Suspected Wallet Compromise: A Practical Incident-Response Guide
Published · GetBestWallet editorial
Separate a malicious approval from a leaked recovery phrase and prioritize the right containment steps.
Key takeaway
The response depends on whether a malicious permission or the signing credentials were exposed. Stop interacting with the suspicious site, preserve public transaction evidence and avoid repeatedly funding an account that may be swept.
Stop interacting and preserve evidence
Close the suspicious page, stop signing requests and record transaction hashes, affected addresses, networks and the time of the incident. Use a trusted device to investigate. Do not post secret material in a support ticket. Determine whether the problem is a misleading interface, an unauthorized transfer, a malicious permission or a compromised recovery secret.
If the recovery phrase or key was exposed
Assume the attacker may control every account derived from that secret, not just the asset first affected. Create fresh credentials in a trusted environment and plan to move remaining assets there. Changing the app password or making a new account under the same phrase does not revoke the attacker’s access. Existing staking, locked positions or contract-based holdings may need separate handling.
If the issue is a spending permission
Identify the exact token, network and spender. A malicious allowance may be revocable from a trusted interface, but revocation must confirm before it protects against future use. Other signatures, NFT operator permissions or smart-account modules can require different remedies. Revoking approvals does not secure an exposed key, and disconnecting a DApp is not an on-chain revocation.
Avoid feeding an active sweeper
An attacker can automate the removal of native currency as soon as it arrives. Repeatedly adding gas without understanding the situation can create further losses. Complex cases involving locked assets or automated draining may require experienced incident-response help. Verify that help independently, agree on scope and never surrender secrets to a stranger claiming guaranteed recovery.
Secure the surrounding accounts
Review device malware risk, browser extensions, email access and cloud backups. For custodial accounts, contact the provider through its official channel and request available controls. Keep public transaction evidence for a report where appropriate. On-chain transfers generally cannot be reversed by wallet support; recovery depends on the actual mechanism and recipient. After containment, replace compromised backups and document the cause so the same authorization mistake is not repeated.