Most Bitcoiners can tell you where their seed phrase lives: on steel, in a drawer, somewhere a burglar would need a map to reach. Far fewer can tell you where it used to live. The screenshot taken during a 2021 wallet setup, the text file named ‘backup’ from a laptop migration, the secure note that felt like a sensible compromise at the time. A hardware wallet protects the key inside the device. It cannot protect the copy you made before you knew better, and this week's malware goes looking for exactly those copies.
The stealer reads your filenames
On September 18, BleepingComputer reported on Rapuncel, an infostealer that LastPass and Delphos Labs traced to fake GitHub repositories impersonating LastPass and at least 39 other companies. Victims find the repos through search results, click a download button, and receive a bloated ZIP archive that sideloads a malicious DLL through a disguised Microsoft debugger. Once running, Rapuncel takes browser credentials, data from 30 wallets, and screenshots. It also searches documents for files with ‘password,’ ‘seed,’ ‘wallet,’ or ‘recovery’ in the name.
That last behavior is the one to act on. Rapuncel does not need to break your hardware wallet. It needs you to have saved seed.txt once and forgotten about it.
Phones get the same treatment through a different door. In 2025, Kaspersky's SparkCat research found apps on Google Play and Apple's App Store that ran an OCR library over gallery images, matched the text against wallet-phrase keywords in nine languages, and uploaded the hits to attacker servers. The infected Android apps passed 242,000 downloads. A follow-up campaign Kaspersky named SparkKitty went after gallery photos again. A screenshot of your recovery phrase is a file an attacker can read, whether or not you remember taking it.
Run the sweep in one sitting
Budget an hour. Work on the device itself, not over remote access, and do not paste results into an AI tool or a cloud note while you work.
1. Filenames on the computer. Search your home folder for the obvious names. On macOS or Linux:
```
find ~ \( -iname '*seed*' -o -iname '*wallet*' -o -iname '*recovery*' -o -iname '*mnemonic*' -o -iname '*backup*' \) 2>/dev/null
```On Windows, from Command Prompt:
```
dir "%USERPROFILE%" /s /b | findstr /i "seed wallet recovery mnemonic backup"
```2. File contents. Filenames lie; contents lie less. ripgrep searches text quickly: rg -il -e mnemonic -e "seed phrase" -e "recovery phrase" -e xprv -e zprv ~. On Windows, findstr with /s /i /m does the same job more slowly. Include Downloads, Desktop, old project folders, and external drives.
3. Wallet files. Look for wallet.dat, Electrum and Sparrow wallet files, and descriptor exports. An unencrypted software wallet file is a key, not a record.
4. Photos. Apple Photos and Google Photos both find images by the text inside them. Search generic terms such as ‘recovery,’ ‘seed,’ ‘words,’ or ‘phrase,’ then scroll the screenshots album by hand. Never type your actual seed words into a cloud search box to test it. That turns a search into a disclosure.
5. Notes, mail, and the password manager. Check Apple Notes, Google Keep, email drafts, messaging apps' ‘saved messages,’ and every secure note and attachment in Bitwarden or KeePassXC.
6. Cloud sync and old devices. Anything in a synced folder also existed on a server. Check iCloud Drive, Google Drive, Dropbox, and the retired phone in the kitchen drawer.
Log each find on paper: where it was, which wallet it belongs to, and whether that wallet still holds coins.
Priya's forgotten screenshot
Priya is hypothetical, but you have met her. Her savings sit on a COLDCARD, seed stamped in steel, never typed into anything. She considers herself done.
The sweep disagrees. A photo search for ‘words’ surfaces a 2021 screenshot of a twelve-word phrase from the mobile wallet she used before buying hardware. She forgot that wallet because she swept most of it to the COLDCARD. A few UTXOs from an old Lightning withdrawal still sit there, and the screenshot has synced across three phones and one cloud account for five years.
Her hardware wallet is fine. Her history is not.
Destroy, move offline, or migrate
Every find gets one of three verdicts, and one rule governs all of them: deletion does not un-expose a secret.
An empty, abandoned wallet gets the simplest treatment: delete the copy everywhere, including cloud trash and ‘Recently Deleted’ albums, but confirm first that the wallet really is empty by loading its addresses into a watch-only wallet connected to your own node.
A funded wallet whose copy never left an offline machine keeps its seed, but loses the file. Write it on paper or steel, store it with your other backups, and destroy the digital file.
Any funded wallet whose copy ever touched a networked device or a cloud account should be treated as burned. Generate a fresh wallet on hardware, move the funds, and only then delete. Use coin control to move UTXOs in sensible batches rather than consolidating everything into one transaction that links your whole history for any chain analyst who cares to look. Priya lands here.
Deletion itself has limits. Overwrite tools cannot guarantee removal on SSDs and phone flash storage, as the EFF explains. Full-disk encryption covers what deletion misses, which is one more reason a funded seed that touched a disk gets migrated rather than merely deleted.
Make it a quarterly habit
Copies creep back. A new wallet setup, a phone upgrade, a relative who photographs your backup card to be helpful. Put the sweep on your calendar every quarter, and adopt one rule for every new wallet: the seed goes from the device screen to paper or steel, with no camera and no keyboard in between. If you need to rehearse a recovery, do it on the hardware signer or on an offline machine booted from Tails, never on your daily laptop.
Final thoughts
Rapuncel is not clever. It searches for the word "seed" because the word "seed" keeps paying. A careful steel backup does nothing about the careless copy that came before it, and an hour of searching costs less than any recovery you might need later. Self-custody means knowing where your keys are, all of them, including the ones you made on a bad day in 2021. Count every copy before someone else does.
