An unknown token transfer appears minutes after a user approved an unfamiliar contract, while other assets and the recovery phrase may still be safe. That is an incident requiring authority classification, not merely a customer-service ticket. Blockchain transfers are generally not reversible by a wallet provider, and the first objective is to identify what the attacker can control before exposing remaining assets through the same environment.
Speed matters, but unstructured speed can worsen the loss. Revoking one approval does not help if the recovery phrase itself is exposed, and sending assets from a malicious device may reveal the destination or sign an altered transaction. A short triage process separates key compromise, approval abuse, account compromise, and display errors before choosing containment actions.
What you will learn
- Classify incidents by exposed key, approval, session, device, or account authority
- Prioritize containment actions without reusing compromised secrets or devices
- Preserve transaction and communication evidence for reporting and later analysis
Establish facts and a clean channel
Record what was observed: unknown transaction, changed balance, suspicious signature, exposed recovery phrase, lost device, fake support interaction, or exchange alert. Note times, affected addresses, chains, assets, transaction hashes, websites, and devices. Confirm activity with more than one reputable block explorer or direct wallet data source because interface indexing errors can mimic disappearance.
Move incident work to a known-clean device and communication channel when compromise is possible. Do not install tools recommended by unsolicited helpers, share the recovery phrase, or send a so-called verification payment. If an organizational wallet is involved, activate the existing incident plan and contact authorized signers through established channels before individual actions conflict.
Contain what remains controllable
For exposed keys, create a new wallet using trusted hardware and fresh randomness, verify its backup, and move remaining assets and protocol positions. Consider tokens, NFTs, staked assets, liquidity positions, claimable rewards, and assets on every chain. Do not import the exposed phrase into the clean wallet or reuse its addresses as destinations.
For approval-only incidents, revoke affected allowances using a trusted interface or direct contract interaction, but understand transaction ordering. An attacker monitoring the address may submit a transfer before the revocation confirms, especially when blockspace is congested. Moving the approved asset to an address the spender cannot access may be preferable in some cases, but there is no universal sequence: token behavior, gas, pending transactions, protocol positions, and the attacker's automation all affect the race.
Preserve evidence and report accurately
Save transaction hashes, full URLs, domain registration clues, messages, email headers, wallet prompts, downloaded filenames, account alerts, and a timeline. Screenshots are useful context but transaction hashes and original message data are easier to verify. Preserve files without reopening them on a clean operational device if they may contain malware.
Report malicious addresses and domains to relevant wallet providers, exchanges, hosting services, law enforcement, or national cybercrime channels as appropriate. If funds reach a centralized exchange, a prompt report may help that service identify an account, but freezing or recovery is not guaranteed and depends on jurisdiction, evidence, timing, and the exchange's procedures. Do not pay private recovery agents who promise certainty.
Rebuild and learn without contaminating the new setup
Reset or rebuild affected devices, reinstall software from verified sources, rotate account credentials from a clean environment, end sessions, and review email and phone recovery. Generate new keys rather than restoring exposed ones. Inspect whether browser synchronization, cloud backups, password storage, or extensions could reintroduce the original compromise.
After containment, write a factual timeline and identify the failed controls: navigation, signature interpretation, account recovery, device separation, allowance scope, or monitoring. Change the smallest set of procedures that would have prevented or bounded the event, then test them. Do not make the replacement system so complex that routine mistakes become more likely than the original attack.
Common misconceptions
“Wallet support can reverse an unauthorized blockchain transfer.”
Wallet software usually cannot change finalized network history. Exchanges or issuers may sometimes freeze assets under their own controls, but recovery is uncertain.
“Revoking approvals fixes an exposed recovery phrase.”
Anyone with the phrase can sign direct transactions and grant new approvals. Remaining assets need migration to keys generated in a clean environment.
“A visible balance means an attacker no longer has access.”
The attacker may be waiting, unable to pay gas, targeting a locked position, or using an outstanding allowance later. Authority must be removed, not inferred absent.
Risks and limitations
- Public rescue transactions can reveal destination addresses and create a race with an automated attacker.
- Congestion, insufficient gas, lockups, or protocol pauses can prevent immediate migration or revocation.
- Interacting from an infected device can expose fresh addresses, credentials, or replacement transactions.
- Fake responders target incident victims with recovery scams, remote-access tools, and requests for additional payments.
- Cross-chain positions and derivative wallet addresses may be overlooked during hurried containment.
Key takeaways
- Verify the event and move response work to a clean environment.
- Classify whether keys, approvals, sessions, accounts, or devices are exposed.
- Migrate from exposed keys; revoke when authority is limited to allowances.
- Inventory every chain, token, NFT, and protocol position before declaring containment.
- Preserve hashes, messages, URLs, and a precise timeline for reporting.
- Rebuild affected systems and test the revised operating procedure.
Primary and further reading
Test your understanding
Score at least 2 out of 3 to complete this lesson. Explanations appear after you submit.