A seed phrase is not a wallet password and not a confirmation code. It is the wallet itself, written out as twelve or twenty-four words. Anyone holding it restores every address and every balance derived from it, without limits and without your involvement. On-chain transfers are final: no support desk and no exchange can reverse them.
Where it fits in the flow — nowhere
Walk the steps in order. Depositing: you send funds from your own wallet to a personal address issued by the site, and they credit after network confirmations. Withdrawing: you supply the destination address and the request goes to operator review. The account itself: an email and a password, no identity verification, with email confirmation required once, before the first withdrawal. Not one of those steps needs access to your wallet, because the site does not control it. Which means a request for a seed phrase cannot be a technical necessity, whoever signs it.
The standard scripts
- A "support agent" messages first. A direct message, often minutes after you mentioned a problem in a public chat. Name and avatar copied from the real thing.
- Wallet "sync" or "validation". A link to a page asking for the phrase to "connect" your wallet. No legitimate operation carries that name.
- The stuck transaction. "Your deposit failed, enter your seed to recover it." A genuinely missing deposit is traced by transaction hash, never by phrase.
- A bonus waiting for you. Confirm wallet ownership and the credit appears. On-site credits never require access to an external wallet.
- An urgent "account confirmation". A mail threatening a block, with a link to a form. Email confirmation on the site happens once, before the first withdrawal, and is done inside the account.
- Remote access. A request to share your screen or install a "diagnostic" tool. Here the phrase is not asked for — it is watched.
- Lookalike domains. A site or bot with an almost-correct name: one extra letter, a different zone, an underscore in the handle.
The channels that are real
Tonza has three: the on-site chat for signed-in users, the Telegram bot @TonzaSupportBot, and [email protected]. Anything else is not support, whatever it calls itself. Check spelling character by character — swapping one letter in a handle is an old, boring move, which is exactly why it still works.
Five rules that cover almost everything
- A seed phrase or private key goes nowhere except into your own wallet application during recovery.
- Treat any conversation you did not start as unsafe by default, then reopen the matter yourself through an official channel.
- Urgency and threatened loss of funds are part of the script. A pause costs nothing; the mistake costs everything.
- Store the phrase offline — paper or metal, not a screenshot, not notes, not cloud storage, not a chat thread.
- Keep serious holdings on a separate wallet and only the current playing budget on the one you use daily.
What is not a risk
Your public deposit address is safe to share; receiving funds is what it exists for. One piece of vocabulary is worth untangling too. In Tonza Originals, round fairness is verified with a server seed, a client seed and a nonce — parameters of a single round. The hash of the server seed is published in advance, the server reveals the seed after the round, and the outcome is recomputed by hand on the provably fair page, which also holds round history, a verification calculator and seed rotation. Those seeds have nothing to do with a wallet seed phrase, and verifying fairness never requires access to your funds.
If the words are already typed
Treat the wallet as compromised from that second. Create a new one and move whatever remains, first thing — automated sweepers empty an address within minutes. Revoking previously granted signing approvals does not save you here: a leaked phrase means the key itself is in someone else's hands, and it can sign anything. If the impostor used the site's name, report it through an official channel: it will not recover funds, but it shortens the clone's working life.
