Discovering unauthorised transactions or realising your seed phrase was exposed is frightening, and the instinct is to act instantly. But rushed moves cause second losses: sending funds to an address you copied wrong, typing your seed into a fake recovery site, or revoking approvals on a wallet whose keys are already gone. The right response has a clear order, and the first step is figuring out what kind of compromise you actually have.

Start by diagnosing the breach before you move anything. There are two very different situations. In the first, only a token approval was abused: funds moved for one token, but your seed phrase was never exposed. Here the wallet itself is still secure, and the fix is to revoke the malicious approval and rotate to a fresh address for caution. In the second, your seed phrase or private key was exposed, through a phishing site, a screenshot, malware, or someone seeing your backup. Here the wallet is fully compromised: the attacker can drain everything, and no approval revoke will save it.

If the seed is exposed, speed matters, but only in the right direction. First, disconnect the affected device from the internet to cut off active malware. Then, on a clean device, create a brand-new wallet with a brand-new seed phrase that has never touched the compromised device. Transfer remaining funds to the new wallet immediately, starting with the largest holdings, and verify each receiving address character by character. Do not reuse the old wallet for anything afterwards, and do not send funds back to it later. If you cannot move everything at once, move the most valuable assets first and accept that small balances may be lost.

Once funds are safe, clean up the damage around the wallet. Revoke all token approvals on the old wallet so nothing retains access, then abandon it. Scan your devices for malware, remove unknown browser extensions, and review login activity on every account linked to your crypto, especially email and exchange accounts. Change those passwords and enable authenticator-app two-factor authentication rather than SMS, which is vulnerable to SIM-swap attacks. Report phishing domains and scam contract addresses to block explorers and anti-phishing lists so others are warned.

The final step is rebuilding your security so the same failure cannot repeat. Generate the new seed on a trusted device, back it up offline in two separate places, and test the restore with a tiny amount before loading the wallet. Keep a separate hot wallet for experiments and a cold wallet for savings. Write down, in plain words, what went wrong the first time, whether it was a fake site, a screenshot, or a shared phrase, and remove that habit from your routine. Most compromises trace back to one repeatable mistake, and naming it is what prevents the second incident.

A compromised wallet is recoverable as long as you still control some funds and act in the right order: diagnose, move to a clean wallet, clean up devices and accounts, then rebuild with better habits. Stay calm, move deliberately, and never let urgency push you into typing your seed phrase into a site that promises to save you.

The first hour after discovering a compromise is when most second losses happen, so it helps to know the moves to avoid. Do not type your seed phrase into any website, tool, or support chat that promises to recover, freeze, or protect your funds: no legitimate service needs it, and every request for it is a scam. Do not send funds to an address you copied from a message or a search result without verifying it through a second channel. Do not pay anyone who contacts you claiming they can reverse the theft, since blockchain transactions cannot be reversed and recovery services asking for upfront fees are almost always frauds. And do not keep using the compromised wallet while you investigate, since the attacker may still hold access. Pause, diagnose, and move deliberately.