Stop all wallet activity first. Close the suspicious site, do not sign another transaction or message, and never enter your recovery phrase again on that page. From a different browser profile, device, or other clean environment, create a new wallet with a new recovery phrase. Move any assets that are still safe, then permanently abandon every account derived from the compromised phrase. If a sweeper bot may be watching the wallet, do not send it more ETH or another gas token: the bot may take that deposit too.
Self-custody providers cannot reverse confirmed blockchain transactions or restore missing funds. Your priority is therefore to prevent a second loss, isolate the remaining assets, remove permissions, secure the device and accounts, and preserve evidence.
As an Amazon Associate I earn from qualifying purchases.
The first minute: contain the compromise
- Stop interacting. Disconnect from the suspicious dapp and close its tab. Do not connect the wallet again, sign a transaction, approve a token, sign an apparently harmless message, or type a recovery phrase into a website. A wallet-security warning is a useful signal, not a guarantee that your funds are safe; a warning can be overridden and loss can still occur.
- Identify the event. Open a block explorer directly, rather than through a link in a message, and inspect the wallet’s recent transactions. Record the time, recipient address, contract or dapp, asset and amount. This separates a transaction you recognize from one you did not authorize and helps determine whether the problem is an approval, a signature, a private-key leak or an account takeover elsewhere.
- Prepare an isolated replacement wallet. Use a different browser, a fresh browser profile or a separate mobile device. Create a new wallet and write its new recovery phrase on paper or another offline medium. Do not reuse a Google or Apple account that might also be compromised, and do not photograph or upload the phrase.
- Move funds only when it is safe. Transfer remaining assets to the new wallet if you have no reason to believe a sweeper script is monitoring the old account. If a sweeper is active, adding ETH or another gas token can simply finance an automated theft. Consider moving the highest-value assets first and watch the destination address carefully.
- Retire the old wallet. Once assets are removed, stop using every account derived from the old recovery phrase. Changing an extension password does not repair a leaked phrase or private key.
If an unauthorized transfer has already settled, save its transaction hash and recipient address immediately. You may be unable to recover the funds, but those records are essential for exchange reviews, incident reports and law-enforcement requests.
Free tools Windows power users keep installed
One-click scans. No signup required.
Work out what was actually exposed
“Hacked wallet” can describe several different incidents. The response depends on the cause, whether funds remain, whether the device is trustworthy and which permission was granted.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
| Likely cause | What it can allow | First priority |
|---|---|---|
| Recovery phrase or private key leaked | Control of every account derived from that secret, including future deposits | Create a new wallet on a clean environment and abandon the old phrase |
| Malicious token approval or operator permission | A contract or spender may withdraw approved tokens later, sometimes up to an unlimited allowance | Move at-risk assets and revoke the allowance on the affected network |
| Phishing or off-chain signature | Delayed permissions, including Permit2-style authorization, without an obvious on-chain transfer at signing time | Move the affected tokens to a new account and remove the old account’s permissions |
| Malware or hostile browser extension | Screen capture, clipboard replacement, key theft or repeated transaction signing | Stop using the device for recovery work; scan and remediate it with trusted help |
| Exchange-account takeover | Withdrawals or account changes even when the self-custody wallet itself is intact | Use the exchange’s official support channel, reset credentials and secure 2FA |
A wallet connection is not the same as an allowance. Disconnecting a dapp prevents a connection from being used in the interface, but it does not necessarily cancel token allowances already granted. Revocation is a separate on-chain transaction and requires a network fee.
Move assets without feeding a sweeper
When a normal transfer is appropriate
If the evidence points to a bad approval or signature but the recovery phrase and private key were not exposed, move the affected tokens to the new wallet before revoking permissions when that order reduces the chance of another withdrawal. Check the destination address character by character, send a small test amount when practical, and verify receipt on the explorer.
When a sweeper changes the plan
A sweeper script watches a compromised account and automatically spends incoming funds, often as soon as gas arrives. In that situation, sending ETH or another gas token to “rescue” assets may hand the attacker the fuel needed to take them. Do not improvise repeated deposits. Stop and obtain qualified incident-response help that understands the relevant chain and transaction mechanics.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat a transfer cannot fix
Moving coins does not make the old phrase safe. Any account derived from a leaked phrase remains under the attacker’s control, and a newly received deposit can be stolen later. After the transfer, treat the old wallet as permanently retired.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Revoke malicious approvals and signatures
Review token allowances, NFT operator permissions and other spend authorizations for the affected account on each network it used. Revoke only through a trusted interface or directly through the network’s established tools; do not follow a “revoke” link sent by a stranger. Each revocation is an on-chain transaction and costs a network fee.
Unlimited allowances can expose an entire token balance, not just the amount you intended to spend. A signature-phishing attack can also create delayed exposure through Permit2-style permissions. If you are unsure what an off-chain signature authorized, moving the at-risk tokens to an account created from a new phrase removes permissions tied to the old account, but it does not erase the old account’s history or recover assets already taken.
Connection versus permission
- Dapp connection: an interface knows which address you use; disconnecting stops that interface from seeing the session.
- Token allowance: a spender contract may transfer tokens later; disconnecting alone does not cancel it.
- Operator approval: an approved marketplace or contract may move NFTs or other assets according to its rules.
- Off-chain signature: a signed authorization may be used later, even when no transfer appeared immediately.
Secure the device, browser and related accounts
Assume malware is possible when a phrase was entered on a computer, a browser extension behaved strangely, clipboard contents changed, or transactions appeared that you did not approve. Do not create the replacement wallet on that machine until it has been investigated.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Disconnect the suspect device from sensitive work and stop using its wallet extensions.
- Review browser history, recently installed extensions, downloads and remote-access software for the time of the incident.
- Run a reputable security scan and remove malware with a trusted provider if you cannot verify the machine is clean. Cleanup can prevent another theft; it cannot recover coins already transferred.
- From a known-clean device, change passwords for email, cloud accounts, exchanges and other services linked to the wallet incident. Use unique passwords and enable strong two-factor authentication.
- Check email forwarding rules, recovery addresses, active sessions and API keys on exchange accounts. Revoke anything unfamiliar through the service’s official settings.
If the same Google or Apple account was used to create or back up the wallet and may be compromised, secure that account before relying on it for the replacement wallet.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Use a hardware wallet correctly
A hardware wallet can provide a separate signing screen for the replacement wallet and keep the new recovery phrase away from a general-purpose computer. Buy only through the manufacturer’s official channel and verify the device before use. Ledger reported a localized reseller-tampering incident updated 15 October 2026, so a marketplace listing is not automatically trustworthy.
A hardware device cannot rescue a leaked old phrase. Importing that phrase into new hardware preserves the attacker’s control. Generate a completely new phrase instead. On the device, read the recipient, network, amount and approval or spender details before confirming; never approve a transaction merely because a browser popup says it is required.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recognize and avoid “recovery” scams
Attackers often target victims again after a theft. No legitimate support agent should ask for a recovery phrase, private key, password, two-factor code, remote access, software installation or a transfer to a “new” address. Coinbase’s guidance is explicit: it will not call or text you to provide a new seed phrase or wallet address to move funds.
Ignore unsolicited direct messages, paid recovery guarantees and websites promising to reverse a blockchain transaction. Contact a provider only through the address or app you already know is official. Never paste your phrase into a form to prove ownership.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Preserve evidence and report the incident
Create a timeline while details are fresh. Save transaction hashes, wallet and recipient addresses, timestamps, domains, screenshots, emails, direct messages and the wording of suspicious signatures or approvals. Keep original files where possible and note which device and account were involved.
Contact an exchange or wallet provider through its official support route if an address belongs to that service. Give staff the transaction hash and facts, not your secret phrase. Report fraud to the relevant authority in your jurisdiction; U.S. victims can use ReportFraud.ftc.gov. A report may not reverse a transfer, but it creates a record and can help identify linked activity.
After the emergency: rebuild safely
- Keep the new recovery phrase offline in a location protected from fire, water and unauthorized access. Do not store it in screenshots, email, cloud notes or a password manager unless you have deliberately assessed that model’s risks.
- Use separate wallets for long-term holdings, daily dapp activity and testing unfamiliar contracts.
- Review allowances and operator permissions on a schedule, not only after a loss.
- Read transaction simulations and security alerts, but treat them as warnings rather than guarantees.
- For valuable holdings, consider a hardware wallet and a second, independently stored backup. Test recovery with a small amount before depositing substantial funds.
Self-custody means the signing key controls the asset. That gives you direct control, but it also means a confirmed unauthorized transaction generally cannot be reversed by the wallet provider.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
