What to Do If Your Crypto Wallet Is Compromised

If your crypto wallet is compromised, minutes matter. Learn how to tell what was exposed, move what is left safely, document the theft and report it.

Step one: work out what was actually compromised

“My wallet got hacked” can mean very different things, and the right response depends on which one happened. Take two minutes to diagnose before you act, because the fix for a leaked recovery phrase is different from the fix for a bad approval.

If you can’t tell which one applies, assume the worst case, a leaked recovery phrase, and act accordingly.

The first 10 minutes: move what’s left

When a recovery phrase or private key is exposed, the attacker can act at any moment, so speed matters more than anything else.

1. Stop using the compromised device for crypto. If malware caused the leak, anything you create or type there can leak too.
2. Create a brand-new wallet on a device you trust, ideally a hardware wallet, with a freshly generated recovery phrase. A new account inside the old wallet doesn’t count, because it comes from the same leaked phrase.
3. Move the remaining assets to the new wallet, most valuable first. Keep enough of the network’s native coin to pay the fees, and move that coin last.
4. Never send funds to the compromised address, not even a little gas to rescue stuck tokens. Whoever holds the key can take it the moment it arrives.

Example: After a phishing signature, a wallet still holds 1.28 ETH (hypothetically $3,200 at $2,500 per ETH), Token X worth $1,150 and Token Y worth $90, with fees at 12 gwei. Each token transfer uses about 65,000 gas: 65,000 × 12 gwei = 0.00078 ETH, or $1.95. The final ETH transfer uses 21,000 gas: 0.000252 ETH, or $0.63.

Moving everything costs about $1.95 + $1.95 + $0.63 = $4.53 to protect $4,440, roughly 0.1% of the value. Even Token Y is worth moving, since its fee is about 2.2% of its value. The order matters: send the ETH first and you would have nothing left to pay for the token transfers. Estimate your own numbers with our gas fee calculator, and skip only assets worth less than the fee to move them.

When the problem is an approval, not your phrase

If only certain tokens were drained after you signed something, the likely cause is a token approval or permit you granted to a malicious spender. Your recovery phrase may be fine.

Revoke the risky approvals from a trusted device, using the process in how to review and revoke token approvals. Using the same example prices, revoking six approvals at about 46,000 gas each costs 276,000 gas × 12 gwei = 0.003312 ETH, or about $8.28. Alternatively, move the affected tokens to a fresh wallet, which protects them from every approval at once. The patterns behind these drains are explained in crypto drainers and phishing sites.

Warning: If you aren’t sure whether a signature exposed only one token or your whole wallet, treat it as a phrase compromise. Moving to a new wallet costs a few dollars; guessing wrong can cost everything.

The first hour: lock down your accounts

• Secure your email first, since password resets for everything else go there. Change the password and review recovery settings.
• Contact any exchange involved through its official website or app, never through a number or link someone sends you. The FTC’s advice for crypto payments is to contact the exchange immediately, tell it the transaction was fraudulent and ask for a reversal.
• Upgrade two-factor authentication to an authenticator app or security key, as explained in two-factor authentication for crypto accounts.
• Check your phone account for unexpected changes, such as a SIM you didn’t request.

The first day: document and report

Reports are far more useful with precise details. The FBI’s IC3 asks crypto fraud victims for the cryptocurrency addresses, the amounts and types of cryptocurrency, the transaction hashes, and the dates and times of the transactions, plus how the scammer contacted you, the websites involved and any phone numbers.

Put all of that in one document along with screenshots, then report it:

• United States: the FBI’s IC3 at ic3.gov and the FTC at ReportFraud.ftc.gov.
• England, Wales and Northern Ireland: Report Fraud at reportfraud.police.uk or 0300 123 2040. It replaced Action Fraud on 4 December 2025.
• Scotland: Police Scotland on 101.
• Elsewhere: your local police, plus any exchange that sent or received the funds.

Our guide on how to report a crypto scam covers more countries and agencies.

The first week: rebuild on a clean foundation

Wipe and reinstall, or replace, any device that may be infected before you create more wallets on it. Retire the compromised recovery phrase completely: destroy the old backups once your funds are safely moved, and write down the new phrase using the storage advice in seed phrase security.

Then find the root cause. Did you type your phrase somewhere, approve a request you couldn’t read, or install something unfamiliar? Fixing that habit matters as much as the new wallet.

Watch for the second scam

After a theft, you may be contacted by people who claim they can trace and recover your funds. The IC3’s advice is blunt: “Be wary of cryptocurrency recovery services, especially those charging an up-front fee.” No one can reverse a blockchain transaction for a fee, and no genuine agency will ask for your recovery phrase.

Once things are stable, work through the crypto wallet security checklist to close the gaps that let this happen.

The bottom line

Diagnose what leaked, then move what’s left to a new wallet with a new recovery phrase, tokens first and the fee-paying coin last. Secure your email and exchange accounts, record every address, hash and time, and report to the right agency. Treat anyone who offers to recover your crypto for a fee as the next scam.

This content is for education only and is not financial, investment, tax or legal advice. Crypto assets are volatile and you can lose money. Examples use hypothetical numbers. See our disclaimer and editorial policy.