If a seed phrase or private key was exposed, treat that wallet as permanently compromised. On a clean, updated device, create a new wallet with a new recovery phrase, move every remaining asset to it, revoke suspicious token approvals, secure the device and linked accounts, preserve transaction evidence, and report the crime. Stop sending money immediately: additional “taxes,” unlock fees, or recovery payments almost never make a withdrawal possible and can create a second loss.
What to do in the first hour
Speed matters, but do not rush so carelessly that you destroy evidence or hand another scammer your credentials. Work through this order.
As an Amazon Associate I earn from qualifying purchases.
- Stop all payments and replies. Disconnect from the scammer’s chat, stop sending cryptocurrency, and ignore instructions to pay a tax, validation charge, gas deposit, or “release fee.” The FBI’s Operation Level Up guidance tells victims to stop sending money and report promptly. Do not hire a service that promises guaranteed recovery.
- Preserve evidence before closing accounts. Save screenshots and export messages while they are still available. Write down the wallet address, blockchain network, asset, amount, date and time, transaction hash, exchange username, suspicious URL, phone number, and any email headers. The FBI identifies the address, amount and type of asset, date and time, and transaction ID or hash as the most important transaction information.
- Use only official support channels. Open the exchange, wallet provider, or cryptocurrency ATM operator’s website by typing its known address or using an application you installed previously. Use the contact method shown there—not a number from a message, search advertisement, social-media account, or pop-up. Ask whether the provider can freeze an account, flag a destination address, or preserve logs.
- Contain the technical access. If a computer or phone may have been controlled, stop using it for wallet operations. Disconnect it from networks if malware or remote access is suspected, then use a different clean device for urgent wallet creation and account changes.
- Report quickly. File a report with the FBI’s Internet Crime Complaint Center (IC3.gov) and the relevant local law-enforcement agency. Report consumer fraud to the Federal Trade Commission when the circumstances fit its reporting system. A report cannot guarantee reimbursement, but prompt, precise records give investigators useful intelligence and may help connect related cases.
Decide whether the wallet itself is compromised
Approval theft and full-key compromise require different responses. A visible transfer does not by itself prove that the seed phrase was stolen, but you should assume the worst if you entered the phrase or private key into a website, sent it to anyone, stored it in an exposed file, or used a device with suspected malware.
Free tools Windows power users keep installed
One-click scans. No signup required.
| What happened | Risk assessment | Required response |
|---|---|---|
| Seed phrase or private key was typed, photographed, copied, emailed, or shown to another person | The attacker can recreate the wallet and sign transactions without your device | Create a new wallet on a clean device and transfer all remaining assets immediately; never reuse the old phrase |
| A malicious dApp received a token allowance, but the signing key was not exposed | The contract may spend the approved token amount under its delegated permission | Revoke suspicious approvals, then review balances and activity; migrate funds if key exposure is possible |
| An exchange, email, or phone account was taken over | An attacker may reset wallet or exchange access and intercept alerts | Recover the account through its official process, change credentials from a clean device, enable strong MFA, and review sessions and withdrawal settings |
| A scammer only requested payment or personal details, with no wallet signing or account login | Funds may not yet have moved, but credentials could be targeted next | Stop contact, change any reused passwords, monitor accounts, preserve messages, and report the attempt |
If your seed phrase or private key leaked
A recovery phrase is not a password that can be changed. Anyone who has it can derive the same wallet and sign transactions. The Singapore Police Force states that when a seed phrase is compromised, you should transfer all remaining assets to a new, uncompromised wallet immediately. A hardware wallet can reduce future online exposure, but it cannot make an exposed phrase safe again.
#1 Best Overall
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Create the replacement wallet safely
- Use a device that is updated, free of untrusted software, and not being remotely controlled. If you cannot establish that, use another device or perform a clean reinstall before initializing the wallet.
- Obtain wallet software or hardware directly from the maker or an authorized seller. Inspect packaging and download sources, and refuse a device that arrives initialized or includes a preprinted recovery phrase.
- Initialize the wallet yourself so it generates a new phrase. Write the words down offline in the order shown. Do not photograph them, place them in cloud storage, paste them into notes, or enter them into a website.
- Verify the new receiving address on the wallet’s trusted display or confirmation screen, not only in a computer clipboard. Clipboard-changing malware can substitute an attacker’s address.
- Send a small test amount if the network and fees make that practical. Confirm the destination and receipt on the blockchain before sending the rest.
- Transfer every remaining asset and every relevant network account from the old wallet. Include tokens, collectibles, and assets on other chains controlled by the same phrase. Leave only an amount needed for network fees until the migration is complete.
- After funds arrive, stop using the old wallet. Do not “test” it by sending funds back, and do not import its phrase into the replacement device.
Handle network fees and assets carefully
A token transfer may require the network’s native asset for a transaction fee. If the old wallet contains tokens but no fee asset, fund the wallet only with the minimum necessary amount from a trusted source, then transfer the tokens and remove the fee balance. Check the network name and token contract carefully; an address on one network is not automatically usable on another. When a wallet or exchange offers a network selector, choose the network that matches both the receiving wallet and the asset.
If an attacker is actively draining the wallet, adding funds can simply give the attacker more fees. In that case, do not experiment with repeated transfers. Preserve the transaction data and ask the wallet provider or a qualified incident-response professional—contacted through an independently verified channel—for narrowly scoped help. Never disclose the seed phrase while seeking assistance.
Revoke malicious dApp connections and token approvals
Connecting a wallet to a decentralized application and signing an approval can authorize a smart contract to spend a specified token allowance later. Disconnecting the website alone may not cancel that allowance. The Singapore Police Force and the European Banking Authority advise reviewing and revoking suspicious token approvals through the wallet interface or a reputable blockchain explorer.
Revocation procedure
- Open the wallet’s built-in connected-app or approval view, or navigate to a reputable explorer by entering its address yourself.
- Select the exact network and wallet address involved. A separate approval list exists for each chain.
- Identify contracts and allowances you do not recognize, no longer use, or that were associated with the scam. Check the token and spender address rather than relying on a familiar logo.
- Submit a revoke transaction and confirm the spender address and fee on the wallet’s trusted screen. Revocation itself consumes network fees.
- Check the allowance again after the transaction confirms. Repeat on every affected network and for every affected token.
Revocation stops a delegated contract from using that allowance; it does not reverse transfers already made, return stolen assets, or repair an exposed private key. If the key or phrase may have leaked, complete the wallet migration even after all approvals show zero.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of cards, no known remote hacks.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Secure the device, email, exchange, and password manager
An attacker who returns through a compromised computer or account can steal a newly created wallet just as easily as the old one. Perform these changes from a clean device whenever possible.
Computer or phone
- Install operating-system, browser, and legitimate security-software updates. Run a full malware scan and remove detected remote-access tools, credential stealers, and browser extensions you did not install deliberately.
- Review installed applications, browser extensions, startup items, accessibility permissions, and remote-management profiles. Remove unknown entries and restart before creating or using the replacement wallet.
- Encrypt the computer, phone, removable drives, and sensitive files. Keep a backup on a secure external device or a vetted cloud service, protected by a separate strong credential.
- Do not install “wallet recovery” software sent by a stranger or grant screen-sharing access to unsolicited support.
Email, exchange, and password manager
- Change passwords from the clean device. Make each one unique and long; change any other account that reused an exposed password.
- Enable multifactor authentication. An authenticator application or a hardware security key is generally preferable to text messages when the service supports it. The FTC lists hardware tokens as an MFA method.
- Sign out of all sessions, remove unknown devices and app authorizations, regenerate API keys, and review withdrawal addresses, spending limits, recovery email, and phone number.
- Secure the password manager itself with a new master password and MFA. Check its audit or security log for exports, new devices, and recovery changes.
- Ask your mobile carrier about an account PIN and protections against unauthorized number transfers if your phone number is used for recovery.
Choose a safer storage setup after the incident
For many holders, a hardware cryptocurrency wallet is the clearest physical security improvement. The Singapore Police Force recommends storing cryptocurrency in hardware wallets where possible because they are less vulnerable to online attacks. “Offline” does not mean risk-free: a fake device, malicious firmware, stolen recovery phrase, or deceptive transaction prompt can still defeat the setup.
| Evaluation point | Questions to ask before choosing |
|---|---|
| Network and asset support | Does it support every chain, token standard, and collectible you actually use, including the networks needed to move funds during an emergency? |
| Transaction-screening clarity | Can the device show the destination address, amount, network, and meaningful contract details so you can detect a malicious signature? |
| Recovery and backup design | How is the recovery phrase generated, verified, and restored? Can you maintain an offline backup without entering it into a computer? |
| Update process | Are firmware releases authenticated, documented, and installable through a process you understand? Can you verify what changed? |
| Independent security documentation | Are security architecture, vulnerability handling, and audit information publicly documented rather than presented only as marketing claims? |
| Supply-chain trust | Can you buy from the manufacturer or an authorized seller, verify tamper evidence, and initialize the device yourself? |
| Compatibility | Will it work with the exchanges and dApps you use without requiring you to import the recovery phrase into a web wallet? |
Store and back up the new phrase
Keep the recovery words offline and protected from fire, water, theft, and casual access. Consider two geographically separate physical backups if losing the only copy would be catastrophic, but understand that every additional copy increases the number of places an attacker could find it. Never give the phrase to support staff, investigators, tax preparers, friends, or a website. A legitimate provider can troubleshoot a device without asking for it.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Can stolen cryptocurrency be recovered?
Do not assume that a blockchain transfer can be reversed. The FTC says cryptocurrency payments generally do not have the same legal protections as credit- and debit-card payments, so getting money back can be difficult. No government agency guarantees reimbursement for a compromised wallet.
Rank #3
- Quality materials: these steel crypto wallets are made of 304 stainless steel with a melting point of over 2500 Fahrenheit degrees, designed and tested to be preservative, fireproof, waterproof, and impact-resistant, and can serve you for a long time
- Products quantity: you will receive a 2-in-1 set of steel bitcoin wallets with matching lock screws, and 1 piece of metal plate marking pen, which is a matching set to help you protect your codes, passwords, and further importantly, your cryptocurrency
- Functions: with these steel crypto wallets you can record information such as fieldworks passphrase in tandem with the BIP39 word list, and they are also compatible with 12 or 24-word seed in most languages, suitable to store your private cryptocurrency information or for many instances where you may need a private cold storage system
- Suitable size: the cold wallet backups are compatible with BIP39 wallets, can work with most hardware wallets, supports up to 24 mnemonics seed phrases, convenient for you to use in coordination with other crypto seed storage devices and wallets
- Multiple ways of locking: you can use the matching screws to lock up the steel bitcoin wallets; You can also lock them up and hide them in other places if you still feel unsafe; The hole on the bitcoin wallet measures 6 mm/ 0.24 inch in diameter, suitable for hanging
Reporting still matters. Include the exact transaction hashes, addresses, asset type, amount, network, date and time, exchange account details, messages, and suspicious domains in your IC3 and local reports. Contact the provider immediately through its official channel and ask what account-freeze, compliance, or law-enforcement process is available. A report may help investigators identify a common destination or preserve records, but it is not a promise that funds will be returned.
Recognize the second-wave recovery scam
The FBI warned on 24 August 2023 that anyone claiming to recover your funds may be running another scam. Recovery fraudsters often know details from a public complaint, demand an upfront “retainer,” request your seed phrase or one-time code, or instruct you to move funds to a supposedly safe wallet. Ignore unsolicited accounts that claim to be investigators, wallet support, lawyers, or blockchain tracing specialists. Do not pay for guaranteed recovery and do not share credentials to “prove ownership.”
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Evidence and reporting checklist
- Wallet address and whether it is the sending or receiving address
- Blockchain network and token contract, if known
- Asset name, quantity, and approximate value at the time
- Transaction hash or ID for each transfer
- Date and time with time zone
- Exchange, wallet, or ATM account name and user ID
- Scammer’s addresses, usernames, email addresses, phone numbers, and payment instructions
- Suspicious websites, advertisements, app names, extensions, and download files
- Screenshots, chat exports, emails with headers, invoices, and screen recordings
- Device details and the time you noticed unauthorized access
Store the evidence in read-only or well-protected copies. Do not edit screenshots or delete the original messages after making notes. When reporting, describe what you personally observed and label estimates as estimates.
How to avoid repeating the incident
Use a transaction pause
Before signing, read the network, destination, amount, token, spender, and requested permission on the wallet’s trusted display. Treat an unlimited approval, an unfamiliar contract, or a request to sign a message you do not understand as a stop signal. Close the session and verify the project through an independently obtained source rather than a link in a direct message.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Separate everyday access from long-term storage
Keep only the amount needed for routine activity in a wallet that connects frequently to dApps. Store long-term holdings in a separately backed-up wallet or hardware device, and avoid importing its recovery phrase into browser extensions or phones. This separation limits the damage from one malicious connection, although it cannot protect a phrase that has already been exposed.
Plan an emergency drill
Write down, without recording any secret phrase, where to find official support, how to revoke approvals on each network, which trusted device will create a replacement wallet, and how you will pay network fees. Periodically verify that backups are readable and that trusted family or estate instructions do not reveal the recovery words themselves.
When to stop and get professional help
Pause self-directed transfers if malware is still active, the attacker appears to control the phone number or email, multiple networks are involved, or moving funds could violate a legal or estate requirement. Seek help from a qualified incident-response or legal professional through a contact you verify independently. Give them transaction hashes and timelines, not seed phrases or one-time codes. Anyone who insists on secrets, promises certainty, or demands cryptocurrency before examining the facts is not a safe responder.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
