What to Do If Your Crypto Wallet Gets Drained

If your crypto wallet gets drained, that transfer cannot be reversed. But the theft is usually not finished, because whatever let the attacker in is still there. So the first job is not to chase the money. It is to move anything that is left to a brand-new wallet, and then work out which door was open.

Why a drained wallet stays dangerous

Think of a key somebody photographed. In crypto you cannot change the lock, because the key and the address are the same thing. You move house instead. Make a fresh wallet in MetaMask, Phantom or a Ledger, with a new seed phrase generated on a device you trust, and send the remaining tokens there. Do not tidy up the old one and carry on using it. Thieves often leave a bot watching a robbed address, and it empties any new deposit within seconds.

How did they get in?

There are really only two doors. The first is your seed phrase: those 12 or 24 words went into a website, a support chat, a fake wallet app or a note in the cloud that somebody read. If that is what happened, every account in that wallet is lost, including ones you never used.

The second door is an approval, a signature you once gave a website that lets its contract move one of your tokens for you. That door is narrower, and it can be shut. Open an approval checker such as Revoke.cash, connect the affected wallet and cancel every permission you do not recognise. If one token vanished while your ether sat untouched, this is almost certainly what happened.

What can still be done about the money

Open a block explorer such as Etherscan or Solscan, find the theft and copy two things: the transaction hash and the address that received the funds. Follow that address. If the coins land at a named exchange like Binance or Coinbase, email that exchange's support with the hash and the timestamp. An exchange can freeze an account, and that is the one realistic recovery path that exists.

Then stop, and be careful who you talk to. Within hours of a public theft, replies and direct messages arrive from people offering to recover the funds for a fee. They are the second robbery, and not one of them is worth a reply. If you are not yet sure you were robbed, read what to do if you think your wallet has been compromised; if you are, filing an IC3 report is the next step.