Wallet private keys and recovery phrases
A tool parameter resembles a cryptocurrency private key or labeled recovery phrase.
Why it is risky
Section titled “Why it is risky”A private key or recovery phrase can give its holder control of wallet assets. Revealing it to another party may compromise the wallet even without an immediate transfer.
Example
Section titled “Example”An agent pastes a wallet recovery phrase into a general-purpose tool while trying to troubleshoot an account.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”One rule matches selected labeled 64-character hexadecimal values and 0x-prefixed 64-character values. Another matches a sequence of lowercase words after a seed or mnemonic label.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_MNEMONIC_PHRASE | wallet_generation | Community | HIGH |
RULE_PRIVATE_KEY_MATERIAL | wallet_generation | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Determine whether the value is a real secret and who received it. If a funded wallet secret was exposed, follow the wallet provider recovery guidance from a trusted environment; deleting the disclosure alone does not restore key secrecy.
False positives
Section titled “False positives”A transaction hash or other 0x-prefixed 64-character value may match as a private key. Labeled ordinary prose and realistic test data can match the phrase rule.
False negatives
Section titled “False negatives”Unlabeled phrases, other languages, split or encoded keys, and wallet formats outside the patterns can be missed.
Technical details
Section titled “Technical details”The rules do not verify key validity, ownership, a BIP-39 word list, or its checksum. They recognize shapes in captured parameters.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.