Free tools Windows power users keep installed
One-click scans. No signup required.
If you only connected your wallet—and did not sign a transaction or approval, or reveal your recovery phrase or private key—the connection alone does not authorize token transfers in MetaMask’s documented connection flow. Disconnect the site, then check your wallet activity and token approvals to see whether anything else happened. If you signed a request, investigate what it authorized; if you exposed your recovery phrase or private key, treat the associated wallet as compromised.
First, stop interacting with the site
Close the page. Do not return to claim a reward, test whether the site still works, or follow instructions from someone offering help. Never enter your recovery phrase or private key into a website or share it with support. Ethereum.org says legitimate apps never ask for your seed phrase.
As an Amazon Associate I earn from qualifying purchases.
Work out what happened
Connecting a wallet is not the same as signing a request. The distinction determines what to check and what to do next.
Recommended Free Tools
- Connected only: In MetaMask’s documented connection flow, a dapp can learn your public address and inspect public blockchain information, such as balances. The connection alone does not authorize token transfers. Disconnect the site and still check your activity and approvals.
- Signed a token approval or permission: A signed allowance may let a contract move tokens within the approved allowance. Disconnecting the site does not revoke that on-chain authorization.
- Signed a transaction or another request: Review the specific request and its result. What a signature authorizes depends on the signed data, wallet, and network; the fact that you signed something does not by itself establish what access it granted.
- Shared a recovery phrase or private key: Treat every account derived from that secret as compromised. A new device does not make the exposed phrase safe.
- See a confirmed unauthorized transfer: A confirmed Ethereum transaction cannot be reversed. Focus on securing any assets that remain, preserving evidence, and reporting the incident.
MetaMask’s explanation of the connection flow is available in its dapps user guide. Wallet interfaces and permission types differ, so use the official instructions for your wallet and check the relevant network.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Disconnect the site and inspect activity
- Disconnect it in your wallet. Open the wallet’s connected-sites or permissions settings, find the unfamiliar site, and disconnect it. This ends the connection; it does not remove a token approval already recorded on-chain.
- Review wallet activity. Look for transactions, contract interactions, approvals, or other requests around the time you used the site. For an unfamiliar transaction, MetaMask recommends checking its date and time, recipient, dapp, and value in its incident guidance.
- Check the relevant block explorer. Review activity on each network you used. Keep the transaction hash for any interaction you do not recognize; seeing a site connection in your wallet is not a substitute for checking the on-chain record.
Check and revoke suspicious approvals separately
If you signed a token approval or find an allowance you do not recognize, check approvals for the affected network and revoke suspicious ones using the wallet’s trusted tools or a reputable approval checker. Revoking is a separate on-chain transaction and may require a network fee. It removes that authorization; it does not undo a transfer that has already happened. MetaMask explains how token approvals work and how to revoke them.
If you exposed your recovery phrase or private key
Use a clean device or browser profile to create a new wallet with a completely new recovery phrase. If the exposed phrase was used for multiple accounts, consider all of them compromised. Move remaining assets to the new wallet only if you can do so safely. MetaMask warns that a sweeper may monitor a compromised wallet and take funds sent to it for gas, so do not add more funds to the old wallet without understanding that risk. Stop using the old wallet and its phrase; do not reuse a potentially compromised linked Google or Apple account.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
If funds are missing, preserve evidence and report
Save the fake site’s URL and where you found it, timestamps, wallet addresses, transaction hashes, screenshots of the reward offer and wallet prompts, and related messages. Ethereum.org’s scam help and reporting guide lists options including Chainabuse and Etherscan for address reports; PhishTank, Google Safe Browsing, and the social platform where the link appeared for phishing reports; and local law enforcement. It identifies FBI IC3 in the United States, Action Fraud in the United Kingdom, and Europol in the European Union. If transaction tracing suggests funds reached a centralized exchange, contact that exchange promptly through its official support channel. Reports can help warn others or support investigations, but they do not guarantee recovery.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Watch for follow-up recovery scams
Ignore unsolicited recovery agents and anyone demanding an upfront fee or asking for your recovery phrase or private key. Ethereum.org warns that paid recovery promises are likely to be another scam. No service can promise to reverse a confirmed Ethereum transaction; as Ethereum.org puts it, no one can reverse blockchain transactions.
Quick Recap
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
