Seed Phrase vs Private Key: What's the Difference and Which Leaked?

By Merunas Grincalaitis, founder of MEV DAO and a developer who builds MEV, sniping and trading bots on Ethereum. Last updated: Oct 31, 2026.

TL;DR: A seed phrase (also called a recovery phrase or Secret Recovery Phrase) is 12 or 24 words that generate every account in a wallet. A private key is a single 64-character hex string that controls one address. If a private key leaks, one account is compromised. If the seed phrase leaks, every account derived from it is compromised, on every EVM chain, and you can't change the phrase. Accounts you imported with a private key are not covered by the seed phrase, so you have to back them up separately.

Almost every rescue request I get starts with the same confusion. Someone says "my private key leaked" when they actually typed their 12 words into a fake site, or they say "my seed phrase is safe" while a sweeper bot empties an account they imported years ago. Which one leaked decides how much is at risk and what you should do next, so it's worth getting this right before you move a single token.

What is a seed phrase?

A seed phrase is a human-readable backup of the master secret that generates all of a wallet's keys. Most wallets follow BIP-39, a standard that turns random data into words from a fixed list of 2048 English words.

The math is simple once you see it. A 12-word phrase encodes 128 bits of randomness plus a 4-bit checksum. A 24-word phrase encodes 256 bits plus an 8-bit checksum. That checksum is why a wallet can tell you a phrase is invalid when you mistype a word.

The words aren't used directly as a key. BIP-39 runs them through PBKDF2-HMAC-SHA512 with 2048 iterations, using the word "mnemonic" plus an optional passphrase as the salt, to produce a 512-bit seed. That seed is the root of everything else.

MetaMask calls this the Secret Recovery Phrase. Ledger, Trust Wallet and Rabby use slightly different names, but in almost every modern wallet it's the same BIP-39 standard underneath.

What is a private key?

A private key is a 256-bit number that signs transactions for exactly one Ethereum address. It's usually shown as 64 hexadecimal characters, sometimes with a 0x in front.

Your address is derived from it in one direction: the private key gives a public key, the public key is hashed with Keccak-256, and the last 20 bytes become your 0x... address. You can go from key to address, but never from address to key. If you want to see where this fits with smart accounts, our guide on EOA wallets and account types after EIP-7702 covers it.

How are seed phrases and private keys connected?

The seed generates a tree of private keys, one per account, using a fixed derivation path. This is defined in BIP-32 (hierarchical deterministic wallets) and BIP-44 (the path structure).

For Ethereum, most wallets use the path m/44'/60'/0'/0/n, where 60 is Ethereum's coin type and n is the account number. Account 1 is n = 0, account 2 is n = 1, and so on. Because the path is deterministic, typing the same 12 words into a different wallet rebuilds the same addresses, as long as both wallets use the same path.

So the relationship is one-way and one-to-many:

One seed phrase produces many private keys.
Each private key controls one address.
A private key can't be turned back into the seed phrase.

Seed phrase vs private key: what's the difference?

The difference is scope. Here's the side-by-side I give clients:

	Seed phrase	Private key
What it looks like	12 or 24 words	64 hex characters
What it controls	Every account derived from it	One address
Chains affected	All EVM chains (and others, like Bitcoin, if the wallet derives them)	That address on every EVM chain
Can you change it?	No, you can only move funds to a new phrase	No, you can only move funds to a new address
Restores imported accounts?	No	Only the one account it belongs to
Typical way it leaks	Fake wallet sites, "support" scammers, screenshots, cloud notes	Exported for a bot or script, `.env` files, pasted into tools
Damage if leaked	Whole wallet	One account

One thing surprises people: a leaked private key compromises that address on Ethereum, Base, Arbitrum, BNB Chain and every other EVM chain at the same time, because the address is the same everywhere. A leaked seed phrase does that for every account in the wallet.

Which one leaked? How to tell

Work backwards from what you typed or stored, and from which accounts are being drained. These are the patterns I see in rescue cases:

Several accounts in the same wallet were drained or are being watched. Assume the seed phrase leaked. A private key leak only affects one address.
Only one account is affected, and it's an imported account. That points to the private key. In MetaMask, imported accounts are labeled "Imported", and MetaMask's support docs confirm they aren't derived from your Secret Recovery Phrase.
You typed your words into a site, a form or a "wallet validation" bot. The seed phrase leaked, full stop, even if only one account has been touched so far.
You exported a private key for a trading bot, a script or a hardware wallet migration. Check where that key was stored: .env files in a public repo, chat messages and screenshots are the usual leaks.
Funds leave within seconds of arriving. That's a sweeper bot watching the address. It tells you the key is compromised, but not which secret leaked, so check the other accounts too.

If you're not sure whether an address is being watched, our compromised wallet checker guide shows how to read the on-chain signs.

What should you do if your seed phrase leaked?

Treat every account in that wallet as compromised and move everything to a brand new wallet with a new phrase. MetaMask's own wording on its recovery phrase is that the words "can be used to steal all your accounts", and the phrase can't be changed.

In order:

Create a new wallet on a clean device and write the new phrase on paper. Don't reuse anything.
Move the most valuable assets first, starting with whatever the attacker hasn't taken yet.
Check every account index the wallet ever created, not just the first one, and every chain you used.
Revoke token approvals from the old addresses where it still makes sense.
If a sweeper bot takes the ETH you send for gas, stop sending ETH. That's when you need a Flashbots bundle rescue, where gas and transfer land in the same block.

The first-hour checklist walks through the full sequence.

What should you do if only a private key leaked?

Move funds off that one address, then check whether the same key was stored anywhere else. Other accounts derived from your seed phrase are not exposed by a single private key, so you don't have to abandon the whole wallet.

Still, look at how it leaked. If the key sat in a .env file next to other keys, or in a password manager that was breached, assume those are gone too. And remember that a key leaked on one EVM chain is leaked on all of them, so check balances and airdrops on L2s and sidechains before you call it done.

Frequently asked questions

Is a seed phrase the same as a private key?

No. A seed phrase is 12 or 24 words that generate many private keys. A private key is one 64-character hex string that controls a single address. Leaking the phrase exposes every derived account; leaking a key exposes one.

Can you get a seed phrase from a private key?

No. Derivation only goes one way, from the seed phrase to the private keys. Nobody can work backwards from a private key, or from an address, to the phrase.

Does my seed phrase restore imported accounts?

No. Accounts you imported with a private key or JSON file aren't derived from the seed phrase, so restoring the phrase won't bring them back. Back up their private keys separately.

If my private key leaked, is my whole wallet compromised?

Not by that leak alone. Only the address that key controls is exposed, on every EVM chain. Your other accounts are safe unless the seed phrase or other keys leaked too.

Can I change my seed phrase?

No. A seed phrase can't be changed or reset. If it leaked, create a new wallet with a new phrase and move your funds and positions to it.

Is 24 words safer than 12?

A 24-word phrase has 256 bits of entropy versus 128 for 12 words, but 128 bits is already far beyond brute force. In practice, how you store the phrase matters much more than its length.

If a sweeper bot is already watching your old address and you still have tokens, staking positions or airdrops stuck there, that's exactly what our Token Rescue Bot handles. Here's how the compromised wallet rescue service works.