My Crypto Wallet Got Drained — What Should I Do Now?

Do these four things, in this order: move whatever is left, cut off the access, save the evidence, then report it. The order matters more than the speed. It is like a fire — you get everyone out of the building first and ask how it started afterwards, because the thing that caused it is still burning while you investigate.

The first ten minutes

Create a brand-new wallet with a new seed phrase, on a device you have reason to trust. If you own a Ledger or a Trezor, use it. Send everything the old wallet still holds to the new one, valuable tokens and NFTs first. Do not send the last of your ether or SOL away, since you need a little to pay the fee for the transfers. Unstake nothing yet and swap nothing yet; just move.

The next hour: cut the access

Now close the doors. Open Revoke.cash or a similar approval checker, connect the emptied wallet, and cancel every token permission you do not recognise. Disconnect the wallet from every site in MetaMask's connected-sites list. Then sweep the machine itself: uninstall browser extensions you did not deliberately add, run a malware scan, and change the passwords and two-factor settings on your email and your exchange accounts, because those are often the next target. If your seed phrase was ever typed into a website or stored in a notes app, treat the old wallet as permanently public and never use it again.

Before the day is over

Write down what happened while it is fresh: the transaction hashes from Etherscan, the address that received your coins, the amounts and the exact times, plus the link, message or app you interacted with before it happened. Send that to your exchange if the funds arrived at one, and file it with the authorities — filing an IC3 report takes about twenty minutes.

Then give yourself a night before doing anything else. Nearly every bad decision after a theft — paying a recovery service, signing a second thing in a panic, buying back at any price — happens in the first few hours. Our ten-step checklist is worth keeping open while you work through it.