Crypto news and analysis
Advanced · Security

How to respond to a wallet compromise

Follow a wallet incident triage process: identify exposed authority, protect clean assets, revoke permissions, preserve evidence, and rebuild from trusted devices.

14 min read3-question quizUp to 215 XP

An unknown token transfer appears minutes after a user approved an unfamiliar contract, while other assets and the recovery phrase may still be safe. That is an incident requiring authority classification, not merely a customer-service ticket. Blockchain transfers are generally not reversible by a wallet provider, and the first objective is to identify what the attacker can control before exposing remaining assets through the same environment.

Speed matters, but unstructured speed can worsen the loss. Revoking one approval does not help if the recovery phrase itself is exposed, and sending assets from a malicious device may reveal the destination or sign an altered transaction. A short triage process separates key compromise, approval abuse, account compromise, and display errors before choosing containment actions.

What you will learn

  • Classify incidents by exposed key, approval, session, device, or account authority
  • Prioritize containment actions without reusing compromised secrets or devices
  • Preserve transaction and communication evidence for reporting and later analysis

Establish facts and a clean channel

Record what was observed: unknown transaction, changed balance, suspicious signature, exposed recovery phrase, lost device, fake support interaction, or exchange alert. Note times, affected addresses, chains, assets, transaction hashes, websites, and devices. Confirm activity with more than one reputable block explorer or direct wallet data source because interface indexing errors can mimic disappearance.

Move incident work to a known-clean device and communication channel when compromise is possible. Do not install tools recommended by unsolicited helpers, share the recovery phrase, or send a so-called verification payment. If an organizational wallet is involved, activate the existing incident plan and contact authorized signers through established channels before individual actions conflict.

Classify the exposed authority

If a private key was revealed, assume its address is compromised. If a mnemonic was revealed, treat every wallet the attacker can reconstruct from the exposed recovery inputs as compromised. A separate passphrase that was never disclosed may prevent immediate derivation of that wallet, but the mnemonic should still be retired rather than trusted as a lasting security boundary. A local wallet password change does not alter any exposed keys. If only a token approval was granted, the attacker may be limited to the approved asset, amount, chain, and spender, although the same interaction could have requested several permissions.

A lost locked hardware wallet is different from an exposed backup, but do not assume its lock provides a known response window. Resistance to extraction varies by device, configuration, attacker, and vulnerability. Follow the manufacturer's current incident guidance and migrate when the value at risk justifies it. A compromised exchange login affects custodial balances and recovery settings rather than self-custody keys. Malware may alter displayed destinations or steal sessions, so its scope remains uncertain until the device is rebuilt or professionally examined.

Contain what remains controllable

For exposed keys, create a new wallet using trusted hardware and fresh randomness, verify its backup, and move remaining assets and protocol positions. Consider tokens, NFTs, staked assets, liquidity positions, claimable rewards, and assets on every chain. Do not import the exposed phrase into the clean wallet or reuse its addresses as destinations.

For approval-only incidents, revoke affected allowances using a trusted interface or direct contract interaction, but understand transaction ordering. An attacker monitoring the address may submit a transfer before the revocation confirms, especially when blockspace is congested. Moving the approved asset to an address the spender cannot access may be preferable in some cases, but there is no universal sequence: token behavior, gas, pending transactions, protocol positions, and the attacker's automation all affect the race.

Preserve evidence and report accurately

Save transaction hashes, full URLs, domain registration clues, messages, email headers, wallet prompts, downloaded filenames, account alerts, and a timeline. Screenshots are useful context but transaction hashes and original message data are easier to verify. Preserve files without reopening them on a clean operational device if they may contain malware.

Report malicious addresses and domains to relevant wallet providers, exchanges, hosting services, law enforcement, or national cybercrime channels as appropriate. If funds reach a centralized exchange, a prompt report may help that service identify an account, but freezing or recovery is not guaranteed and depends on jurisdiction, evidence, timing, and the exchange's procedures. Do not pay private recovery agents who promise certainty.

Rebuild and learn without contaminating the new setup

Reset or rebuild affected devices, reinstall software from verified sources, rotate account credentials from a clean environment, end sessions, and review email and phone recovery. Generate new keys rather than restoring exposed ones. Inspect whether browser synchronization, cloud backups, password storage, or extensions could reintroduce the original compromise.

After containment, write a factual timeline and identify the failed controls: navigation, signature interpretation, account recovery, device separation, allowance scope, or monitoring. Change the smallest set of procedures that would have prevented or bounded the event, then test them. Do not make the replacement system so complex that routine mistakes become more likely than the original attack.

Reality check

Common misconceptions

Wallet support can reverse an unauthorized blockchain transfer.

Wallet software usually cannot change finalized network history. Exchanges or issuers may sometimes freeze assets under their own controls, but recovery is uncertain.

Revoking approvals fixes an exposed recovery phrase.

Anyone with the phrase can sign direct transactions and grant new approvals. Remaining assets need migration to keys generated in a clean environment.

A visible balance means an attacker no longer has access.

The attacker may be waiting, unable to pay gas, targeting a locked position, or using an outstanding allowance later. Authority must be removed, not inferred absent.

Before you act

Risks and limitations

  • Public rescue transactions can reveal destination addresses and create a race with an automated attacker.
  • Congestion, insufficient gas, lockups, or protocol pauses can prevent immediate migration or revocation.
  • Interacting from an infected device can expose fresh addresses, credentials, or replacement transactions.
  • Fake responders target incident victims with recovery scams, remote-access tools, and requests for additional payments.
  • Cross-chain positions and derivative wallet addresses may be overlooked during hurried containment.

Key takeaways

  1. Verify the event and move response work to a clean environment.
  2. Classify whether keys, approvals, sessions, accounts, or devices are exposed.
  3. Migrate from exposed keys; revoke when authority is limited to allowances.
  4. Inventory every chain, token, NFT, and protocol position before declaring containment.
  5. Preserve hashes, messages, URLs, and a precise timeline for reporting.
  6. Rebuild affected systems and test the revised operating procedure.

Primary and further reading

Knowledge check

Test your understanding

Score at least 2 out of 3 to complete this lesson. Explanations appear after you submit.

1. A user entered a recovery phrase into a fake support page but sees no unauthorized transfer yet. What assumption should drive containment?
2. A verified transaction shows an unlimited spender allowance, but the user never exposed keys or a recovery phrase. Which containment action directly removes that authority?
3. An exchange asks a victim for independently verifiable evidence of the unauthorized transfer. What should accompany screenshots?