What to Do If Your Crypto Wallet Is Hacked
Ashir researches and writes about crypto self-custody and security at CryptoBeacon, helping readers understand how to safely store and manage their digital assets.
If this is happening right now: don't read top-to-bottom. Jump to "Act Now" immediately.
Every minute matters when a wallet drainer is active.
A compromised crypto wallet is one of the few online security incidents where the damage can be permanent and instantaneous. Unlike a bank fraud incident — where your bank can reverse a transaction — blockchain transfers are final. Once funds leave your wallet to an attacker's address, they are gone unless you can trace them to an exchange that cooperates with law enforcement.
This guide is structured by urgency, not by topic. Skip the sections that aren't relevant to your timeline.
This article is for educational purposes only and is not legal or financial advice.
Emergency Action Plan — By Urgency
Do not try to 'rescue' funds by sending more ETH for gas. Attackers often run automated drainer scripts that will immediately sweep any ETH you send in. Interacting with the wallet can make things worse.
If the wallet still has assets the attacker hasn't drained yet, move them to a brand-new wallet (one you've never used before, on a different device if possible). Use the fastest, cheapest gas setting to front-run the attacker's sweep transaction.
Go to revoke.cash, connect the compromised wallet as read-only, and revoke all approvals. This stops drainer contracts that have been granted unlimited spending rights from continuing to pull tokens.
In MetaMask: Settings → Connected Sites → disconnect all. In Rabby: check each site's permissions. This limits the attacker's ability to request further signatures from apps that remember your wallet.
Check your browser extensions for recently installed unknown extensions. Look for clipboard hijackers, keyloggers, or any software you recently downloaded. If your seed phrase was ever stored digitally, assume it was exposed.
If you suspect malware on the device used with the compromised wallet, do not use it for crypto again until it has been fully wiped and reinstalled. Using the same device is how people get hacked a second time.
Check the blockchain explorer to trace where funds went. If they landed at a centralized exchange address (Coinbase, Binance, Kraken), file a report with that exchange's fraud team immediately. Exchanges can freeze accounts pending investigation.
Screenshot your wallet address, transaction hashes, timestamps, and the addresses funds were sent to. Save these. In several countries, crypto theft can be pursued legally if the attacker's identity is later identified.
In the US: IC3.gov (FBI Internet Crime Complaint Center). In the UK: Action Fraud. In the EU: Your national cybercrime unit. Recovery is rare, but reports build a paper trail that helps law enforcement track serial attackers.
Your next wallet should be a hardware wallet (Ledger, Trezor, or Coldcard). Software wallets are convenient but remain vulnerable to the malware and phishing attacks that likely caused this compromise.
How did your seed phrase get exposed? Was it a phishing site, a malicious browser extension, a malware download, or a seed phrase stored in your email? Fix the root cause — not just the symptom.
Can I Recover Stolen Crypto?
Bluntly: rarely. Blockchain transactions are irreversible by design. The scenarios where recovery is possible are narrow: the attacker sent funds to a centralized exchange (where their KYC identity might be known), law enforcement gets involved quickly and the exchange cooperates, or a vulnerability in a smart contract is used and a white-hat counter-exploit recovers funds before the attacker can move them.
Most successful drainer attacks move funds through multiple wallets and mixers within minutes of the initial theft. The window for intervention is extremely short. The best defense is prevention — the actions above are damage control after the fact.
Disclaimer
This article is for informational and educational purposes only. It is not legal advice. If you believe you are the victim of a crime, consult a legal professional and contact law enforcement.