What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If your recovery phrase or private key may have been exposed, treat the wallet as compromised: use a secure device to create a genuinely new wallet with a new phrase, secure that phrase offline, and move any remaining assets. Do not restore the old phrase into the new wallet or assume changing an app password will protect it. If the concern is only a suspicious token approval, review and revoke that permission instead—but revocation does not make an exposed phrase safe.
Stop entering the phrase, avoid unsolicited support links, and preserve transaction details if funds have moved. The right next step depends on what was exposed and whether the wallet is self-custody, embedded, or custodial.
As an Amazon Associate I earn from qualifying purchases.
Act first: contain the risk
- Stop sharing or entering the phrase. Never send it to someone claiming to be support, type it into a link from a message, or enter it again on a site you do not trust. A recovery phrase gives control over the wallet and accounts derived from it.
- Stop using a potentially infected device. If malware or unknown software may be involved, disconnect that device and do not use it to create or access a replacement wallet. Use a device you have reason to trust for protective steps.
- Decide whether the phrase or private key may be exposed. If it was typed into a site, shared, or stored somewhere another person or program could access, assume full compromise. If you only interacted with a suspicious dApp or signed an unfamiliar approval, the problem may be a permission rather than a leaked phrase.
- If the phrase or key may be exposed, create a new wallet and move remaining assets. Generate a fresh recovery phrase on a secure device, keep it private and offline, then transfer assets from the affected wallet. Do not import the compromised phrase into the replacement wallet.
- Review permissions and linked accounts. Revoke suspicious token approvals through a trusted wallet interface or a reputable checker for the relevant network, and disconnect unknown dApps where possible. For an embedded wallet, secure the account used to sign in as well.
- If funds have left, preserve evidence and report promptly. Record addresses, transaction hashes, times, and relevant messages. Contact an exchange quickly if the trail appears to lead to one, and report through the appropriate police or cybercrime channel for your location.
Do not pay anyone who promises to reverse a confirmed transaction or recover funds in exchange for an upfront fee. Ethereum.org warns that recovery scammers target people who have already been victimized.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the response that matches what happened
Not every suspicious wallet event proves that a recovery phrase has leaked. Matching the response to the exposure avoids treating an approval problem as a password problem—or overlooking a full compromise.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
| What may be compromised | What to do | What the action does not fix |
|---|---|---|
| Recovery phrase or private key | Create a new wallet with a newly generated phrase on a secure device; move remaining assets and stop using the old phrase. | Changing only the wallet app password does not retire an exposed phrase. |
| Token approval or dApp permission, with no sign the phrase was exposed | Inspect the interaction, revoke suspicious approvals, disconnect unknown dApps where possible, and review transactions. | Revoking an approval does not protect a phrase that was also exposed. |
| Device suspected of malware or unauthorized access | Disconnect it and use a secure device for wallet-protection steps. | Continuing wallet activity on the affected device does not resolve the device risk. |
| Sign-in account for an embedded wallet | Secure the linked email, Google, Apple, or passkey account; end unknown sessions and change passwords where appropriate. | Securing the sign-in account alone may not address an exported or exposed wallet key. |
| Funds already transferred out | Preserve transaction evidence, report the incident, and contact a centralized exchange quickly if relevant. | A report or support request does not itself reverse an on-chain transaction. |
When to assume the phrase is exposed
Treat the wallet as compromised if you entered the phrase on a website, gave it to anyone, or saved it in a cloud file or another place that may be accessible to others. The Singapore Police Force and Cyber Security Agency of Singapore advised on 29 November 2024: “If a wallet’s seed phrase is compromised, transfer all remaining cryptocurrencies in the compromised wallet to another wallet immediately.” That instruction is about remaining assets; it is not a way to undo transfers that have already confirmed.
If you cannot tell what a signature authorized, or you see transactions you did not make, err on the side of treating the phrase as potentially compromised and move remaining assets to a new wallet. This is especially important if you cannot establish that the incident was limited to a specific approval.
When the evidence points only to an approval
A token approval is a permission that can let a contract or dApp access specified tokens. A suspicious approval is a real risk, but it is distinct from someone learning the wallet’s recovery phrase. Review the permission and its associated activity, revoke a suspicious approval using a trusted interface or reputable network-specific checker, and disconnect the dApp where possible. Follow the official site for the relevant network rather than a link sent in an unsolicited message.
Approval revocation is not a substitute for moving assets if the phrase or private key may also be exposed. Likewise, changing a password does not remove an on-chain approval. The two problems have different remedies.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
How to replace a wallet after phrase exposure
- Choose a secure device. If you suspect the device you normally use has malware or unauthorized software, disconnect it and do not generate the replacement wallet there. Kraken Support’s compromised-wallet guidance likewise advises disconnecting an affected device.
- Generate a completely new wallet. Use the wallet’s trusted setup process on the secure device. It must create a new phrase; restoring the old phrase recreates access to the wallet you are trying to retire.
- Secure the new phrase offline and privately. Write it down or otherwise store it using the wallet provider’s intended offline guidance. Do not share it with support or enter it into a message, website, or cloud file. MetaMask Help Center distinguishes a Secret Recovery Phrase from a device password: a password protecting an app or device does not replace the phrase’s role in controlling the wallet.
- Transfer remaining assets from the affected wallet. Send them to the newly created wallet using the correct network and destination details. Check the receiving address carefully before confirming. Follow the wallet’s trusted instructions for moving assets; do not respond to a stranger who offers to perform the transfer for you.
- Stop using the old phrase. Do not reuse it for a later wallet, even after transferring assets. Anyone who has it may retain access to accounts derived from it.
Moving assets may require interacting with the affected wallet, so device safety matters. If you believe a device can capture new credentials or transactions, do not use it for the replacement-wallet setup. The available guidance establishes the need for a secure device and a newly generated phrase; it does not specify a universal transfer sequence for every wallet, network, or asset.
Secure the other access paths
Embedded or account-based wallets
Some wallets are accessed through an identity or sign-in account rather than only through a locally managed phrase. Secure the linked email, Google, Apple, or passkey account: review active sessions, sign out unknown sessions, and change passwords where appropriate. If the platform offers account-security controls, use its official interface and contact the platform through verified channels. If you believe a wallet key was exported or exposed, account security alone is not enough; treat the key exposure as a separate wallet compromise.
Kraken’s guidance notes that exporting embedded-wallet keys may be necessary to move assets, depending on the circumstances. That is provider-specific guidance, not a universal instruction for every embedded wallet. Follow the relevant platform’s official procedures and avoid sharing an exported key with anyone.
Exchange accounts connected to the incident
If a linked exchange account may also be at risk, change its password and enable two-factor authentication. Review sessions or account activity if the service provides those controls. This protects the exchange login path; it does not make a compromised self-custody recovery phrase safe.
Rank #3
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Lost or stolen hardware wallet
The physical device being lost or stolen does not by itself establish that the recovery phrase has also been exposed. The risk depends on what else may be known or accessible, including the phrase, PIN, and device. Because device procedures differ by wallet model, use that model’s official instructions rather than assuming one blanket rule. If you have reason to think the phrase itself was compromised, retire it and move remaining assets as described above.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If a transaction is unauthorized or funds are gone
Record the affected wallet address, transaction hash, time, and any relevant messages, sites, or account notifications. Keep copies of the evidence and use the appropriate police or cybercrime reporting channel in your jurisdiction. The Singapore advisory’s reporting directions are specific to Singapore; readers elsewhere should use their local authorities’ official channels.
Contact a centralized exchange quickly if the transaction trail appears to lead to an account there. Ethereum.org says an exchange may sometimes freeze an account flagged for fraud, but that possibility is not a guarantee that funds can be stopped or returned. Provide transaction details and follow the exchange’s verified reporting process.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFor Ethereum, confirmed transactions cannot be reversed. Kraken Support states, “Onchain transactions cannot be reversed,” and Ethereum.org likewise cautions that Ethereum transactions are final once confirmed. Reporting remains worthwhile for documentation and possible investigation, but it is different from reversing the transaction. Be particularly wary of anyone claiming they can undo it for a fee or asking for the phrase to “trace” or recover funds.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Why an app password is not enough
A wallet app password and a recovery phrase serve different purposes. The password may protect access through a particular app or device, while the phrase can restore or control the wallet and accounts derived from it. Ethereum.org describes the recovery phrase as “the master key to your wallet.” If another person has that phrase, changing an app password does not revoke their ability to use it elsewhere.
That is why phrase exposure calls for a newly generated wallet and asset transfer, while a suspicious approval calls for permission review and revocation. A wallet can also face both risks at once, so investigate what happened rather than assuming a password change has resolved the incident.
Reduce the chance of a repeat incident
- Keep the recovery phrase offline, private, and separate from ordinary files or cloud storage that could be accessed through a compromised account.
- Never disclose the phrase to a person claiming to be support. A request for the phrase should be treated as a warning sign.
- Use a hardware wallet if offline private-key storage fits your needs. Ethereum.org describes hardware wallets as storing private keys offline, and the Singapore advisory recommends hardware wallets as less vulnerable to online attacks.
- Review what a dApp is asking you to approve or sign, and periodically inspect token permissions using trusted tools for the relevant network.
- Secure linked sign-in and exchange accounts, including with strong passwords and two-factor authentication where available.
A hardware wallet is a preventive measure, not a way to rehabilitate a phrase that has already leaked. Any replacement after exposure still needs a newly generated phrase; transferring an old exposed phrase onto a different device leaves the same access risk.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
