacker’s hands, that attacker can import the wallet into any application and access all funds. A MetaMask wallet imported into Rabby is just as vulnerable if the seed phrase was exposed, regardless of which interface is used. The point at which the compromise occurred matters because it determines which assets are at risk and how urgently they must be moved.

Did the exposure happen yesterday, a month ago, or an hour ago? If funds have already been moved or drained without your action, you have a different situation than if the phrase was compromised but the wallet is still intact. Check the wallet’s activity by connecting to a blockchain explorer such as Etherscan for the Ethereum mainnet or respective explorers for other EVM chains supported by Rabby. View the address history, recent transactions, and current balance. Do not assume that a wallet appears empty if you can only see one or two chains; Rabby supports multiple EVM networks, and funds may be distributed across chains such as Polygon, Arbitrum, Optimism, Base, BNB Chain, and others. If you used Rabby’s hardware wallet compatibility feature, the exposure may be limited to the browser extension and not affect hardware-backed keys, but you should verify this assumption rather than rely on it.

The timeline also affects prioritization. If the compromise happened within the last few hours and no unusual activity has occurred, moving assets can be urgent but not necessarily panicked. If the exposure happened weeks ago and the wallet is still intact, an attacker may have multiple wallets under observation waiting for larger deposits. If unusual activity has already started, the attacker is actively monitoring, and funds must be moved before the next window of activity. A wallet showing recent suspicious outbound transactions is a sign of active compromise, not a reason to delay further action.

Create a new Rabby Wallet with a secure recovery phrase

The first step is to establish a new, genuinely secure wallet before moving any funds. Download Rabby from the official source at sites.google.com/rabby-wallet-extension.com/rabby-extension-download/ if you are installing on a new device or in a separate browser profile. Do not reuse the same browser profile or installation that may have been compromised by malware or phishing. Installing on a separate device, using a virtual machine, or creating a new browser profile reduces the risk that any malware present during the original compromise will be present during the migration process.

When creating a new wallet, Rabby will generate a new recovery phrase. This phrase must be written down by hand on paper and stored in a physical location that is both secure and inaccessible to casual observers. Do not photograph the phrase, email it, save it to cloud storage, or use any digital backup that might be intercepted or inadvertently shared. The phrase should be stored away from the device used for the migration. If you lose access to the new wallet later, this phrase is the only way to recover the funds; if an attacker finds the phrase, the new wallet is immediately compromised. The trade-off between security and convenience is real: the most secure approach is also the most inconvenient if you need to recover quickly.

Once you have written down the new recovery phrase, create the wallet in Rabby, and verify that you can view the receiving addresses. For Ethereum mainnet and each other EVM chain you plan to use, note the receiving addresses. These are the destinations to which you will send funds from the compromised wallet. Each address should be unique per wallet, but Rabby also supports the Ledger hardware wallet integration if you want to add a hardware-backed layer to the new wallet, which is an optional but highly recommended step for larger balances. The new wallet should not yet contain any funds; it is simply a secure destination waiting to receive them from the compromised wallet.

Identify all assets and their locations across chains

Rabby’s support for multiple EVM chains means that your funds may be distributed across Ethereum mainnet, Polygon, Arbitrum, Optimism, Base, BNB Chain, and others. Use Rabby’s network selection feature to cycle through each supported chain and check the balance on that network. Write down the assets, quantities, and network for each holding. Include not only fungible tokens (like USDC or USDT) but also NFTs if you have any. A common mistake during emergency migrations is to forget about assets on less-frequently-used chains, then later discover that funds were left behind in the compromised wallet.

For each asset, clarify whether it is held directly as a token balance or locked in a smart contract through a liquidity position, staking arrangement, or collateral deposit in a lending protocol. A balance shown in Rabby as “USDC: 1000” is straightforward; a balance shown as “LP tokens in Uniswap” or “Aave lending position” requires additional steps to unwind. Some assets cannot be moved with a simple token transfer. If you have provided liquidity on Uniswap, Curve, or another DEX, you will need to withdraw from that position first, which generates one transaction to claim the LP tokens and another to swap them back to underlying assets. If you have collateral deposited in Aave, Compound, or another lending protocol, you will need to either repay any borrowed funds or reduce the collateral position carefully to avoid liquidation.

Create a detailed list with columns for asset name, quantity, network, and current location (direct balance, liquidity pool, lending protocol, etc.). This list is your migration checklist. As you move each asset to the new wallet, mark it off. The goal is to end with a list showing zero balances on the compromised wallet and matching balances on the new wallet for each asset. This is also when you should verify that you actually intend to keep some of these assets. A compromised wallet situation is an opportunity to reassess holdings and consider selling tokens you no longer want to keep, using the migration as a natural checkpoint.

Drain token balances to the new wallet across each chain

Begin moving direct token balances (not positions in smart contracts) from the compromised wallet to the new one. Use Rabby’s transaction preview and risk alert features to verify each transaction before signing. The process is: (1) select the asset, (2) enter the receiving address from the new wallet on the same network, (3) input the full balance or the maximum amount available, (4) review the transaction preview to confirm the destination and amount, (5) check for any risk alerts that Rabby may flag, and (6) sign and broadcast the transaction.

Start with one transaction on the network with the largest or most accessible balance, so that if a mistake occurs, it is limited in scope. Confirm that the transaction is included in a block on a blockchain explorer, then verify that the funds appear in the new wallet. Once this first transaction succeeds, repeat the process for each remaining token balance. Do this methodically rather than in parallel; sending multiple transactions simultaneously increases the risk of mistakes and makes it harder to track what has been moved.

For stablecoins and wrapped tokens (like WETH or WBTC), the process is identical. For tokens on multiple chains, remember to switch networks in Rabby before entering the receiving address; an Ethereum mainnet address will not receive tokens sent from Polygon even if it looks correct. Rabby’s automatic network selection feature can help with this, but verify it rather than assuming it is correct. Each token, each chain, each transaction should be verified before signing.

Unwind complex positions: liquidity pools, staking, and lending

Token balances are the simplest to move; complex positions require more care. If you have provided liquidity to a DEX (decentralized exchange), your funds are represented by LP tokens in a smart contract. To move the underlying funds, you must first withdraw from the liquidity pool, which generates one transaction that burns your LP tokens and returns the underlying assets. This may involve two tokens (e.g., ETH and USDC from a Uniswap pair), not just one. Use Rabby’s transaction interpretation feature to understand what each step will produce.

For a lending protocol position, you may have collateral deposited and borrowed funds outstanding. If you borrowed an asset (like USDC) against collateral (like ETH), you must repay the borrowed amount before withdrawing the collateral. This is not optional; attempting to withdraw collateral while funds are borrowed will fail. Check your position’s health factor and ensure that reducing collateral will not trigger a liquidation. If the health factor is low, repay borrowed funds first, then withdraw collateral. Again, each step is a separate transaction that should be reviewed and confirmed.

Some positions may be staking arrangements where your tokens are locked for a fixed period or tied to a validator. You may not be able to unstake immediately, or unstaking may trigger a withdrawal delay. Check the relevant protocol’s interface or Rabby’s display to understand whether funds are immediately accessible. If funds are locked, you will need to wait for the unlock period; moving the wallet to a new address does not release locked funds any faster, but it does ensure that when the unlock completes, the funds can be moved to your new secure wallet. Document the unlock dates so you know when to return and complete the migration for those assets.

Move NFTs and verify collection addresses

Rabby supports NFT management, displaying non-fungible tokens held in the wallet. Moving NFTs is more complex than moving fungible tokens because each NFT is unique and gas fees are typically higher. Use Rabby’s NFT display to view each NFT you own, then send each one to the new wallet using the native NFT transfer feature. Some NFTs may be part of a larger collection; verify that you understand the complete list of NFTs before deciding which to move.

The consideration is whether to move every NFT or to sell some and keep only those you genuinely want to hold. An NFT that has declined in value or that you no longer use may be worth selling rather than paying gas fees to migrate. The compromised wallet situation provides a natural decision point to reassess your holdings. For NFTs you do want to move, use Rabby’s transfer function, review the transaction, and confirm that the destination address is the new wallet. Do not use an NFT marketplace’s listing interface during this migration process; use only direct transfer to move NFTs to your new wallet.

After moving each NFT, verify on a blockchain explorer or NFT marketplace that the new wallet is now the owner and the compromised wallet no longer holds the NFT. This may take a few minutes to update on some interfaces, so do not assume an NFT is lost if it does not immediately appear in the new wallet’s display. Check the blockchain itself as the authoritative source.

Verify complete migration and secure final setup

Once all assets have been moved, verify that the compromised wallet shows zero balances across all chains and asset types. Use Rabby to cycle through each network, check that no tokens or NFTs remain, and confirm with a blockchain explorer that the wallet is empty. This is not just a cleanliness check; it is confirmation that no assets were forgotten and that the migration is complete.

Next, verify that the new wallet displays the correct balances on all chains for all assets. The totals should match what was in the compromised wallet, minus any gas fees paid during the migration. If balances do not match, identify which assets were not moved, check for transactions that may have failed, and complete the migration for any remaining holdings. Once balances match, the active migration is complete, but the security setup is not.

Enable all available security features in the new Rabby Wallet. Set a strong PIN or password for the wallet interface. If you are using the browser extension, enable any additional security settings that the browser or extension offer. Consider using a password manager to store the PIN in a secure, encrypted form separate from the recovery phrase. If you are using the mobile app (Android or iOS), enable biometric authentication if available. For larger balances, consider connecting a hardware wallet such as a Ledger through Rabby’s hardware wallet compatibility, which adds a physical signing step between the wallet software and actual transaction approval.

Document the incident and prevent recurrence

Now that assets are secured, reflect on how the recovery phrase was exposed and take steps to prevent it from happening again. Was the phrase stored in a cloud service that was then hacked? Switch to local, offline storage. Was it visible on a shared computer or photographed? Ensure that your new phrase is never in digital form or visible to others. Was it obtained through phishing? Be extremely cautious about emails or messages claiming to be from wallet providers, and remember that legitimate services will never ask for your recovery phrase under any circumstances.

The recovery phrase for the new wallet should be stored in a location that is both secure and that you can actually access if needed. Many security experts recommend a physical safe, a safe deposit box, or another form of physical security that is under your direct control, not your bank’s. A backup stored in your lawyer’s office or a trusted family member’s safe is an option, but ensure that you document the location and access procedure in case you need to recover the wallet in a time-sensitive situation.

Document which addresses correspond to which wallet so that if you receive funds in the future, you can verify that they are going to the new, secure wallet and not the old one. Keep a written record (not digital) of the new wallet’s receiving addresses for each EVM chain you use regularly. This is not the recovery phrase; it is just the public addresses that people can send funds to. Public addresses are not secret, so there is no security risk in writing them down clearly.