Your 24 words: what they are for and how to keep them

What the 24 words are

A wallet is controlled by keys. A key is a secret number, and whoever has the right key can move what the wallet holds. Your wallet generates its keys from a list of ordinary words, and that list is the backup of all of them.^[2] In Kudu, the list has 24 words. Some websites call it a "seed phrase".

Three facts about the words:

• They are a master key. The same 24 words always give the same wallet, on any phone. Whoever has them controls it.^[2]
• The order matters. Write the words in the order they were shown to you. The same words in another order give a different result.^[2]
• Each word is exact. Write every word as shown, in the language shown. Do not translate, shorten or change a word. A mistake in spelling gives a different set of addresses.^[2]

What the words are for

• Opening your wallet on a new phone. If you change phone or open your wallet in a new browser, the app normally asks for your PIN. It asks for your 24 words if your PIN cannot open the wallet on that device, or if you have lost your PIN.
• Opening your wallet in another wallet app. Some other wallet apps accept a phrase like this, but whether one accepts your 24 words depends on the app and on the language of your words. Check before you rely on it, and know that typing your words into another app has its own risk.
• Proving that the wallet is yours. When you type your words, the app checks them against your wallet and refuses words that do not match.

How to write them down

1. Pick a private moment. Nobody should see your screen, and no camera should point at it.
2. Write the words by hand, on paper, in order. Number the lines 1 to 24 and write one word per line, exactly as shown. The screen with your words tells you the same: write them by hand, on paper, and never take a screenshot.
3. Check every word. Read your paper back against the screen, one word at a time. A mistake in spelling or in word order gives a different set of addresses.^[2]
4. Write a second copy. Write the 24 words again, by hand, on a second sheet.
5. Keep the two papers in two different places that lock. For example, a drawer at home and a locked box somewhere else. One flood, one fire or one move should not reach both.
6. Keep the words out of your phone's pictures, notes and messages. That means no screenshot, no photo, no note app, no email and no message to yourself. Each of these puts the words where someone else may be able to open them. If you also use the file download that the app offers, follow what the file says: keep it in a password manager only.

Nobody who contacts you may ask for your words

Nobody who helps you with your wallet should ask for your 24 words. That includes a support team, a bank, an authority and a friend. Kudu support never asks for your 24 words, by email, message, call or ticket.

The only screen where the Kudu app asks for your 24 words is the one where you restore your wallet or choose a new PIN. Open the app yourself, from its icon or an address you typed, and type the words only there. Never type them into a website, a form, a chat or a message that you reached through a link, a call or a message from someone else.

If you think someone has seen your words

Anyone who has your 24 words, in order, can move your funds from any phone. Moving your funds to a wallet with different words stops the next move. It does not bring back anything that has already left. Your old 24 words stay valid on the blockchain, so anyone who has them can still use the old wallet: leave nothing in it. Do this before anything else.

1. Get a wallet with different 24 words. The Kudu app does not let you replace the 24 words of a wallet you already have. Use another wallet app. Write the new 24 words down as in the steps above, on new paper.
2. Send all of your funds from the old wallet to the address of the new one. Check the address before you confirm.
3. When the old wallet is empty, stop using it. Then destroy the two old papers.
4. Report what happened to the police.^[1]

Common scams

• A call from a police officer, a customs officer or a magistrate that asks for your words. Cybermalveillance.gouv.fr, the French national scheme that assists victims of online attacks, says that the police, the gendarmerie, customs or a magistrate "will never call you to ask for confidential data" (free translation of "ne vous appelleront jamais pour vous demander des données confidentielles"). It names recovery keys among what such impersonators try to obtain.^[3]
• "We can get your money back." After a loss, someone offers to get your funds back. In January 2023 the AMF warned about callers who claimed to help victims recover their funds, including an "engineer" who was supposed to provide technical assistance in recovering their crypto-assets "directly on the Blockchain". The AMF says it "has no authority to recover or return funds lost by investors" and that it "never asks consumers for money".^[4]
• A page or app that asks you to "connect", "verify" or "update" your wallet with your words. Any page, form or chat that you reached through someone else's link, call or message, and that asks you to type your 24 words, is asking for control of your wallet, whatever reason it gives.
• A request to share your screen or take control of your phone. Cybermalveillance.gouv.fr lists, among what impersonators do, asking to take remote control of your phone or computer (« solliciter la prise de contrôle à distance de votre téléphone ou ordinateur »).^[3] With that control, a stranger can see your words or your wallet.

An email, message or call that claims to come from Kudu support is a scam as soon as it asks for your words. Do not answer it, and do not open its links.

Questions

Next guide MiCA and your wallet: what changes for you MiCA sets rules for tokens and for the companies that serve you. Here is what the text says about wallets, with dates. Read the guide