Recovering From a Compromised Wallet

Discovering that a wallet has been compromised is frightening. Tokens disappear, unknown transactions appear, or an NFT collection is suddenly gone. Attackers often keep watching a compromised wallet and sweep any new funds that arrive. Acting quickly and in the right order can save remaining assets and prevent further losses.

Figure out what kind of compromise it is

The response depends on how the attacker got access:

Type	Signs	What the attacker can do
Seed phrase or private key exposed	Transfers you did not sign, across many tokens	Anything, at any time
Malicious approval	Specific tokens taken through a contract	Move approved tokens until revoked
Malicious signature such as a permit	Tokens moved without an approval transaction	Use that signature until it expires or is used
Device malware	Changed addresses, fake prompts, stolen files	Depends on what the malware captured
Exchange account takeover	Withdrawals from exchange account	Withdraw funds held on the exchange

If you are unsure, assume the worst case: the seed phrase is exposed.

The first hour

Work through these steps quickly:

1. Use a clean device. If malware is possible, avoid using the compromised computer or phone.
2. Create a new wallet on a clean device or a new hardware wallet. Record the new seed phrase offline.
3. Move remaining assets from the compromised wallet to the new wallet, prioritising the most valuable.
4. Revoke approvals if the compromise came from an approval and the seed phrase is safe.
5. Stop sending funds to the compromised address, including gas top-ups, which attackers often sweep automatically.
6. Record everything: transaction hashes, times, suspicious sites and messages.

If the attacker is sweeping every incoming gas payment, moving assets can be difficult. Some advanced recovery methods bundle gas funding and transfers in a single private transaction, but they require technical expertise and trustworthy help.

Beware of recovery scams

Victims attract a second wave of scammers. Fake "recovery experts", hackers-for-hire and support agents contact victims promising to recover stolen funds for a fee. Almost all are scams.

Legitimate help does not arrive through unsolicited DMs, does not require upfront payment and never asks for your seed phrase.

Find the cause

Understanding how the compromise happened prevents repeat incidents:

• Did you sign something on an unfamiliar site recently?
• Did you enter a seed phrase anywhere?
• Did you download software, extensions or files from unknown sources?
• Did you store the seed phrase digitally, such as in photos, notes or cloud storage?
• Did anyone have physical access to backups?

Check recent approvals and signatures on a block explorer. Scan devices for malware or reset them completely before using them again for crypto.

Report the theft

Reporting rarely recovers funds, but it can help:

• Report to exchanges if stolen funds were sent there, with transaction hashes
• Report to stablecoin issuers, who occasionally freeze stolen tokens
• File a report with local law enforcement for records and possible investigations
• Report phishing domains to wallet providers and browser safe browsing services
• Warn communities if a project was impersonated

Rebuild safely

After securing what you can:

• Use a hardware wallet for significant holdings
• Keep a separate low-value wallet for new sites and experiments
• Store seed phrases offline only
• Review signing habits and read every prompt carefully
• Consider multisig for larger amounts

Abandon the compromised wallet permanently, even if it appears quiet. Attackers often keep monitoring it for months.

Look after yourself

Losing funds can be emotionally hard. Talk to people you trust, and remember that sophisticated attacks catch experienced users too. Sharing your story, without sensitive details, often helps others avoid the same trap.

Update official information if you run a project

If a project wallet was compromised, update treasury addresses everywhere and explain the change publicly. Consistent new addresses across your website, docs and profiles such as a Proud Globe pin help your community avoid sending anything to the old, compromised wallet.