I have a MEW address associated with a private key that was Phished and funds depleted, (my fault...) I also have MEW address created with a Trezor, are my ETH and Tokens in my Trezor wallet safe? I know not to use my address with the compromised private key anymore, but are my MEW accounts linked in any other way I should be concerned about? e.g. is the private key I was given only associated with the one address?

Discussion of best practices would be appreciated. Any suggestions about what to do with the phished account?


1 Answer 1


I'm going to read "MEW address" as "Ethereum account used in MEW".

If your compromised account was not generated with the Trezor and your computer/phone is not compromised (I hope you didn't download malware while being phished), then your other accounts should be fine (I'm assuming you otherwise have good security practices).

If the account that was compromised was generated using the Trezor and you are paranoid cautious, I would transfer all tokens/Ether to new accounts that are protected by a different seed key than the one you are currently using. Untested; I don't own a Trezor; I'm only guessing at a procedure One way of doing this is to back up your current Trezor seed phrase (PHRASE_A), generate some new accounts using a new seed (PHRASE_B), restore the Trezor using PHRASE_A to send your ether/tokens to the newly created accounts, and then restoring back to PHRASE_B. I'm hoping you have tried restoring your accounts from PHRASE_A as soon as you got your Trezor (because an untested backup is not a good backup). The more expensive way is to get a new Trezor with a new seed phrase and send all the tokens/ether from one to accounts "created" by the other.

The reason why I would not use any keys derived using PHRASE_A if you lost a private key derived from that seed is because you have to trust that the key scheduling algorithm/procedure used by the Trezor is secure. It may not be due to bad math (which would affect a lot of people), incorrectly implementing good math, and/or Trezor folks thinking they know better than crypto people and rolling their own key derivation/scheduling algorithm that has issues (but the Trezor is closed source so it wouldn't be immediately obvious if this were the case). If one of these things is true, then knowing one private key may enable the attacker to determine other private keys generated by your Trezor, thus compromising all other accounts. Even if it's a currently unknown flaw, might as well solve the problem now while the difficulty/cost of transferring to new accounts is lower than if Ethereum is commonplace and you're "locked in" to your current accounts.

Aside from not using your phished account again, I don't have any other suggestions. Edit: If your phished account has control over something (for example, owns a contract or is used for identification purposes), then you should go and reassign control, if possible, to other accounts ASAP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.