How to Respond to a Wallet Compromise
What to do in the first 60 minutes after a suspected wallet drain: triage, asset rescue, and forensic next steps.
What you'll need (prerequisites)
- Self-custodial wallet
- A second device for verification
- Block explorer (Etherscan, Solscan, etc.) familiarity
Recommended for this tutorial
Tools and accounts referenced in the steps below:
Step-by-step
-
Step 1: Identify the issue
Before any action, write down what happened and when. Screenshots, transaction hashes, and the exact addresses involved are essential — both for self-recovery and any external help.
-
Step 2: Isolate affected accounts
If a private key may be compromised, immediately stop using that wallet. Move any remaining assets to a freshly created wallet on a clean device. Do not interact with any unknown approvals or pending signature requests.
-
Step 3: Audit on-chain history
Open the affected address on Etherscan / Solscan / your chain explorer. Review the last 100 transactions. Look for unfamiliar approvals (revoke.cash), unauthorized transfers, and contract interactions you did not initiate.
-
Step 4: Revoke risky approvals
Use revoke.cash or Etherscan's token-approval tool to revoke any unfamiliar spender. Each revocation is its own on-chain transaction; budget gas accordingly.
-
Step 5: Document for tax / legal purposes
Save transaction hashes and timestamps. If the loss is significant, file a report with IC3 (US), Action Fraud (UK), or your local equivalent. Many jurisdictions allow theft deductions on taxes — check with a crypto-aware accountant.
-
Step 6: Harden the next setup
Treat this as a learning event: move to a hardware wallet, enable passphrase if not already, segregate wallets by purpose (hot for daily, cold for storage, burner for new dApps), and audit your sigsec.
Common errors and fixes
- Approval can't be revoked due to insufficient gas. Revoke transactions cost the same gas as a normal token transfer. Top up the wallet with a small amount of native gas token before revoking.
- Funds already drained. On-chain theft is generally irreversible. Document everything, file police / IC3 / Chainalysis Reactor reports, and contact the protocol team if a known exploit. CEX-side funds may be recoverable if the attacker on-ramped to a regulated exchange.
- Suspected key leak but no losses yet. Move all funds immediately to a freshly created wallet. Burn the old seed. Audit every device the seed touched (browser extensions, cloud backups, email).
- Cannot identify the malicious contract. Use Etherscan's "advanced filter" to filter by token approvals and unusual contract calls. Run the suspicious tx through Tenderly to decode the call.
- Phishing email looks real. Always verify by typing the URL manually. Real exchanges and protocols never email asking for seed phrase, password, or 2FA codes — full stop.
FAQ
What should I do in the first few minutes after my wallet is drained?
Move any remaining assets to a brand-new wallet with a fresh seed phrase immediately — speed matters more than tidiness. Do not stop to investigate first; get salvageable funds out, then revoke approvals and document what happened.
If my seed phrase or private key was exposed, is revoking approvals enough?
No. If the seed or private key itself leaked, the entire wallet is compromised and must be abandoned — revoking token approvals only stops contract-based drainers, not an attacker who holds your keys. Migrate everything to a new wallet whose seed has never touched the compromised device.
How do I revoke the approvals a drainer is using?
Connect to a trusted approvals tool such as revoke.cash or your wallet's built-in approvals screen, then revoke every unfamiliar or unlimited token allowance. This only helps when the attacker is exploiting an approval rather than your keys, and each revocation is an on-chain transaction that costs gas.
What can and cannot be salvaged after a drain?
On-chain transfers are irreversible, so anything already moved is almost certainly gone — your goal is protecting what remains and cutting off future access. Do not touch or try to transfer unknown dust tokens that suddenly appear, as some are bait designed to trigger a malicious approval when you interact with them.
How do I stop it from happening again?
Identify the root cause — a phishing signature, a malicious approval, a fake app, or an exposed seed — because a new wallet on the same compromised laptop or phone will be drained too. Rebuild on a clean device, keep the new seed offline, use a hardware wallet for real balances, and route risky dApp interactions through a separate burner.