Crypto Wallet Hacked or Drained? 10 Things to Do Right Now

A drained wallet is an emergency with a short useful window. You cannot claw the transaction back, but you can stop the rest from following it. Work down this list in order — the first three matter most, and the whole thing takes under an hour.

The ten steps, in order

1. Make a new wallet. A fresh seed phrase on a device you trust — a Ledger if you have one.
2. Move what is left. Tokens and NFTs out of the old wallet, keeping just enough ether or SOL for fees.
3. Revoke approvals. Connect the drained wallet to Revoke.cash and cancel every permission you do not recognise.
4. Disconnect the sites. In MetaMask or Phantom, clear the list of connected websites.
5. Screenshot everything. Balances, the messages that led you here, the site you signed on.
6. Copy the transaction hashes. From Etherscan, Solscan or the explorer for that chain, with times and amounts.
7. Follow the money one hop. If it reaches Binance, Coinbase or another named exchange, note the address.
8. Email that exchange. Hash, timestamp, amount. Exchanges can freeze accounts, and only they can.
9. Clean the device. Remove unfamiliar browser extensions, scan for malware, change your email password and two-factor.
10. File the report. With the police and, in the US, with the FBI's IC3.

What makes it worse

Three things, reliably. Reusing the old wallet because a small balance came back — thieves leave bots on robbed addresses and take new deposits within seconds. Paying anyone who offers to recover your coins, since almost all of them are the same crew coming back for the rest. And signing something new while rattled, which is how a partial loss becomes a total one.

Once the list is done, put it down for the night. Then read what to do if your wallet gets drained for the longer explanation of how the two kinds of theft differ, and how to file an IC3 report when you are ready to write it up.