A seed backup was seen or taken: moving to a new multisig

Why you have time

In a 2-of-3, one seed gets someone one key. If your passphrase was in the same box, they have that too. They still need a second seed, and you have two that nobody else knows. That means you can still sign, and they can’t.

Why you shouldn’t wait

You no longer have a spare key. Until you’ve moved, losing one more backup, or someone finding one more, would be a real problem. Treat the exposed seed as public from now on.

Steps

1. Don’t use the exposed seed for anything new, and don’t bring it near your computer.
2. Create a new seed for the exposed key on a new device, or reset that device first. Replacing all three seeds is the cleanest option if you’re unsure what else was seen, but then do it on new devices, or move the coins first and reset the old devices afterwards. Don’t reset a device whose key you still need to sign the move.
3. If you use a passphrase and it was in the same box, pick a new one.
4. Build a new 2-of-3 in Sparrow as in the setup guide, from step 6 onwards.
5. Back up the new descriptor and seeds, and do the recovery rehearsal.
6. Send everything from the old wallet to a verified address of the new one. Sign with the two keys that weren’t exposed.
7. Once the old wallet is empty, destroy the exposed seed backup and the old descriptor. Keep the seed backups of any key you carried over to the new wallet, and update your notes and inheritance letter.

What counts as exposed

• Someone saw the words or the plate, even briefly.
• A photo, scan or digital copy ever existed.
• A box was opened, moved or went missing, and you can’t rule out that someone read it.
• You typed the words into a website, app or computer, for whatever reason.