BIP-39 Crypto Wallet Seed Phrase

Detects a BIP-39 mnemonic (crypto wallet recovery / seed phrase): a run of 11-24 space-separated lowercase words. Because the full 2048-word BIP-39 list cannot be embedded in a single regex, detection fires either when the word run is explicitly labelled as a seed/mnemonic/recovery phrase, or when the run contains one of a set of distinctive BIP-39 anchor words. A leaked seed phrase grants full, irreversible control of the wallet's funds.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence when labelled, because the explicit seed/mnemonic/recovery-phrase label adjacent to a long lowercase word run is highly specific. The anchor path is more heuristic but still requires a long run of short lowercase words containing a distinctive BIP-39 word, which is uncommon in ordinary prose.
Jurisdictions: global
Regulations: GDPR
Frameworks: CIS Controls, ISO 27001, NIST CSF, SOC 2
Data categories: credentials, financial
Scope: narrow
Risk rating: 10
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?:seed\s+phrase|mnemonic(?:\s+phrase)?|recovery\s+phrase|recovery\s+seed|wallet\s+backup|secret\s+recovery\s+phrase)[\s:#=-]{0,8}(?:[a-z]{3,8}\s+){10,23}[a-z]{3,8}\b|(?<![a-z])(?:[a-z]{3,8}\s+){0,13}(?:abandon|ability|zoo|zone|robust|gospel|ozone|scheme|surround|witness)(?:\s+[a-z]{3,8}){10,23}(?![a-z])

Corroborative evidence keywords

seed phrase, mnemonic, recovery phrase, secret recovery phrase, wallet, private key, BIP39, cold storage

Proximity: 300 characters

Should match

seed phrase: abandon ability able about above absent absorb abstract absurd abuse access account — Labelled 12-word seed phrase using real BIP-39 words
recovery phrase legal winner thank year wave sausage worth useful legal winner thank — Labelled 12-word recovery phrase (classic BIP-39 test vector words)
gospel robust scheme ozone witness surround zone wisdom kitten garage soccer legal hover — Unlabelled 13-word run containing several BIP-39 anchor words

Should not match

seed phrase: this — Label present but only a single trailing word, not a full mnemonic
the quick brown fox jumps over the lazy dog again today — Ordinary short-word prose with no label and no BIP-39 anchor word
Always store your recovery phrase offline and never share your mnemonic with anyone — Prose advice about seed phrases with no actual word run

Known false positives

Long runs of short lowercase words (e.g. word-game text or tokenized prose) that happen to contain a BIP-39 anchor word. Mitigation: Prefer the labelled path; require corroborative wallet/crypto keywords for the anchor path and optionally validate words against the full BIP-39 list downstream.