← All guidesGuide · 6 min read

Crypto wallet hacked? What to do in the first hour

Last updated

If you’ve lost funds to a hack, a drainer or a scam, the next hour matters. Your goal is to protect what’s left, not chase what’s gone. Blockchain transactions can’t be reversed.

If it’s a self-custody wallet

  1. Assume your seed phrase or private key is compromised, even if you don’t know how.
  2. Create a brand-new wallet with a new seed phrase on a device you trust. Don’t reuse the old seed phrase with a new app.
  3. Move remaining funds to the new wallet immediately, starting with the most valuable. Attackers often run bots that sweep any new deposits, so act quickly.
  4. Revoke token approvals on the old address. See our token approvals guide.
  5. Stop using the old wallet permanently.
If you don't have gas money to move tokens, be careful: sending gas to a compromised wallet can be swept by the attacker's bot before you use it. Get help from a reputable source rather than a stranger who offers to help.

If it’s an exchange account

  1. Contact the exchange through its official website or app, not through social media.
  2. Change your password and email password, and switch to app-based or passkey two-factor authentication.
  3. Check for changes the attacker made: new API keys, new withdrawal addresses, changed email or phone number.
  4. If your phone lost service around the same time, read about SIM swaps and call your carrier.

Find out how it happened

Common causes, so you can fix them:

  • You entered your seed phrase on a website or in a fake app.
  • You signed a malicious approval or permit on a scam site.
  • Malware on your computer, often from pirated software or a fake download.
  • The seed phrase was stored in a photo, notes app, email or cloud drive.

If you suspect malware, don’t create your new wallet on that computer. Use a clean device or a hardware wallet.

Report it

  • In the US, report to ic3.gov and reportfraud.ftc.gov.
  • If the funds went to an exchange, contact that exchange with the transaction details. They may be able to freeze them.
  • Save transaction hashes, addresses, screenshots and messages.

Avoid the recovery scam

Right after a theft, victims are flooded with offers from “crypto recovery experts,” “blockchain investigators” or “hackers” who promise to get funds back for an upfront fee. They are almost always scammers. Legitimate investigators don’t cold-contact victims in comments and DMs.