Free tools Windows power users keep installed
One-click scans. No signup required.
Act as though the wallet may be at risk until you establish exactly what happened. Close the site, reject every further prompt, and determine whether you merely connected the wallet, signed a transaction, granted a token-spending approval, exposed a recovery phrase or private key, or installed software. Those are different events with different remedies.
If a recovery phrase or private key was entered or shared, the wallet is no longer trustworthy: create a new wallet on a clean device and move any remaining assets. If you signed an approval, inspect and revoke suspicious permissions on the affected chain. If assets have already left, document everything and report it, but do not pay anyone who promises to reverse the transfer.
As an Amazon Associate I earn from qualifying purchases.
What to do in the first 10 minutes
- Stop interacting with the site. Close the tab, disconnect the wallet from the site using the wallet’s connected-sites or permissions control, and do not return through a message, advertisement, pop-up, or unsolicited support link. Reject any pending wallet request.
- Record what you can while the evidence is fresh. Save transaction hashes, destination and spender addresses, token names, screenshots, the site’s address, timestamps, and relevant emails or chat messages. Do not click the site again merely to collect more information.
- Classify the event. Establish whether the wallet only connected, a transaction was signed, a token approval was granted, a recovery phrase or private key was entered, or software was downloaded or installed. The correct response depends on this classification.
- Protect linked accounts. Change passwords for exchange accounts and email accounts associated with the wallet, and turn on two-factor authentication. If an exchange account may be involved, contact that exchange through an official support channel that you locate independently.
- Use a clean device for sensitive actions. If you installed software, suspect malware, or entered credentials on the device, stop using that device for wallet operations. Do not type a recovery phrase into it while investigating.
A wallet prompt can look routine even when the requested action is not. Read the requested network, token, contract and amount before approving anything. If you cannot tell what a prompt does, cancel it and investigate from a trusted source instead of asking the suspicious site for help.
Connection, signature, approval and phrase exposure are not the same
A decentralized application (dapp) can request a connection so it can see a public wallet address and the selected network. That connection does not by itself equal permission to spend tokens. A signature or transaction approval is a separate event. Entering a recovery phrase or private key is more serious still: it gives control of the wallet rather than a limited permission.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
| What happened | What it usually means | Priority response |
|---|---|---|
| Connection only | The site was linked to the wallet and may know the public address and network. No spending approval was necessarily granted. | Disconnect it, inspect approvals and activity, and avoid returning to the site. Treat unexpected prompts or downloads as a separate risk. |
| Signed a transaction | A blockchain action was authorized. It may have transferred assets, interacted with a contract, or granted a permission. | Find the transaction hash and inspect the destination, contract and token movements. If an approval was included, revoke it. |
| Granted a token approval | A contract or spender may be allowed to transfer the approved token from the wallet, sometimes until the allowance is changed. | Check active approvals on that chain and revoke any suspicious spender as soon as it is safe to do so. |
| Entered or shared a recovery phrase or private key | The secret that controls the wallet may be known to an attacker. Disconnecting a site does not make the wallet safe again. | Create a new wallet from an official source on a device believed to be clean and transfer remaining assets. |
| Downloaded or installed software | The device may be compromised independently of the wallet connection. | Stop signing on that device. Use a clean device for the new wallet and credential changes, and have the original device assessed before reusing it. |
These categories can overlap. For example, a connection can be followed by an approval request, and a phrase can be stolen by a fake support page. Record each action rather than assuming the most reassuring explanation.
If you only connected the wallet
A connection alone is not the same as an approval or a transfer. Nevertheless, do not treat a suspicious connection as proof that nothing happened. Review the wallet’s activity and approval permissions on every network you use, because a site can present a second prompt after the initial connection.
Disconnect the dapp
Open the wallet’s list of connected sites or active connections, locate the suspicious domain and remove it. Wallet interfaces use different labels, and disconnecting a site only removes the connection; it does not undo a token approval that was signed earlier. If the site is no longer listed, continue by checking on-chain approvals and transactions.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Check for unexpected activity
Compare the wallet’s recent transactions with the evidence you saved. Look for outgoing transfers, contract interactions, newly granted allowances and activity on networks you do not normally use. A public address can be observed without giving the observer control, so an unfamiliar incoming transaction is not by itself proof of theft; focus on actions that moved assets or changed permissions.
Do not “test” the site
Returning to see whether the connection still works can expose you to another prompt. Never paste a recovery phrase into a verification form, and never follow a support account’s instruction to “synchronize” or “validate” the wallet.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
If you signed a transaction
Use the transaction hash to determine what was authorized. Confirm the network, the receiving address or contract, the token and amount, and whether the transaction granted an allowance. Wallet activity screens may summarize a contract call; a chain explorer can provide the underlying data, but use the explorer’s official domain and verify the network before relying on it.
When the transaction was an approval
Follow the approval procedure in the next section immediately. A malicious approval can let a spender continue taking tokens later, even if the suspicious site is no longer connected.
When assets were transferred
Save the hash and destination address, then move any assets that remain only if the wallet’s secret is still secure and the device is safe. If the phrase or private key was exposed, do not keep using the old wallet; create the replacement wallet first and follow the compromised-secret procedure instead. Do not sign additional transactions merely to experiment with the contract.
How to find and revoke suspicious token approvals
Ethereum.org identifies Revoke.cash, Revokescout and Etherscan Token Approval Checker as examples of tools for inspecting approvals. They are alternatives for viewing permissions; none can recover assets that have already been transferred. Use a known official address for whichever tool you choose, not a link supplied by the suspicious site or an unsolicited message.
- Select the correct network. An approval on one chain does not automatically appear on another. Repeat the check for every chain on which the wallet holds tokens or has interacted with the site.
- Enter only the public wallet address when the tool requests it. An approval checker should never need your recovery phrase or private key. Leave immediately if a page asks for either.
- Review each spender. Match the contract address, token, allowance and last-used information against your own activity. Treat an unfamiliar spender or an allowance created immediately after the suspicious visit as high risk, while remembering that a familiar token name does not prove a contract is safe.
- Open the wallet’s signing prompt for the revocation. Confirm that the network, contract and requested action correspond to revoking the permission. A revocation is itself a blockchain transaction, so do not sign if the destination or action is unclear.
- Verify completion. Refresh the approval list and confirm that the allowance is removed or reduced as intended. Check the transaction hash on the correct network.
- Repeat for other addresses and chains. Wallets can control multiple accounts, and a single suspicious site may have been used with more than one account.
Revoking an approval prevents the spender from using that permission in the future; it does not reverse a transfer that already occurred. If an attacker knows the recovery phrase, revoking permissions is not a substitute for replacing the wallet.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
If a recovery phrase or private key was exposed
Ethereum.org describes the recovery phrase as Your recovery phrase (also called secret recovery phrase or seed phrase) is the master key to your wallet.
Anyone who obtains it can recreate the wallet and sign transactions without your consent. Assume the wallet is compromised even if no unauthorized transfer is visible yet.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCreate the replacement wallet safely
- Use a device you believe is clean and obtain the wallet software or hardware wallet from the maker’s official source. Type the address yourself or use a bookmark you created before the incident.
- Generate a completely new wallet and write its new recovery phrase offline. Do not photograph it, store it in cloud notes, enter it on a website, or send it to support.
- Confirm that the new receiving addresses are displayed by the wallet itself. A support representative, moderator or “recovery expert” should never need the phrase.
- Transfer remaining assets from the exposed wallet to the new address, prioritizing assets that could be drained quickly. Check each address and network before confirming.
- After the move, stop using the exposed wallet for custody. Keep its transaction history and evidence for reporting, but do not treat a changed password or disconnected dapp as a cure.
A hardware wallet is an optional way to keep private keys offline for a newly established wallet. Buying one does not undo exposure of an existing phrase; the replacement wallet must be generated with a new secret.
If you downloaded software or suspect the device
Wallet security can fail through the device as well as through a dapp. A fake wallet extension, remote-support program, clipboard-changing malware or browser add-on can alter addresses or capture secrets. If software was downloaded from the suspicious site, stop using that device for signing and phrase entry.
- Disconnect the device from sensitive wallet sessions and do not approve a “cleanup” transaction offered by the site.
- Use a separate, trusted device to create the replacement wallet and change exchange and email passwords.
- Remove untrusted extensions and programs only after preserving the evidence you need; if substantial funds are involved, obtain professional incident-response help from a service you independently verify.
- Check that two-factor authentication is enabled on linked accounts. Prefer an authenticator application or security key over receiving codes through an account that may itself be compromised.
If you cannot establish that the device is clean, assume anything typed into it—including a new phrase—could be captured and start again on a different device.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Secure linked exchange and email accounts
Ethereum.org recommends changing passwords on linked exchange accounts and enabling two-factor authentication. Start with the email account that can reset those services, then change exchange passwords and review active sessions, withdrawal addresses and API keys. Use the exchange’s official application or a manually entered support address; do not trust a “help” account that contacts you first.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
If an exchange account may have been accessed, tell its official support team the date, affected wallet address, transaction hashes and any account changes you observed. Ask what account-lock or withdrawal-hold procedure is available. Do not give support staff a recovery phrase or private key.
Report the scam and preserve evidence
Keep an evidence folder containing the suspicious domain, screenshots, transaction hashes, wallet and spender addresses, token and network details, messages, emails and a timeline of events. Ethereum.org specifically recommends documenting transaction hashes, wallet addresses, screenshots and communications. Preserve original files where possible rather than editing screenshots.
Report the incident through the wallet or service’s official reporting route, the relevant exchange if it was involved, and the cybercrime or law-enforcement channel applicable to your jurisdiction. A report may help identify a pattern or preserve information, but it does not freeze a blockchain transfer automatically. Do not publicize your recovery phrase, private key or full authentication codes while asking for help.
Can stolen crypto be recovered?
Ethereum.org’s scam guidance states: No one can reverse blockchain transactions.
A confirmed transfer normally cannot be canceled by the wallet, a dapp, an exchange support agent or a chain explorer. Reporting remains worthwhile, especially if an exchange later receives the funds, but there is no guaranteed reversal process.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Be especially cautious after the initial theft. People who claim they can recover funds for an upfront fee, ask for your phrase, or request remote access are almost certainly attempting a second scam. Do not pay them or disclose any secret. Keep your evidence and communicate only through independently verified official channels.
What security alerts and simulations can—and cannot—do
Some wallets provide security alerts or transaction simulations that flag known risk signals before you sign. MetaMask’s help guidance presents these features as aids, not guarantees: an alert may miss a threat, and a user can still proceed. Treat a warning as a reason to stop and investigate, not as a complete safety check. The absence of a warning is not proof that a site or contract is trustworthy.
Preventing the next incident
- Open dapps from a bookmark or a project address you verified independently, not from unsolicited advertisements, direct messages or search-result look-alikes.
- Use a separate, limited-balance wallet for experimental dapps and keep long-term holdings in a wallet that is not routinely connected to new sites.
- Read every wallet prompt for the network, contract, token, amount and permission duration. Cancel requests that do not match the action you intended.
- Review token approvals periodically, including on chains you use less often. Disconnecting an old dapp is not the same as revoking its allowance.
- Keep the recovery phrase offline and private. No legitimate website, wallet employee or support representative needs it.
- Keep wallet software, browsers and operating systems updated, and remove extensions you no longer recognize.
- Consider a hardware wallet for a newly created long-term wallet if offline key storage fits your threat model. It is an additional control, not a remedy for a phrase that has already been exposed.
When to stop using the old wallet entirely
Retire the old wallet for custody if its recovery phrase or private key was exposed, if malware may have captured it, or if you cannot determine what a signed transaction authorized. Create a fresh wallet on a clean device, transfer what remains, and use the old address only as an evidence trail. If the only event was a verified connection with no signatures, no approvals and no suspicious software, disconnecting the site and monitoring activity may be sufficient, but continue to treat unexpected prompts as a warning.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
