What to Do If You Think Your Crypto Wallet Has Been Compromised

If you think your wallet has been compromised, act as though it has. Moving your coins to a new wallet costs a few dollars in fees and twenty minutes; being wrong the other way costs everything in it. Treat the suspicion like a smoke alarm at night. You leave the building first and find out it was the toast afterwards.

What counts as a real warning sign?

Some things genuinely mean trouble: a transaction you did not make, a token approval you do not remember granting, your seed phrase typed into any website or support chat, a wallet app installed from a link rather than the official store, or a hardware wallet that arrived already set up with a phrase printed in the box. Getting an unexpected token or NFT in your wallet is not a sign of compromise — anyone can send you anything, the same way anyone can post you a letter. Just never interact with it.

How to check without making things worse

Look, do not click. Paste your address into a block explorer such as Etherscan or Solscan and read the outgoing transactions: anything leaving that you did not authorise is your answer. Then open an approval checker such as Revoke.cash and see which contracts currently have permission to move your tokens. Do this in a normal browser tab you typed yourself. Do not follow links from a message about your wallet, and do not download any "wallet checker" tool — that is a common way people turn a scare into an actual theft.

Move first, investigate later

If anything on that list applies, create a new wallet with a fresh seed phrase and move the funds. This is not optional when the seed phrase may have leaked, because revoking approvals does nothing at all against somebody who holds the words. Afterwards, clean up the device: remove browser extensions you did not choose, scan for malware, and change your email password, since email is the key to most of your other accounts.

The habit that keeps this rare is boring but works: keep long-term holdings in a hardware wallet you never connect to websites, and use a small separate wallet for anything experimental. If it turns out the funds are already gone, what to do if your wallet gets drained covers the next hour, and the ten-step checklist keeps you in the right order.