What to do if a crypto wallet may be compromised
A calm incident-response sequence for suspicious signatures, exposed phrases, malicious approvals, and stolen funds.
Key takeaway
Protect what remains, stop using the suspected wallet, preserve evidence, and ignore anyone promising guaranteed recovery for a fee.
First decide what may be exposed
A leaked recovery phrase means the wallet's underlying keys should be treated as compromised. A malicious token approval may affect a particular token or collection on a particular network. A stolen exchange password is an account incident with a different response path.
If you are unsure, act conservatively. Do not keep interacting with the suspicious website to investigate while valuable assets remain exposed.
Protect remaining assets
From a separate trusted device where possible, create a new wallet with a new recovery phrase. Move unaffected remaining assets to the new wallet. Do not import the old phrase into the new setup or reuse a phrase that may have been seen.
For token-approval incidents, revoke malicious or unnecessary allowances using an official wallet tool or the relevant block explorer. Revocation requires a transaction and fee; if the recovery phrase itself leaked, moving to new keys remains the priority.
Secure connected accounts and devices
Change relevant email and exchange passwords, enable strong 2-step verification, terminate unknown sessions, and contact the exchange through its official support route if an account is involved.
Remove suspicious browser extensions or software and run appropriate device security checks. If remote-access software was installed, treat the whole device as potentially exposed until assessed.
Preserve a useful record
Save transaction hashes, wallet addresses, timestamps, screenshots, URLs, usernames, messages, and the sequence of actions taken. Do not alter the evidence to make it look cleaner.
Report the incident to the relevant platform, local fraud-reporting service, and law enforcement where appropriate. Fast reporting may help an exchange identify deposited stolen funds, but no outcome is guaranteed.
Avoid the recovery trap
Publicly discussing a loss often attracts people claiming to be investigators, hackers, or recovery agents. They may use blockchain records to sound informed and then ask for an upfront fee, remote access, or a phrase.
No one can simply reverse a confirmed blockchain transaction. Be sceptical of guaranteed recovery and never give a second party control of the new wallet.
Practical checklist
Before you move on
- ✓Stop using the suspicious site and wallet
- ✓Move remaining assets to entirely new keys when needed
- ✓Revoke malicious token approvals on affected networks
- ✓Secure email, exchange accounts, and devices
- ✓Preserve transaction hashes and communications
- ✓Use official reporting routes and reject recovery offers
Check the source
Authoritative material used to verify the safety guidance in this article.