What to Do If Your Crypto Wallet Is Hacked: Complete Guide, Examples, Risks and Best Practices
A hacked crypto wallet is stressful because crypto transactions usually cannot be reversed like a credit-card chargeback. The good news is that fast, careful action can sometimes limit damage, protect remaining funds, and preserve evidence for exchanges, law enforcement, tax records, or insurance claims.
This guide explains what a wallet hack means, how wallet attacks usually happen, what to do in the first few minutes, when to revoke token approvals, how to report stolen crypto, and how to rebuild your security afterward.
1. Quick Answer: What Should You Do First?
- Stop using the compromised wallet. Do not connect it to more sites or sign more transactions.
- Check what was stolen using a trusted block explorer or your wallet’s official activity tab.
- Move any remaining assets to a brand-new wallet created on a clean device, if it is safe to do so.
- Revoke suspicious token approvals on affected chains, especially if tokens remain in the wallet.
- Contact relevant exchanges, bridges, wallet support, and law enforcement with transaction hashes and addresses.
- Do not trust anyone who guarantees they can recover your funds for an upfront fee. Recovery scams are common after crypto theft.
Figure 1: Simple crypto wallet hack response flow.
2. What Does It Mean for a Crypto Wallet to Be Hacked?
A crypto wallet is software or hardware that lets you control blockchain assets such as Bitcoin, Ethereum, stablecoins, NFTs, or tokens. The wallet does not usually “store” coins inside the app. Instead, it holds or protects the private keys that prove you can move funds from blockchain addresses.
When people say their crypto wallet was hacked, they usually mean an attacker gained the ability to move assets, trigger approvals, or trick the owner into signing a harmful transaction. Sometimes the wallet app itself was not technically hacked. The real cause may be a stolen seed phrase, malware on the device, a fake wallet app, a phishing website, a malicious smart contract approval, or social engineering.
2.1 Important Terms for Beginners
| Term | Simple meaning | Why it matters |
|---|---|---|
| Seed phrase / recovery phrase | A set of 12, 18, or 24 words that can restore the wallet. | Anyone with it can usually take your funds. Never type it into a website or share it with support. |
| Private key | A secret key that controls one crypto address. | If stolen, the address is compromised. |
| Public address | The visible wallet address people can send crypto to. | Safe to share, but it reveals activity on public chains. |
| Transaction hash / TXID | A unique ID for a blockchain transaction. | Needed for reports, exchange tickets, and tracing. |
| Token approval / allowance | Permission for a smart contract to move certain tokens. | A bad or unlimited approval can let a contract drain tokens later. |
| Cold wallet / hardware wallet | A wallet that keeps keys offline or on a separate device. | Safer for long-term storage when used correctly. |
3. How Crypto Wallet Hacks Usually Happen
Most wallet incidents fall into a few patterns. Understanding the cause helps you choose the right response.
| Attack type | What happens | Typical warning sign | Best immediate response |
|---|---|---|---|
| Seed phrase theft | You entered or exposed the recovery phrase. | A site, email, QR code, or “support agent” asked for the phrase. | Create a new wallet and move remaining funds immediately. Never reuse the old seed. |
| Malicious approval | You approved a contract that can spend tokens. | Funds leave after connecting to a dApp, mint site, airdrop, or fake claim page. | Revoke approvals and move remaining funds. |
| Malware or fake app | Malicious software steals keys, changes addresses, or reads clipboard data. | Unexpected wallet popups, copied addresses changing, fake browser extension. | Use a clean device, remove malware, then create a new wallet. |
| Exchange account takeover | The attacker gets into a centralized exchange account. | Login alerts, changed passwords, withdrawals you did not request. | Freeze account, reset passwords, rotate 2FA, contact exchange. |
| Social engineering | A scammer convinces you to send crypto or sign a transaction. | Promises, urgency, fake support, romance/investment pressure. | Stop communication, document evidence, report quickly. |
| Smart-contract exploit | A protocol you used is exploited. | Multiple users report losses from the same app or contract. | Follow official project updates, revoke approvals, avoid fake “refund” links. |
4. First 10 Minutes: Emergency Checklist
Act quickly, but do not panic-click. A second mistake can make the loss worse.
- Disconnect the wallet from websites. Close suspicious tabs and stop signing messages.
- Do not send more funds into the compromised wallet to “test” it.
- Open the wallet activity page or a trusted block explorer and copy transaction hashes, attacker addresses, token contract addresses, amounts, and times.
- If assets remain, prepare a new wallet on a clean device. Write down the new recovery phrase offline.
- Transfer remaining assets to the new wallet. Prioritize high-value assets first and leave enough native gas token only when required.
- Revoke token approvals on affected chains after or before moving funds, depending on the situation. If a drainer is actively watching the wallet, moving assets first may be safer.
- Change passwords for email, exchanges, cloud storage, password manager, and any account connected to the wallet.
- Report the incident to wallet support, exchanges, bridges, marketplaces, blockchain analytics tools, and law enforcement.
4.1 What Not to Do Immediately After a Hack
- Do not share your seed phrase with anyone, including people claiming to be wallet support.
- Do not pay “recovery agents” who guarantee results or ask for an upfront fee.
- Do not keep using the compromised wallet for new deposits.
- Do not delete messages, emails, browser history, or transaction data before saving evidence.
- Do not trust direct messages after posting publicly about the hack. Scammers monitor victims.
5. Should You Move Funds or Revoke Approvals First?
There is no single answer because wallet hacks have different causes. Use this comparison as a practical guide.
| Situation | Better first step | Reason |
|---|---|---|
| Your seed phrase or private key was exposed | Move funds to a brand-new wallet | Revoking approvals does not secure a seed phrase. The attacker can still sign transactions. |
| Only one suspicious token approval is visible | Revoke approval, then move funds if needed | The risk may be a contract allowance rather than full wallet compromise. |
| Tokens are actively being drained | Move high-value assets first if you can act safely | Speed matters, but use a clean device and avoid signing unknown prompts. |
| Device may be infected with malware | Stop, switch to a clean device, then create a new wallet | A new wallet on an infected device may also be compromised. |
| Exchange account was accessed | Freeze withdrawals and contact exchange first | The wallet may not be the issue; account security is. |
6. How to Check What Was Stolen
- Find your public wallet address in the wallet app.
- Paste it into a trusted block explorer for the relevant chain, such as Etherscan for Ethereum or a known explorer for the specific network.
- Review normal transactions, token transfers, NFT transfers, internal transactions, and approvals.
- Copy transaction hashes, attacker addresses, destination exchange deposit addresses if visible, token names, amounts, dates, and times.
- Take screenshots, but also save text data because screenshots alone can be hard to search later.
Tip: If the stolen funds moved to a centralized exchange deposit address, report it immediately to that exchange. Exchanges may not be able to reverse a blockchain transaction, but they may freeze accounts or preserve records if notified quickly and lawfully.
7. How to Revoke Token Approvals Safely
On smart-contract chains such as Ethereum, BNB Chain, Polygon, Arbitrum, Base, and similar networks, token approvals can let a dApp move certain tokens from your wallet. Disconnecting a wallet from a website is not always the same as revoking an on-chain approval. Revoking an approval usually requires an on-chain transaction and a gas fee.
- Use trusted tools only, such as your wallet’s built-in approval manager, Etherscan Token Approval Checker, or well-known approval-revoke tools.
- Check the exact chain. Approvals are chain-specific, so Ethereum approvals do not automatically cover Polygon or Base.
- Look for unlimited approvals, unknown contracts, old NFT marketplace approvals, and approvals created near the time of the incident.
- Revoke risky approvals one by one. Confirm the wallet prompt says you are revoking or setting allowance to zero.
- After revoking, refresh the page or check the explorer again to confirm the approval is gone.
Caution: if your seed phrase is stolen, revoking approvals is not enough. The attacker can still control the wallet. Use a new wallet.
8. How to Report a Hacked Crypto Wallet
Reporting rarely guarantees recovery, but it can help preserve evidence, flag attacker addresses, support exchange investigations, and strengthen your case if funds touch a regulated platform.
| Who to contact | When to contact them | What to provide |
|---|---|---|
| Wallet provider support | If the wallet app, extension, or hardware-wallet process may be involved. | Wallet address, transaction hashes, screenshots, device/app version, suspicious links. |
| Centralized exchange | If stolen funds came from or moved to an exchange. | TXIDs, wallet addresses, account email, times, police report if available. |
| NFT marketplace or DeFi protocol | If NFTs or protocol assets were involved. | Token IDs, collection links, wallet addresses, transaction hashes. |
| Local police or cybercrime unit | For theft, identity theft, large losses, or legal documentation. | Timeline, evidence folder, transaction data, communication records. |
| FBI IC3 (U.S.) or relevant national cybercrime portal | For U.S.-connected cybercrime or if you are in the U.S. | Detailed complaint with transaction info and scammer identifiers. |
| Blockchain abuse-reporting databases | To warn others and help investigators connect cases. | Attacker addresses, domains, social handles, transaction hashes. |
8.1 Evidence Checklist
- Your wallet address and all known attacker addresses.
- Transaction hashes for every suspicious transfer or approval.
- Exact date and time, including time zone.
- Screenshots and URLs of phishing websites, emails, text messages, social profiles, QR codes, or fake apps.
- Exchange account IDs or support ticket numbers.
- Device details, wallet app version, browser extension version, and operating system.
- A short timeline written in plain English.
9. Can Stolen Crypto Be Recovered?
Sometimes, but you should set realistic expectations. Blockchain transactions are generally final once confirmed. Recovery is more possible when stolen funds reach a centralized exchange, a bridge, a custodial service, or law enforcement can identify and freeze assets. It is much harder when funds move through mixers, cross-chain swaps, privacy tools, or many self-custody addresses.
| Recovery path | Pros | Limitations |
|---|---|---|
| Exchange freeze | Can stop funds if reported very fast and the exchange cooperates. | Requires timing, evidence, and often legal process. |
| Law enforcement investigation | Can subpoena records and coordinate with exchanges. | May take time; recovery is not guaranteed. |
| Blockchain tracing | Can map fund movement and identify exchange touchpoints. | Tracing does not equal recovery. |
| Civil legal action | May help in large cases with identifiable parties. | Can be expensive and jurisdiction-dependent. |
| Recovery service | May help with lost passwords or forensic documentation. | Many are scams; be cautious with upfront fees and seed phrase requests. |
Red flag: Anyone who says “send me a fee and I will definitely get your crypto back” is likely trying to victimize you again. Legitimate professionals will not need your seed phrase and should give clear scope, identity, contract terms, and limitations.
10. Real-World Scenarios and What to Do
10.1 Scenario 1: You Entered Your Seed Phrase on a Fake Website
A fake wallet-support page asked for your 12 or 24 words. Minutes later, tokens started leaving.
- Treat the entire wallet as permanently compromised.
- Create a new wallet on a clean device and move anything left.
- Do not import the old seed into a new app and continue using it.
- Report the phishing URL and attacker addresses.
10.2 Scenario 2: You Signed a Fake Airdrop or NFT Mint
You connected to a website that promised free tokens or a popular NFT mint. After signing, a token or NFT disappeared.
- Check approvals on the relevant chain.
- Revoke suspicious approvals.
- Move valuable remaining assets to a new wallet if you are unsure what you signed.
- Bookmark official project links instead of clicking links from social media ads or direct messages.
10.3 Scenario 3: Your Exchange Account Was Drained
You received login alerts or saw withdrawals from a centralized exchange account.
- Contact the exchange immediately and request account lock or withdrawal freeze.
- Reset email and exchange passwords from a clean device.
- Replace SMS 2FA with an authenticator app or hardware security key where available.
- Check email forwarding rules and API keys. Attackers often add hidden access.
10.4 Scenario 4: Your Hardware Wallet Funds Were Stolen
Hardware wallets are strong protection, but they cannot protect you if the seed phrase is exposed or if you approve a malicious transaction on the device.
- Assume the seed phrase may have been exposed if anyone saw, photographed, or typed it.
- Create a new seed phrase and move funds.
- Only enter the recovery phrase directly on the hardware device when restoring, not into websites, forms, or computer apps.
- Carefully read transaction details on the device screen before approving.
11. Common Mistakes That Make Wallet Hacks Worse
| Mistake | Why it is dangerous | Better action |
|---|---|---|
| Posting your wallet address and asking for help publicly | Scammers will message you pretending to be support. | Use official support channels and never share secrets. |
| Typing your seed phrase into “verification” pages | This gives full wallet control to attackers. | Only use the phrase to restore a wallet in a trusted app/device. |
| Reusing the compromised wallet | The attacker may still have access. | Start fresh with a new wallet and new seed phrase. |
| Ignoring token approvals | A contract may continue draining tokens later. | Review and revoke risky approvals regularly. |
| Keeping seed phrases in cloud notes or screenshots | Cloud accounts can be hacked or synced to compromised devices. | Use offline backups stored securely. |
| Using SMS-only two-factor authentication | SIM-swap attacks can bypass it. | Use authenticator apps or hardware security keys where possible. |
12. Best Practices to Protect Your Crypto Wallet Going Forward
12.1 For Everyday Users
- Use a separate wallet for experimenting with new dApps and keep only small amounts there.
- Keep long-term holdings in a hardware wallet or other cold-storage setup.
- Never share your recovery phrase, private key, wallet file, or screen during support chats.
- Download wallet apps only from official websites or verified app stores.
- Bookmark trusted websites instead of clicking ads, social links, or search-result lookalikes.
- Use strong unique passwords and a password manager.
- Turn on phishing-resistant 2FA for exchanges and email.
- Keep your operating system, browser, wallet extension, and hardware-wallet firmware updated.
- Test with a small transaction before moving large amounts.
- Review token approvals monthly or after using new dApps.
12.2 For Larger Holdings
- Split funds by purpose: spending wallet, DeFi wallet, NFT wallet, long-term vault.
- Use a hardware wallet for the vault and avoid connecting it to unfamiliar dApps.
- Consider multi-signature wallets for business, family, or high-value treasury funds.
- Store backups in multiple secure physical locations, protected from fire, water, theft, and accidental discovery.
- Create an inheritance or emergency-access plan that does not expose the full seed phrase to one person unnecessarily.
13. Hot Wallet vs Cold Wallet: Which Is Safer?
| Wallet type | Best for | Pros | Cons |
|---|---|---|---|
| Hot wallet | Small balances, daily use, DeFi, NFTs | Convenient, fast, easy to connect to apps. | More exposed to phishing, malware, and bad approvals. |
| Hardware/cold wallet | Savings, long-term holdings | Private keys stay offline or isolated; stronger protection. | Costs money, requires careful setup, still vulnerable to seed theft and bad signatures. |
| Custodial exchange wallet | Trading and fiat on/off-ramp | Password recovery, support, sometimes fraud controls. | You rely on the exchange; account takeover and platform risk. |
| Multi-signature wallet | Businesses, teams, high-value funds | Requires multiple approvals; reduces single point of failure. | More complex; mistakes in setup can be costly. |
14. Misconceptions About Hacked Crypto Wallets
- “My wallet app can reverse the transaction.” Usually false. Wallet apps broadcast transactions; they generally cannot reverse confirmed blockchain transfers.
- “Disconnecting a website removes all risk.” Not always. You may also need to revoke on-chain approvals.
- “A hardware wallet makes scams impossible.” False. It protects private keys, but you can still sign a bad transaction or reveal the seed phrase.
- “If I know the thief’s wallet address, I can get the money back.” Not by yourself. An address is not automatically a real-world identity.
- “Recovery services are always scams.” Some legitimate professionals exist for password recovery or forensic tracing, but guaranteed recovery claims and upfront-fee promises are major red flags.
15. Beginner-Friendly Incident Response Template
Copy and fill this out before contacting support, exchanges, or authorities:
| Field | What to write |
|---|---|
| Your name and contact | Name, email, phone if required by the reporting body. |
| Wallet address | The affected public address. |
| Date/time discovered | Include time zone. |
| Estimated loss | Token names, amounts, and approximate fiat value at time discovered. |
| Transaction hashes | List each suspicious TXID. |
| Attacker addresses | Destination addresses, if visible. |
| How it happened | Seed phrase phishing, fake website, approval, malware, exchange takeover, unknown. |
| Evidence links | Screenshots, URLs, emails, chats, app names, domains. |
| Actions taken | Moved funds, revoked approvals, contacted exchange, filed report. |
| What you need | Freeze funds, investigate, preserve records, confirm account lock, etc. |
16. FAQ: Hacked Crypto Wallets
16.1 What is the first thing I should do if my crypto wallet is hacked?
Stop using the wallet, do not sign anything else, document suspicious transactions, and move any remaining funds to a brand-new wallet created on a clean device if it is safe to do so.
16.2 Can a wallet provider recover stolen crypto?
Usually no. Wallet providers often do not control blockchain transactions or private keys. They may help you understand what happened, warn other users, or guide you through safety steps.
16.3 Is it safe to keep using the same wallet after a hack?
If the seed phrase or private key may be exposed, no. Treat the wallet as permanently compromised and create a new one.
16.4 What is the difference between revoking approvals and moving funds?
Revoking approvals cancels a smart contract’s permission to move certain tokens. Moving funds transfers assets to a different wallet. If your seed phrase is stolen, you need a new wallet, not just revoked approvals.
16.5 Do I need to report a small crypto theft?
It is still useful to report. Small reports can help connect cases, flag addresses, and build evidence against repeat scammers.
16.6 Should I hire a crypto recovery company?
Be extremely careful. Avoid anyone who guarantees recovery, asks for your seed phrase, pressures you, or demands an upfront fee. For large losses, consider legal counsel or reputable forensic specialists with verifiable credentials.
16.7 Can I get hacked just by sharing my public wallet address?
Usually no. A public address is meant to be shared. But it can reveal your balances and transaction history, which may attract scammers or targeted phishing.
16.8 Why did my wallet show a confusing signature request?
Some scams use signatures that look harmless but grant dangerous permissions or authorize transfers. Do not sign messages you do not understand, especially from unfamiliar websites.
16.9 How often should I revoke token approvals?
Review approvals after using new dApps and on a regular schedule, such as monthly. Revoke approvals you no longer need, especially unlimited approvals.
16.10 What is the safest wallet setup for beginners?
Use a reputable hot wallet only for small amounts and learning. Keep larger holdings in a hardware wallet, protect the recovery phrase offline, and use a separate “burner” wallet for risky dApps.
17. Final Takeaway
If your crypto wallet is hacked, the goal is not to repair the old wallet. The goal is to contain the damage, secure remaining assets, preserve evidence, report quickly, and rebuild with safer habits. The most important rule is simple: if the recovery phrase or private key may be exposed, create a new wallet and never reuse the old one.
Sources Consulted and Checked
These sources were consulted while preparing and checking this document for accuracy.
Federal Trade Commission (FTC): What To Know About Cryptocurrency and Scams
FBI Internet Crime Complaint Center (IC3): Cryptocurrency guidance and reporting
FBI IC3: Guidance for Cryptocurrency Scam Victims
FBI IC3: Recovery-service scam warning
MetaMask Support: Unauthorized transactions and compromised wallets
MetaMask Support: Revoking token approvals
Ledger Support: Recovery phrase safety
Etherscan Token Approval Checker
Revoke.cash: Token approval revocation tool
SEC Investor Resources and crypto investor alerts
Reader Advice
This article is provided for educational and informational purposes only. It is not personalized legal, financial, tax, investment, cybersecurity, or crypto-recovery advice, and it does not guarantee that stolen assets can be recovered. Crypto transactions, wallet tools, exchange procedures, reporting requirements, risks, laws, policies, rules, and statistics can change over time and may vary by country, region, blockchain, platform, and individual circumstances. Before acting, verify current information through official wallet, exchange, regulator, law-enforcement, and government sources, and consider qualified professional advice where the loss, security risk, identity theft, tax impact, or legal issue is significant. Never share a seed phrase or private key, and be cautious of anyone promising guaranteed recovery or requesting upfront payment.