How to Recover a Hacked Crypto Wallet (Calm, Step-by-Step)

Discovering that your crypto wallet has been hacked is frightening, and the instinct is to panic. This guide is the opposite: a calm, ordered checklist of what to do first, what can realistically be recovered, and — just as important — how to avoid the 'recovery' scams that prey on people in exactly this moment.

The first few minutes

Take a breath. Acting carefully now matters far more than acting in a blind rush. The single most useful thing you can do is rescue whatever funds remain before the attacker takes more. If your seed phrase may be compromised, every wallet derived from it is at risk — not just the one that was drained.

1. Stop interacting with the affected wallet. Don't approve any more transactions or sign any messages.
2. Create a brand-new wallet on a clean device, with a completely new seed phrase that has never touched the internet.
3. Move any remaining assets to that new wallet, highest-value first.
4. Disconnect the compromised wallet from any sites it's connected to, but assume it is no longer safe regardless.

Work out how it happened

Understanding the entry point tells you what else is exposed and how to rebuild safely. Most wallet compromises trace back to one of a handful of causes.

• Seed phrase leaked — typed into a fake site, stored as a photo or note, or entered into a 'wallet validation' pop-up. This is the most serious: the whole wallet is gone.
• Malicious approval — you signed a transaction on a decentralised exchange or dapp that granted a contract permission to spend your tokens. The wallet itself isn't leaked, but specific tokens can be drained.
• Fake app or browser extension — a counterfeit MetaMask or wallet clone that captured your keys.
• Device malware — a compromised computer or phone with a clipboard hijacker or keylogger.

If your seed phrase was never exposed and only certain tokens left, the cause is almost always a malicious token approval rather than a full wallet breach.

Revoke approvals and secure your devices

Token approvals are standing permissions you grant to smart contracts. A common drainer leaves an open approval so it can keep taking tokens whenever your balance refills.

1. Use a reputable approval-checker tool (such as the official one built into many wallets) to review and revoke any active token approvals on the affected wallet.
2. Remember that revoking costs a small network fee and only matters for funds still in that wallet — the priority is still moving funds to a fresh wallet.
3. Run a full malware scan on any device that touched the wallet. If in doubt, treat the device as compromised and reset it.
4. Change passwords and enable app-based two-factor authentication on your email and exchange accounts, which are frequent secondary targets.

Report it (and set expectations)

Reporting rarely recovers funds, but it's still worth doing — it helps authorities track patterns and may matter for insurance or tax records.

• Report to your national cybercrime or fraud reporting body (for example, Action Fraud in the UK or the FBI's IC3 in the US).
• If funds moved to a known exchange, contact that exchange's support with the transaction hashes — they occasionally freeze stolen funds, though there's no guarantee.
• Keep a written timeline and screenshots. You'll need them for any report and to keep your own thinking clear.

Beware the second scam: fake recovery services

Victims of a hack are immediately targeted by a second wave of fraudsters posing as 'fund recovery agents', 'white-hat hackers', or 'blockchain forensic experts'. They watch public victim posts and slide into your replies or DMs within hours.

• They guarantee they can 'reverse the transaction' or 'trace and return' your coins — technically impossible.
• They ask for an upfront fee, a 'gas deposit', or a 'tax' before releasing your funds.
• They ask for your seed phrase or remote access to your device to 'restore' the wallet.
• They impersonate the support team of your wallet or exchange.

Rebuild safely

Once the immediate fire is out, set yourself up so this is far less likely to happen again. The biggest single upgrade is moving long-term holdings to cold storage.

A hardware wallet keeps your keys on a dedicated chip that never exposes them to your computer, so even a malware-infected device can't leak them. Generate a fresh seed phrase on the new device and store it offline, on paper — never digitally.

Frequently asked questions