Crypto Wallet Hacked: What to Do Right Now

Discovering that your crypto wallet has been drained or compromised is frightening, and the most important thing you can do in the first few minutes is act calmly and in the right order. Crypto transactions are final, so there is no bank to call and reverse the charge. But not everything is lost: if any funds remain, you can often save them, and you can stop further losses by cutting off the attacker's access. This guide walks you through immediate triage, explains how wallet drainers and approval phishing actually work, sets honest expectations about what is and is not recoverable, and shows you how to report the theft and rebuild safely. This is educational information, not financial or legal advice.

Speed matters, but order matters more. Work through these steps in sequence rather than panicking and clicking everything at once.

1. Disconnect. Close the dApp or website you were using, and disconnect your wallet from it. In MetaMask, open the extension, click the three dots in the top right of the account view, choose Dapp connections, and disconnect each one.
2. Do NOT enter your seed phrase anywhere. No legitimate support agent, wallet, or recovery tool will ever ask for it. If a site or person is asking, that is the attack.
3. Check what is actually gone. Open a block explorer like Etherscan (or the explorer for your chain) and paste your address to see recent outgoing transactions. This tells you whether the drain is finished or ongoing.
4. Triage remaining funds. If you still hold assets in the compromised wallet, assume the attacker can take them at any moment. Move them immediately to a brand new wallet (see the next section).
5. Note the timestamps and transaction hashes. You will need these for reporting and for any exchange that might freeze stolen funds.

One hard rule: if your seed phrase or private key was ever exposed (typed into a fake site, stored in a screenshot, pasted into a chat, or entered into a clipboard a malware program could read), the wallet is permanently unsafe. You cannot fix it by changing a password. You must abandon it.

If anything of value is left, your goal is to get it out before the attacker does. This is a race, and a few details make the difference between success and a wasted gas fee.

Create a fresh wallet first

• Generate a completely new wallet with a new seed phrase, ideally on a clean device. A hardware wallet such as a Ledger or Trezor is the safest destination. Never send funds to another wallet that shares the same seed phrase as the hacked one.
• Write the new seed phrase on paper, offline. Do not photograph it or store it in a notes app, cloud drive, or password manager field that syncs.

The native-token trap

To move tokens off a chain, you need a small amount of the chain's native gas token (ETH on Ethereum, BNB on BNB Chain, SOL on Solana, and so on) to pay the transaction fee. Many drainers leave dust but take all the gas, leaving you unable to move the valuable tokens. If that happens:

• Send a tiny amount of the native gas token into the compromised wallet, then immediately push the valuable token out. Some drainers run automated bots (called sweeper bots) that grab incoming gas within seconds, so this can fail.
• For badly infested wallets, specialist services exist that use a private transaction relay (sometimes called a Flashbots bundle) to fund gas and rescue the asset in the same atomic block so the sweeper cannot intercept it. Research these carefully; many "recovery" outfits are scams themselves.

Prioritize the highest-value assets first. If you have NFTs or staked positions, those often take extra steps and can wait until the liquid tokens are safe.

Moving your funds is not enough if the attacker still holds spending approvals. An approval is permission you granted (often unknowingly) that lets a contract move specific tokens out of your wallet on your behalf. Until you revoke it, the attacker can keep draining new deposits.

1. Go to a reputable revocation tool such as Revoke.cash or the token-approval checker built into a block explorer like Etherscan (look for the Token Approvals page).
2. Connect the affected wallet (read-only viewing is fine to start) and review every active approval.
3. Revoke anything you do not recognize, and especially any approval set to unlimited for a contract you do not trust.
4. Repeat this for every chain the wallet has touched: Ethereum, Arbitrum, Base, Polygon, BNB Chain, and others each track approvals separately.

Each revocation is its own on-chain transaction and costs a small gas fee. That is normal. Revoking does not undo past theft, but it slams the door on future automated draining. On Ethereum and other chains that support EIP-7702, check one more thing: an attacker may have left a malicious account delegation on your address, and revoking token approvals does not remove it. Revoke.cash lists active delegations in its Delegations tab, but you have to clear a delegation from inside your wallet app rather than from a dapp. Note the limit of this step: if your actual seed phrase or private key was stolen, revoking approvals does not protect you, because the thief controls the whole wallet directly. In that case, only abandoning the wallet works.

Understanding the attack helps you avoid the next one. Most wallet compromises fall into a few clear patterns, and almost all of them rely on tricking you into signing or revealing something.

Approval phishing

You visit a site that looks like a real airdrop, mint, or DeFi app. It asks you to "approve" or "enable" a token to continue. The approval transaction looks routine, but it grants a malicious contract permission to move your tokens. Later, a bot empties your wallet. You never gave away your seed phrase, yet the funds are gone.

Malicious signatures

Some attacks skip approvals entirely and ask you to sign a message. Dangerous ones include Permit and Permit2 signatures (gasless approvals) and the setApprovalForAll function for NFTs, which hands over an entire collection in one click. A signature request that you cannot read in plain language is a red flag.

Seed phrase theft

• Fake support and fake sites. A pop-up, ad, or DM directs you to a cloned wallet site that asks you to "restore" or "validate" your wallet by entering your 12 or 24 words.
• Malware and clipboard hijackers. Software that reads your screen, keystrokes, or clipboard. This is why a seed phrase stored in any digital file is at risk.
• Fake apps and browser extensions. Counterfeit wallets in app stores or extension stores that capture your phrase on setup.

The diagram below summarizes the most common drainer flow so you can recognize the moment you are being asked to sign away access.

This is the hardest truth in crypto, and it is better to hear it plainly than to chase false hope. On-chain transactions are irreversible by design. There is no central authority that can claw funds back the way a bank can reverse a card charge.

Almost never recoverable

• Funds already sent to the attacker's address. Once confirmed on-chain, they are gone unless the thief chooses to return them, which essentially never happens.
• Assets moved through a self-custody chain with no intermediary that can freeze them.

Sometimes recoverable or freezable

• Stolen funds that flow into a centralized exchange. Exchanges follow Know Your Customer and anti money laundering rules and can sometimes freeze an account if you report fast with transaction hashes. Speed is everything here.
• Certain stablecoins. Some issuers (for example USDC and USDT) can blacklist an address at the request of law enforcement, which freezes those specific tokens in the thief's wallet. This is rare and requires a real investigation.

Beware recovery scams

Within hours of a public report, fake "recovery experts," "crypto recovery hackers," and impersonators of real companies will contact you promising to get your money back for an upfront fee. This is a second scam targeting victims. No legitimate service guarantees recovery or asks for your seed phrase, remote access to your computer, or a payment before doing anything. Treat every unsolicited recovery offer as fraud.

Reporting will not usually get your money back, but it creates an official record, can help freeze funds at an exchange, and contributes to investigations that occasionally do lead to seizures. Report promptly and keep copies of everything.

• The exchange or platform involved. If you can trace stolen funds to a known exchange's deposit address (visible on a block explorer), contact that exchange's support and abuse channels with the transaction hashes immediately.
• Your national law enforcement / cybercrime body. In the United States, file with the FBI's Internet Crime Complaint Center at ic3.gov and consider the FTC fraud report. In the UK use Report Fraud, the service that replaced Action Fraud in December 2025 (in Scotland, call Police Scotland on 101). Other countries have equivalents; search for your national cybercrime reporting site.
• Tax and record purposes. Theft of crypto can have tax implications depending on your jurisdiction. Keep records for your accountant, and check your national tax authority for guidance.
• The wallet provider. Report the phishing site or fake app to your wallet maker and to the app store so others are protected.

When you report, include: your wallet address, the attacker's address, transaction hashes, timestamps, the chain involved, the approximate value, and how the compromise happened. Screenshots of the malicious site or message help.

If your seed phrase or private key was exposed in any way, that secret can never be made safe again. Changing a wallet password does nothing, because the password only unlocks the local app; the seed phrase is the master key to every account it controls, on every chain, forever.

What "exposed" means

• Typed or pasted into any website, form, chat, or support ticket.
• Stored in a screenshot, photo, cloud note, email, or synced password field.
• Present on a device that had malware, or copied through the clipboard while malware was running.

The clean-rebuild checklist

1. Generate a new seed phrase on a clean device. Ideally a freshly set up hardware wallet. Never import the old phrase "just to check."
2. Store the new phrase offline only, on paper or a metal backup, in a secure location. Never digitally.
3. Scan or wipe the compromised device for malware before using it for anything sensitive. If in doubt, reinstall the operating system.
4. Move forward, do not reactivate the old wallet. You may keep its public address for reference, but treat it as permanently burned.
5. Separate your holdings going forward. Use a hardware wallet for long-term savings and a small "hot" wallet for daily dApp use, so one bad signature cannot reach everything.

Going forward, slow down before signing anything, verify URLs character by character, bookmark the real sites you use, and treat any unsolicited offer or urgent prompt as a probable scam. Most drains succeed because the victim was rushed.