Before you start
Check a few things before you act, so each step rests on facts rather than guesses. Write down when you first noticed the problem, since those details matter later.
- Identify exactly which wallet, blockchain and address were affected.
- Find out whether your seed phrase, the list of words that restores the wallet, was typed into an online form, sent in a message or photographed.
- Make sure you have a device you trust that has never held the compromised keys.
Avoid installing unfamiliar software or giving anyone remote access to your devices, since those are common routes for further theft.
Steps to take if your wallet is hacked
Work through these steps in order, and finish each one before you start the next. Speed matters, but a rushed move can expose the funds you are trying to protect.
- Stop using the compromised device for any money movement, and disconnect it from the internet.
- Create a new wallet on a clean device, with a newly generated recovery phrase that has never been typed anywhere else.
- Move remaining funds from the old address to the new wallet, starting with a small test transfer.
- Revoke token approvals, which are permissions that let other programs on the blockchain spend from the old address. Remove any you do not recognise.
- Secure the email account linked to your wallet and exchange accounts with new credentials and multi-factor authentication, and remove any forwarding rules you did not set.
- Do the same for exchange and other financial accounts, and ask each provider to freeze withdrawals if access may have been used.
- Scan your other devices for malware, or reset them before you use them for crypto again.
- Write down what happened, including dates, transaction identifiers, addresses, amounts and any messages from the attacker, and save screenshots.
- Report the incident to the provider of the affected wallet or exchange, then to the police or consumer authority in your country.
What to do if a step fails
Some steps may not work the way you expect. If you cannot move funds, the attacker may have changed the access method or may still control the keys.
If a transfer stays pending, do not send another one in a rush. Check its status on the blockchain, and ask your provider what they can see, because repeat sends can add cost and confusion.
If you see funds still leaving the wallet, tell the provider at once, since a freeze request depends on speed.
If an email or exchange account is locked, use the provider's official recovery route rather than a link sent to you. Be wary of anyone who offers to recover funds in return for a payment, since that is a common follow-up scam.
Realistic expectations about recovery
Recovery is often partial, and sometimes impossible. Blockchain transfers are generally final once confirmed, so many thefts cannot be reversed by anyone.
Some providers can freeze funds or help trace them, especially when stolen assets reach an exchange. Results depend on the provider, the blockchain involved and how quickly you report. Check the provider's published policy or your local authority for what they can do.
Expect the process to take time. Keep your records, answer genuine requests from providers, and treat any unexpected contact about your case with caution. A service that asks for payment up front to recover funds is a warning sign in itself.
Where this matters when choosing a provider
How a provider handles security incidents is worth comparing before you deposit funds. A guide on how to choose a wallet covers the points that matter most, including key control and recovery options.
The custody model changes who can freeze, reverse or recover your funds. Check it before you move assets, since the answer shapes what help is possible after an incident.
Keeping keys off internet-connected devices lowers the chance of this kind of compromise, which is why a hardware wallet is often considered. It does not remove the need to protect your recovery phrase or keep a backup of it.
Crypto assets can lose value, and the protection you have varies by country, so weigh each provider against that risk.