Never share your recovery phrase, private key or vault backup files with anyone. Use only the app from the official stores, the chat inside the app and the sites www.thorwallet.org and app.thorwallet.org.
On this page
Most losses in crypto do not come from broken software. They come from someone tricking the owner into giving away a recovery phrase or signing a harmful transaction. These rules cover the common tricks.
The one rule
Your recovery phrase, your private key and your vault backup files give full control over your funds. Never type them into a website, a form or a chat, and never send them to anyone.
Support will never ask for your recovery phrase. THORWallet has no step called "validate", "synchronize" or "verify" your wallet that needs your phrase.
Type your recovery phrase only in the THORWallet mobile app, when you restore a wallet. On a computer, connect the mobile app, a vault or a hardware wallet instead.
Common scams
| What you see | What it is | What to do |
|---|---|---|
| A direct message from "THORWallet support" or an "admin" on Telegram, X or Discord | Fake support. Real support is the chat inside the app and info@thorwallet.org. | Do not answer. Do not open links. |
| A website or pop-up that asks for your recovery phrase to fix an error, claim a reward or "validate" the wallet | Phishing | Close it. Enter nothing. |
| A wallet app with a similar name or logo | Fake app | Install only from the links on the download page. |
| A token you never bought, often with a website name in its title | A lure sent to many wallets (airdrop or dust scam) | Do not interact. Do not visit the site. |
| An offer to recover lost funds for a fee paid up front | Recovery scam | Ignore it. Nobody can reverse a blockchain transaction. |
| A recent address in your history that looks like one you use | Address poisoning | Copy addresses from the source, not from history. Compare the first and last characters. |
What THORWallet shows you
- Unverified Token: a red label on tokens that THORWallet's token list does not recognise. The asset page shows Verified with Yes or No.
- Flagged as malicious: a token marked as a scam has no price in THORWallet and cannot be swapped. The app tells you not to follow links or messages that promote it.
- WalletConnect warnings: when a site asks to connect, THORWallet can show Potential threat, Invalid domain or Cannot verify next to the site name. See Connect to dapps with WalletConnect.
- Request details: before you approve a request from a site, THORWallet shows what it does and warns you about risky requests.
- Token approvals: you can review and revoke permissions you gave to contracts. See Token approvals.
Good habits
- Write the recovery phrase on paper and keep it offline. Do not store it in photos, cloud notes or email.
- Save addresses you trust in Settings, Address Book, and send a small test amount first when an address is new.
- Read every request before you tap Approve. If you do not understand it, tap Reject.
- Keep larger amounts in a multi-device vault, where one device alone cannot move funds.
- Update the app from the official store.
If you think you were scammed
- Stop. Do not send more funds and do not sign anything else.
- If you typed your recovery phrase anywhere, treat the wallet as lost. Create a new wallet with a new recovery phrase and move the remaining funds to it at once.
- If you approved a contract, revoke it under Settings, Token Approvals.
- Disconnect connected sites: open Settings, WalletConnect and tap Reset.
- Contact support in the app chat for guidance. THORWallet cannot reverse the transaction or return the funds.
Related
- How self-custody works in THORWallet
- Token approvals
- How to verify a token contract
- Contact support
- Is THORWallet safe and legit?
Common questions
Will THORWallet support ever ask for my recovery phrase?
No. Support will never ask for your recovery phrase, your private key, your PIN or your vault backup files. Anyone who asks is a scammer.
A token I never bought appeared in my wallet. What should I do?
Leave it alone. Scammers send tokens to many wallets to lure people to phishing sites. Do not open links in the token name and do not try to swap or sell it.
Someone says I must validate or synchronize my wallet. Is that real?
No. THORWallet has no such step. Messages and websites that ask you to enter your recovery phrase to validate, synchronize or unlock a wallet are phishing.
Can THORWallet get my funds back after a scam?
No. Blockchain transactions are final and THORWallet holds no keys, so it cannot freeze, reverse or refund a transaction.
Where is it safe to type my recovery phrase?
Only in the THORWallet mobile app, when you restore a wallet. On a computer, connect the mobile app, a vault or a hardware wallet instead. Never type it in a chat, a form, an email or a website.
Thank you.
Sorry about that. Chat with support inside the app, or write to info@thorwallet.org. Support will never ask for your recovery phrase.