What to do when a wallet vulnerability is announced
A calm order of steps for the day a wallet maker publishes a security advisory: read it, judge your exposure, update safely, move funds only if told to.
Published 3 min read
In short
Most wallet advisories describe crashes, privacy leaks or bugs that need unusual conditions, not stolen keys. Read the maker's own advisory first, check whether your version, platform and settings are affected, and update through the maker's official software.
Move funds to a new wallet only when the advisory says keys or seeds may be exposed. Never follow links or instructions that arrive by email or message claiming to be about the vulnerability: fake security alerts are a standard way to steal seed phrases.
A security advisory about software you trust with money is alarming to read. It is also, in most cases, the system working: the maker found or was told about a flaw, fixed it, and is telling users. The useful response is a short sequence of checks, not a rush to move everything.
Step 1: Read the real advisory
Go to the maker’s own website or repository by typing the address yourself. Advisories published by wallet projects follow a common shape: what the flaw is, which versions and platforms are affected, how severe the maker considers it, what has been fixed, and what users should do.
Ignore messages that come to you. Emails, texts and social media posts announcing an “urgent security update” that requires you to enter your seed phrase are a common theft technique. No maker of software or hardware wallets needs your seed phrase to fix anything.
Step 2: Work out whether you are affected
Three questions settle most cases:
| Question | Example from Bitcoin Core’s 2026 advisories |
|---|---|
| Is my version affected? | The wallet migration bug affected 30.0 and 30.1 only, and was fixed in 30.2 |
| Is my platform affected? | The TCP urgent data issue affected Windows, macOS and BSD builds, not Linux |
| Do I use the feature involved? | The IP address leak in 31.0 affected only users who had turned on the new private broadcast option |
If the answer to any of them is no, the advisory probably does not apply to you, though updating is still sensible.
Step 3: Judge what is at risk
Advisories fall roughly into four kinds, and the right response differs:
- Crash or denial of service. The software can be made to stop or slow down. Coins are not at risk; update when convenient, sooner if your node is exposed to the internet.
- Privacy leak. Something about you, such as your IP address or which addresses are yours, could be revealed. Update, and consider whether past activity was exposed.
- Data loss. Files could be damaged or deleted. Make sure your backup is tested before doing anything else, then update. The Bitcoin Core migration bug, which could delete other files in the wallet directory, is this kind.
- Key or seed exposure. Private keys could be read or predicted. This is the rare case in which moving funds is the right response, to a wallet created on a device and software that are not affected.
Step 4: Update safely
- Download only from the official source, and verify signatures or checksums if the maker publishes them.
- For a hardware wallet, update firmware only through the maker’s official app, and confirm on the device screen. A legitimate update never asks you to type your seed phrase into a computer.
- Do not update in a hurry from a link in a message. A fake updater is a classic way to install malware.
Step 5: Move funds only if told to
If, and only if, the advisory says keys may be exposed, create a new wallet on an unaffected device, write down and test its new seed phrase, and send the funds there. Moving funds without that reason adds fees, links your addresses together and creates a new backup that has not yet been tested.
Where to follow advisories
Bitcoin Core publishes advisories on bitcoincore.org, which also offers an RSS feed. Hardware wallet makers publish theirs on their own websites and security pages. For broader software vulnerabilities, the US Cybersecurity and Infrastructure Security Agency (CISA) publishes advisories for widely used products. Following the feed of the software you actually use is enough; the rest is noise.