I received an email from Exodus, asking me to provide my 12-word secret recovery phrase/password

If you have received an email from any @exodus.com or @exodus.io email address asking you to provide your 12-word secret recovery phrase, this is a phishing attempt to steal your crypto.

Exodus does not send unsolicited emails. Exodus staff will never ask you for sensitive information like passwords, private keys, or secret recovery phrases.

In this article:

Lee este artículo en Español | Read this article in Spanish

What is a phishing email?

A phishing email seems like it's coming from a legitimate platform, but it isn't. It's an attack to get you to click on a link, fill out a form, or download an attachment. The attacker is trying to install malware on your device or get access to your information to steal your money or crypto.

In crypto, these emails often appear to come from support teams like Exodus Support.

Phishing emails often contain links to other websites or request a reply to a different email from the one you see as a sender. These emails may also ask you to send funds to a certain wallet as part of a "backup procedure" or enter your 12-word secret recovery phrase as part of a "verification process." Never do this!

Never click links or follow instructions in unsolicited emails. Attackers aim for you to share private details such as your 12-word secret recovery phrase or private keys so they can steal your crypto or pressure you into sending funds to a wallet they control.

Exodus will never ask any of our customers to provide their passwords, private keys, or 12-word secret recovery phrase, no matter the situation. Any email that you receive asking for such information is meant to trick you into thinking that it is coming from us to steal your funds.

If you receive a scam or phishing email claiming to be from Exodus, please let us know by emailing us at [email protected]. We take scams and phishing attempts extremely seriously and deeply appreciate any community reporting on attempts to harm our customers.

What should I do if I receive a phishing email?

If you receive a phishing email in your inbox, here are a few actions you can take:

  • Do not open it. It’s best practice never to open unsolicited or suspicious emails.
  • Delete it. To prevent yourself from accidentally opening the message in the future, remove it from your inbox.
  • Do not click links. Links embedded within phishing messages direct you to fake or fraudulent websites that trick you into entering private information.
  • Do not open or download attachments. Attachments in phishing emails may contain malware such as viruses, worms, or spyware that can be installed on your system when opened.
  • Never share your private keys or 12-word secret recovery phrase with anyone. Anyone with your private keys or 12-word secret recovery phrase can steal your crypto.
  • Do not send funds. Transactions confirmed on the blockchain are irreversible, so if you send funds to a scammer, retrieving them is not possible.
  • Do not reply. Ignore any requests from the sender, and do not call phone numbers provided in the message.
  • Report it. Let us know if you have been sent a phishing email by writing to us at [email protected].

    • After reporting this to Exodus, you may be asked to provide an EML file to help us investigate the phishing attempt. To do so, follow the steps included in this guide: How do I export an email as an EML file?

How do I protect myself from phishing emails?

Here are a few things you can do to protect yourself from phishing emails:

  • Use a strong spam filter
    • Depending on your mail provider, setting your spam filters a little stronger may make the difference between a message landing in spam versus your inbox.
    • Use services like Gmail's Priority Inbox or Apple's VIP, which figure out the important people for you. However, you'll still get an email if an important person is spoofed, meaning your filters are not 100% reliable.
  • Learn how to spot a phishing email
    • Check and review the header and the sender’s email address. Note that email addresses can easily be spoofed, so they might look completely legitimate.
    • Look out for spelling mistakes.
    • Watch for urgent or suspicious requests. Often phishing emails will make requests and claim it is urgent to scare the receiver into clicking a link or sharing personal information.
    • Never click on links and don’t open or download attachments from unfamiliar or unverified emails.
    • If an email seems suspicious, you can analyze the message headers to identify the real sender behind a spoofed address. To learn more, visit Google’s security guide: Trace an email with its full headers.
  • Keep your device's anti-virus and security settings updated
    • Regular anti-virus checks and security updates can help maintain a secondary line of defense if something gets past your spam filters.
  • Improve your awareness of scams and good security practices
    • Understanding the risk of phishing attacks and scams goes a long way to keeping you and your funds secure. Awareness of the most common scams and phishing attacks in the crypto space significantly impacts your ability to avoid them. You can check out these articles to learn more:

Exodus is not affiliated with any third-party platforms, external links, or any other third-party resources mentioned in this article. As such, Exodus cannot guarantee the performance of third-party products or services, or that the steps shown and the information provided will always be accurate.

Related Articles