2026-09-15

43.8% of stolen crypto in 2024 came from compromised keys. Should your seed phrase backup be encrypted?

The FBI's Internet Crime Complaint Center logged $9.3 billion in reported cryptocurrency fraud losses for 2024 — a 66% jump from the year before, with people 60 and older alone reporting more than $2.8 billion of it. Most coverage of that number leads with investment scams and "pig butchering." But Chainalysis's 2025 Crypto Crime Report breaks the theft side down differently: compromised private keys — not phishing links, not fake exchanges — accounted for 43.8% of stolen crypto in 2024, the single largest category. A private key compromise almost always traces back to the same twelve or twenty-four words: the seed phrase. Somewhere between "write it down" and "lose everything," a lot of those phrases ended up somewhere a screen could show them.

What "never store it digitally" actually says, word for word

Every hardware wallet maker tells you not to digitize your seed phrase. The two biggest names say it slightly differently, and the difference matters. Ledger's own seed-phrase storage guidance reads: "Never store seed phrases in a non-encrypted digital format, including cloud storage, notes apps, or screenshots" — the qualifier "non-encrypted" is doing real work in that sentence; it implies an encrypted digital copy sits in a different risk category than a screenshot sitting in your camera roll. Trezor's official backup guide is blunter and explicitly closes that gap: "Never make a digital copy of your wallet backup (this includes Dropbox, email, encrypted folders, or photos)" — encrypted folders, named directly, still on the forbidden list. Trezor's logic is about the moment of digitization itself, not the format it ends up in: type or photograph the seed on any internet-connected device and that device has now seen the plaintext, whatever you do to the file a second later. Two vendors, both building hardware specifically to keep this secret offline, land in different places on whether encryption changes anything. This post takes Trezor's stricter reading as the standard for your primary backup, and asks a narrower, more honest question: what about the digital copy that, right now, already exists?

The situation this is actually for

Nobody needs to be told to buy a metal plate a second time. What's genuinely common — common enough that Ledger felt the need to name "notes apps" and "screenshots" specifically — is a phrase that's already sitting in one of those places: a photo taken "just in case" that iCloud or Google Photos quietly synced the moment it was snapped, a note typed into Apple Notes or Google Keep years ago and forgotten, an email draft to yourself that never sent, a .txt file left in Downloads. None of that is a hypothetical edge case; it's exactly the surface Chainalysis's 43.8% figure and the info-stealer malware families behind a chunk of it (tools like Redline and Cryptbot, built to scan a compromised device for exactly this kind of file and image) are pointed at. The honest advice for that phrase is still Trezor's: get it onto metal or paper, then delete every digital trace. This post is about the gap in between — the hours or days that plaintext copy still exists on a device before that cleanup is finished — not a replacement for finishing it.

Closing that gap without pretending it's the whole fix

If a digital copy of a seed phrase has to exist for any length of time — mid-migration to a new wallet, or simply the interval between noticing the screenshot and actually deleting it everywhere it synced — the lowest-risk version of "digital copy" is ciphertext, not plaintext, and it should never touch a cloud-synced folder in either form. Move the phrase into a single local text file first — not a photo, not a note that lives inside an app with its own sync switch you might not control — then encrypt that file with a passphrase that has no relationship to the seed itself and is never written down next to the encrypted file. NearSeal runs the whole operation locally in the browser: nothing is uploaded, and the encrypted bytes only leave your device if you choose to move them somewhere yourself. Two format details are worth getting right here specifically. First, NearSeal's default format stores the original filename in a cleartext header field, so "seed-phrase-backup.txt.nearseal" announces exactly what's inside even though it can't be opened — rename the plaintext file to something unremarkable before encrypting, or pick the opt-in age format instead, which carries no filename field at all. Second, once the encrypted file exists, every plaintext version — the original note, the photo, the version still in a cloud provider's trash or file-history — needs to actually be gone, not just moved; an encrypted copy sitting alongside three forgotten plaintext ones has fixed nothing.

What encryption doesn't touch, said plainly

The left side of that diagram is the real, addressable gain: ciphertext sitting in a folder defeats a scan for readable seed phrases, which is what a meaningful share of the malware behind Chainalysis's 43.8% figure is built to do. The right side is not something any file encryptor can reach, this one included. Clipper malware like the QuilClipper family works by rewriting what's on your clipboard the instant you copy something that looks like a wallet address or key — it's watching the moment of use, not the file sitting on disk before or after. If a keylogger or clipper is already resident on the device when you type the phrase into a text file, encrypting that file a minute later doesn't undo what the malware already captured. NearSeal also has no passphrase recovery of any kind — if you forget the passphrase protecting this backup, that copy is gone for good, which is exactly why it must never become your only copy of the phrase; the metal or paper backup Trezor and Ledger both actually recommend as primary has to keep existing independently of whatever you do with a digital one. None of this is a reason to skip the step — it's the reason this post frames encryption as closing one specific gap in an existing bad habit, not as a green light to keep the seed phrase digital on purpose.

The honest summary

Ledger and Trezor don't fully agree on whether an encrypted seed-phrase file is meaningfully safer than a plaintext one — one names "non-encrypted" as the problem, the other names "encrypted folders" on the same forbidden list as photos. What both agree on, without exception, is that the phrase's real home is offline, on metal or paper, never touched by a camera or a keyboard again after it's written down. This post doesn't argue with that. It's for the narrower, more common moment before that's true — a phrase that's already sitting in a screenshot or a forgotten note — where the honest choice isn't "encrypted file vs. perfect offline storage," it's "encrypted file vs. the plaintext copy already sitting there right now." Closing that gap is worth doing. It is not the same thing as being done.