Stop using the suspect device for crypto or other sensitive logins, disconnect it from the network if it may still be infected, and switch to a different trusted device. From that trusted device, treat any recovery phrase or private key that spyware could have seen as compromised: create a new wallet with a new phrase and transfer the remaining assets. If the phrase and key are still safe but you approved a suspicious contract, revoke that token approval. If the wallet is embedded in an email, Google, Apple, or passkey account, secure that identity account and use the provider’s supported migration process.
These actions are urgent because blockchain transfers cannot be reversed. Device cleanup, a password change, or an app PIN change cannot make an exposed phrase secret again. Protect the wallet first, then clean the infected device, document what happened, and report it through official channels.
As an Amazon Associate I earn from qualifying purchases.
Do these things in the first 30 minutes
- Stop entering secrets on the suspect device. Do not open an exchange, wallet, email, password manager, or banking account there. The Federal Trade Commission (FTC) advises stopping logins involving usernames, passwords, or other sensitive information on a device that may contain malware.
- Isolate the device. If infection is plausible, disconnect Wi‑Fi, Ethernet, and mobile data. Do not keep using the computer or phone to “check” the wallet.
- Move to a trusted device. Use a device you believe is clean for wallet creation, transfers, password changes, two-factor authentication, and support contact. Avoid copying a recovery phrase through a cloud clipboard or an account that may also be compromised.
- Do not approve anything else. Ignore pop-ups, unsolicited support messages, and requests to connect the wallet again. A second signature can give an attacker another opportunity.
- Record facts without exposing more secrets. Write down wallet addresses, transaction hashes, dates, contract addresses, URLs, and messages. Never send a recovery phrase or private key as “proof” to a support agent.
The order matters: wallet and account protection come before malware removal. A clean scan performed after an attacker has already obtained a key cannot undo a transfer.
Recommended Free Tools
Identify what the spyware or scam may have obtained
The correct remedy depends on whether an attacker obtained a signing secret, a spending permission, or access to an identity account. Use this table to choose the branch that matches the evidence. If you cannot tell, use the more protective fresh-wallet path.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Possible exposure | What it can allow | First priority | What does not fix it |
|---|---|---|---|
| Recovery phrase or private key entered, displayed, or stored on the suspect device | Control of the wallet and the ability to sign transfers | Create a new wallet on a trusted device and move remaining assets | Changing a password, PIN, or wallet app does not invalidate the exposed phrase |
| Suspicious token approval, but no evidence that the phrase or key leaked | The approved contract may continue spending the approved token allowance | Review and revoke the suspicious approval through the wallet or a trusted chain-specific approval tool | Disconnecting a website alone does not necessarily remove an on-chain approval |
| Embedded or account-based wallet accessed through email, Google, Apple, or a passkey | Someone controlling the identity account may regain wallet access | Secure that identity account, sign out unknown sessions, and follow the provider’s migration or key-export process | Assuming there is no risk merely because you never saw a seed phrase |
| Exchange or custodial account credentials | Access to the account balance and withdrawal functions, subject to the provider’s controls | Change credentials from a trusted device and contact the provider through its official site or app | Trying to resolve the incident through a link in an unsolicited message |
If a recovery phrase or private key may have leaked
Assume compromise if spyware could have captured the phrase or key. This includes typing it, displaying it while screen-capture malware may have been active, storing it in an infected notes app, or importing it into a wallet on the suspect device. You do not need proof that an attacker used it before taking protective action.
1. Create a completely new wallet
On the trusted device, install the wallet software from the provider’s official site or app store and create a new wallet. Generate a new recovery phrase; do not restore the old phrase into the new wallet. The phrase must be new and created while the device is trusted.
2. Transfer the remaining assets
Send the remaining assets from the old address to the new address. Check the destination address on the trusted device before confirming. If funds disappear while you are preparing the transfer, preserve the transaction hash and address immediately; do not sign additional transactions from the old wallet.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThe European Supervisory Authorities’ 2025 crypto-fraud factsheet states: “If your wallet is compromised, immediately transfer your remaining assets to a new secure wallet.” The recommendation applies to self-custody wallets whose signing secret may have been exposed.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Retire the old phrase
After the transfer, stop using the compromised phrase and private key. Do not keep the old wallet for “small” balances, testing, or future airdrops. Anyone who obtained the phrase can continue to sign transactions whenever assets arrive.
Kraken’s compromised-wallet guidance, updated September 15, 2026, likewise directs users to create a new wallet with a new recovery phrase on a secure device, move remaining assets, and stop using the compromised phrase. A wallet password or app PIN is an access-control layer on that device; it is not a replacement for a secret signing key.
If you approved a suspicious token contract
A token approval is an on-chain permission. It can allow a contract to spend a specified token amount from your address later, even after you close the website that requested the permission. Ethereum.org’s scam guidance explains that malicious approvals can let a contract continue spending approved tokens.
Review the approval
Open the wallet’s security, permissions, connected-apps, or token-approval area, or use a trusted approval tool for the specific blockchain. Match the contract and token to the transaction you remember authorizing. Treat an unfamiliar spender, unlimited allowance, or a site you no longer trust as suspicious.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Revoke the permission
Use the wallet or chain-specific tool’s revoke action and confirm the transaction from the trusted device. Revoke each suspicious allowance you identify. Keep the transaction hash as evidence.
Know when revocation is not enough
Revocation addresses a permission; it does not replace a new wallet when a phrase or private key may have leaked. If you entered the phrase on the infected device, cannot establish that the key stayed private, or see an unauthorized transfer, follow the fresh-wallet procedure as well. Do not sign a “revoke” transaction supplied by an unsolicited helper; navigate to the official wallet or trusted tool yourself.
If the wallet is embedded in an account
Some wallets are created and accessed through an email address, Google account, Apple account, or passkey rather than a phrase that you write down. In that model, the identity account is part of the wallet’s security boundary.
Secure the identity account from the trusted device
- Change the account password to a unique password that has not been used elsewhere.
- Enable two-factor authentication using the provider’s supported method.
- Review active sessions and sign out devices or sessions you do not recognize.
- Check recovery email addresses, phone numbers, passkeys, and other sign-in methods for changes you did not make.
These controls protect the account used to reach the wallet; they do not automatically migrate assets. Follow the wallet provider’s documented key-export, recovery, or migration process. Do not improvise by exporting keys into the infected device.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Kraken’s guidance specifically includes linked email, Google, Apple, and passkey accounts when assessing an embedded wallet compromise. If the provider offers a supported way to move assets to a new wallet, use that process from the trusted device and contact support only through the official app or website.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protect exchanges and other linked accounts
If the suspect device was used to log in to an exchange, email account, cloud storage, or password manager, treat those credentials as exposed too. From the trusted device, change each password, make it unique, enable two-factor authentication, and terminate unknown sessions. Start with the email account because it may be used to reset other services.
Contact an exchange or custodial provider quickly through its official website or app. The provider may be able to secure an account or investigate activity, but a self-custody provider cannot reverse a confirmed blockchain transfer. Do not use phone numbers, support addresses, or “case” links sent by a stranger.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Clean and reassess the infected device
Only begin device remediation after the wallet and linked accounts are protected. The FTC’s malware guidance recommends updating or obtaining legitimate security software, scanning for malware, and removing anything detected. Keep the device disconnected while you prepare the scan if it may still be communicating with an attacker.
Use legitimate tools and current software
- Install security software from the vendor’s official channel, not from a pop-up or direct message.
- Update the operating system, browser, wallet applications, and security software before reconnecting for normal use.
- Run a full scan and follow the software’s removal instructions.
- If the infection cannot be resolved, ask the device maker or a trusted technical professional for help.
Do not sign into crypto accounts on the device until you have reasonable confidence that it is clean. A scan can remove malware; it cannot reverse an on-chain transfer or turn a previously exposed recovery phrase back into a secret.
Preserve evidence and report the incident
Make a timeline while details are fresh. Include the software or website that was installed, the wallet address, contract and spender addresses, transaction hashes, amounts, timestamps, screenshots, and copies of messages or emails. Keep original files where possible, but do not reopen a suspicious attachment on the infected device.
Report the incident to the wallet, exchange, or embedded-wallet provider through its official site or app. The 2025 factsheet from the European Banking Authority, European Insurance and Occupational Pensions Authority, and European Securities and Markets Authority advises contacting the crypto provider through official channels and reporting to police or the national financial supervisory authority in your location. The factsheet is available at eba.europa.eu.
Free tools Windows power users keep installed
One-click scans. No signup required.
Scams that follow a wallet compromise
After a theft, victims are often contacted by people claiming they can trace, unlock, or recover the funds. Requests for an upfront fee, remote access, a recovery phrase, or another “verification” payment are major warning signs. Ethereum.org says fee-based claims to recover funds are almost certainly a second scam, and the European factsheet warns about recovery-room fraud.
Real providers will not need your recovery phrase to investigate a transaction. Use only contact details that you reached by typing the official domain or opening the official app yourself. Preserve suspicious messages for your report instead of replying.
When the situation is uncertain
Choose the response that protects against the worst plausible exposure:
- Could the phrase or private key have been visible to spyware? Create a new wallet and move remaining assets.
- Is the phrase demonstrably safe, but did you sign a questionable token transaction? Review and revoke the approval.
- Is access controlled by an email, Google, Apple, or passkey account? Secure that account, terminate unknown sessions, and use the provider’s supported migration process.
- Did an exchange or custodial account receive the login? Change credentials and contact the provider immediately through its official channel.
- Did an unauthorized transfer already settle? Save the hash and report it; do not promise yourself that it can be reversed.
The key decision is what still controls the assets: a leaked signing secret requires a new wallet, an approval requires revocation, and an embedded wallet requires identity-account protection and provider-supported migration. When more than one condition may apply, perform all relevant steps rather than assuming the least serious explanation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
