Discovering that your crypto wallet may be compromised is frightening, but fast, calm action can still limit the damage. Warning signs include transactions you did not authorise, tokens disappearing, unexpected approval requests, or a device behaving strangely after you clicked a suspicious link. If any of these appear, treat the wallet as unsafe immediately — in crypto there is no bank to reverse a transaction, so every minute of delay gives an attacker more opportunity. If the compromise involved a browser extension wallet, remove the extension and scan your device thoroughly before reinstalling anything, since the malicious code may still be present.

Your first move is to stop interacting with the wallet. Do not approve any pending transactions, do not enter your seed phrase anywhere, and do not click links promising to help recover funds — recovery scams specifically target people in this panicked moment. If funds remain, your priority is moving them to a completely fresh wallet created on a clean device, using a new seed phrase that has never touched the compromised device or any suspicious website. Some victims discover the compromise through a notification from their exchange about an unfamiliar withdrawal, which is another reason to keep transaction alerts switched on everywhere.

Creating that fresh wallet safely matters as much as speed. Use a device you trust, ideally one that has not been used with the compromised wallet, and download wallet software only from the official source. Write down the new seed phrase on paper and store it securely. Then transfer remaining funds in small test amounts first: send a tiny amount, confirm it arrives, and only then move the rest. This guards against mistakes made under pressure. When moving remaining funds, prioritise speed for larger balances but still use a test transfer, since a mistake made in haste can compound an already painful situation.

If the attacker has already drained funds, recovery is usually not possible, and you should accept that painful fact rather than chasing false recovery services. Anyone promising to recover stolen crypto for an upfront fee is almost certainly running a second scam. Instead, record everything: transaction hashes, wallet addresses involved, timestamps and screenshots. This evidence is useful for reports even when recovery is unlikely. Keep a written timeline of the incident, including when you first noticed it and what actions you took, because clear records help exchanges, investigators and insurers assess your case.

Next, revoke any token approvals the compromised wallet granted to decentralised apps, using a reputable approval-management tool, and disconnect the wallet from every connected site. Change passwords on related accounts, especially your email, and enable authenticator-based two-factor authentication everywhere it is available. If malware is suspected, assume the device itself is unsafe: back up important non-crypto files, then reset or replace the device before creating any new wallet on it. If you used the same password anywhere else, change those accounts too, since credential reuse is one of the fastest ways a single compromise spreads across your digital life.

Report the incident to the relevant exchange or platform if funds passed through one, and to local cybercrime reporting channels where available. Reports rarely recover funds, but they help authorities track scam networks and may help others avoid the same trap. If a significant amount is involved, consider consulting a professional who specialises in crypto incidents rather than acting on advice from strangers online. Consider informing people who may have received funds or messages from your compromised accounts, because attackers sometimes impersonate victims to target their contacts next.

Finally, rebuild your security from scratch rather than patching the old setup. Use a hardware wallet for significant holdings, separate wallets for different purposes, and a strict rule never to enter a seed phrase on any website. Review what went wrong honestly — a phishing link, a fake app, an approval granted carelessly — and fix that specific weakness. A compromise is a harsh lesson, but traders who learn from it often end up far safer than before. Recovery from a compromise is as much emotional as financial, so take time before making new investment decisions and avoid the temptation to win back losses with risky trades.