Crypto Wallet Hacked or Drained: What to Do in the First Hour

If your crypto wallet was hacked, here is what to do first: treat the wallet as exposed, and from a device you trust create a new wallet with a new recovery phrase (the list of words that gives access to a wallet; see what a seed phrase is). Then move what is left into it. Anyone who offers to check or recover the old wallet and asks for your phrase or a signature can take the rest.

Own wallet or exchange account?

Ask one question first: did the coins leave a wallet where you hold the phrase, or an account on an exchange where you log in?

If you log in to an exchange, follow what to do if you think someone got into your exchange account instead. The rest of this page is for a wallet you control: an app, a browser extension or a hardware wallet.

Common causes of a drained wallet

Whether it is a MetaMask wallet drained or another app, check the wallet's history or a block explorer first. Look at each unauthorized transaction's date and time, recipient address, the app involved and the amount (opens in a new tab). How to read a transaction explains the screen.

Three of the common causes when a crypto wallet is drained or compromised:

• A leaked phrase or private key: typed into a site, shared with someone, or saved in a cloud service, screenshot or notes app that someone else reached.
• A signed approval. A token approval is a permission that lets an app move tokens in your wallet on your behalf.
• Malware on the device, such as keyloggers, clipboard hijackers or malicious browser extensions.

You may not be able to tell which one it was. That is common (opens in a new tab), and Phantom says to treat the wallet as compromised anyway. The same applies if you cannot rule out a leaked phrase or an infected device.

A sign of a leaked phrase: revoke.cash says (opens in a new tab) that if a sweeper bot takes any ETH (or other fee coin) as soon as it arrives, the seed phrase was compromised.

What to do in the first hour, step by step

As of October 2026, these steps follow the wallet makers' own help pages. Act first and work out the cause later, because every minute leaves the rest exposed.

1. Stop using the old wallet and the device you suspect

   Do not sign or approve anything from the old wallet except the sends and revokes below. Disconnecting an app only stops it reading your wallet data; it does not remove spending permissions (opens in a new tab) that already exist.

   If malware may be on the device, note that Trust Wallet says (opens in a new tab) that if malware or a keylogger is present, a new phrase made on that device is already compromised. So scan it and remove threats first, or use a different device if you cannot confirm it is clean. Do not wait for a scan before moving funds: use a second device you trust.

2. Create a new wallet with a new recovery phrase

   On the trusted device, download the wallet only from its maker's official site. MetaMask says (opens in a new tab) to create the new wallet in another browser, browser profile or, for mobile, on a second device, and to write the new phrase down in order.

   Write the new phrase on paper and keep it offline. Never photograph it or save it to the cloud. Check: the new wallet's address must differ from the old one.

   MetaMask also advises that if the old wallet used a Google or Apple sign-in, you should not link the same account to the new one, as it may be compromised.

3. Move what is left to the new wallet

   Open the old wallet only to send out. If you will revoke approvals in the next step, leave a little of each network's fee coin in it to pay for those transactions.

   Sweeper bots are scripts that send incoming assets on to another address (opens in a new tab) within moments. If one may be present, do not send in more of the fee coin to pay for gas. If anything you put in leaves again at once, stop: that is the sign of a leaked phrase described in the causes above, and nothing more should go in.

   Then check that the funds arrived in the new wallet. Tokens that will not move are covered in the FAQ.

4. Revoke approvals on each network you used

   Do this if a signed approval may be the cause or you cannot tell. Revoke.cash says (opens in a new tab) each approval covers one token on one network, so check every network you used.

   On the block explorer for that network, find its approval checker. Etherscan, BscScan and Polygonscan (opens in a new tab) each have one; Ethereum's is at etherscan.io/tokenapprovalchecker (opens in a new tab).

   Revoke.cash, another approval tool, says its core tools are free apart from the network fee. Revoking is a transaction, so the old wallet needs a little of that network's fee coin, one fee per approval.

   Revoking stops future pulls but cannot reverse past ones. If a sweeper bot takes your fee coin as it arrives, revoking will not help with wallet security: moving to the new wallet is the fix. Check: look the wallet up again and confirm the approval you removed no longer shows.

5. Secure the accounts around the wallet

   A compromised wallet is often tied to a wider breach, especially if the phrase was kept in email, cloud storage or a messaging app. From the trusted device, check those accounts for activity you did not cause, change passwords on any account that may have had access to the phrase, and turn on two-factor authentication.

   If you used an exchange with this wallet, see how to secure an exchange account.

6. Save the evidence

   Keep the transaction IDs, the receiving addresses, the site or message involved and the times. The list is in evidence to save before you report.

Example: a made-up drained wallet

This example is made up. It names no wallet or coin, and your wallet may label amounts differently.

• A browser wallet holds 500 Token A, 2 Token B and a little fee coin.
• Yesterday the owner signed a "claim reward" request on a site. This morning the history shows one transfer: all 500 Token A went to an unknown address. Token B and the fee coin are still there.
• One lost token points to an approval, but that does not rule out a leaked phrase. The owner treats it as a leaked phrase.
• On another device, the owner creates a new wallet, sends a small test of Token B, then the rest and the fee coin, leaving a little fee coin behind.
• From the old wallet, the owner revokes the approval on that network and pays a small fee.
• Token A does not come back. A "wallet recovery agent" messages that afternoon, and the owner does not reply.

The loss stopped at 500 Token A because the rest left before anything else could be taken. The numbers are invented, and the same order of steps works with any coin.

If you use a hardware wallet

A leaked phrase gives access even without your device. Trezor says (opens in a new tab) that if someone steals your wallet backup (its word for the recovery phrase), they can access your coins using a different device or wallet.

Hardware wallets give no extra protection against approval exploits (opens in a new tab), so a signed approval still needs revoking. If the phrase may be exposed, move the funds to a wallet with a new recovery phrase. Setting up a hardware wallet covers the device steps.

Report it and ignore recovery offers

As of October 2026, report the theft using the routes for your country in where to report a crypto scam. A report does not guarantee recovery (opens in a new tab), but it creates a record that can help investigators and exchanges. If the coins went to an exchange address, contact the exchange's compliance team (opens in a new tab) with the transaction hash. Use the exchange's official site or app.

Risks to understand

Transfers already made usually cannot be undone; see whether crypto transactions can be reversed. MetaMask says (opens in a new tab) it cannot reverse transactions or rescue funds, and Phantom says it cannot reverse, freeze or recover stolen funds.

Some scams grant ongoing permissions that stay active (opens in a new tab) after you disconnect an app, so an approval you did not revoke keeps working. Fixing one cause does not fix the others, so do not reuse the old phrase or address.

Your next move is how to store crypto safely for the new wallet, and how address poisoning works before your next send.