Skip to content
Financial Context Wiki

What to do when a crypto wallet may be compromised

An incident-response runbook for suspicious transactions, leaked keys or seed phrases, malicious token approvals, and deceptive signatures: contain the incident, move assets safely, revoke permissions, and preserve evidence.

Updated

For educational purposes only; not investment advice. Investing may result in loss.

Direct answer

Treat a wallet as compromised when a seed phrase or private key may have been exposed, an unrecognized transaction was signed, a token approval or NFT operator permission is unexpected, or a deceptive typed-data signature was accepted. The first objective is containment: stop using the suspect device and address, preserve evidence, and avoid sending more gas to an address that may be swept.

Do not enter the seed phrase into a support form, “synchronization” page, or recovery service. From a clean, trusted device, create a new wallet with a new seed, verify its receive address on the device screen, and move the highest-value assets first when the threat model allows it. If the private key or seed is exposed, the old address is permanently untrusted; revoking approvals cannot make it safe.

Leaked private key or seed phrase

The holder can sign arbitrary transactions, including approvals and contract calls. Isolate the device, record addresses and transaction hashes, and plan a one-way migration to a newly generated wallet. Do not fund the old address without a specific, reviewed rescue plan.

Malicious token or NFT permission

The private key may still be safe, but a token allowance, Permit signature, or NFT operator approval may let a contract move assets. Revoke only through a bookmarked, trusted interface, then inspect all chains and token types for other permissions. A revocation transaction itself is a signature, so verify the chain, spender, token, and calldata before approving it.

Malicious typed-data signature or order

An off-chain signature can authorize a later transfer or order without an immediate wallet transaction. Disconnect the site, cancel or invalidate the order where the protocol supports it, revoke the resulting on-chain permission, and review recent signed messages. Treat unfamiliar typed-data domains, amounts, deadlines, and spenders as hostile until independently verified.

Device, browser, or phishing compromise

If malware, a fake extension, remote-access tool, or phishing page may have captured secrets, stop signing on that environment. Preserve the page URL, extension name, downloads, and timestamps, then use a freshly installed or hardware-isolated environment. Changing a password alone does not rotate a blockchain key; migrate funds to a new seed.

What to do when a crypto wallet may be compromised
0 / 5
0 items reviewed; 5 items still unresolved

Completing this review does not prove an asset, transaction, or system is safe.

How it works

On-chain ownership is enforced by valid private-key signatures. A token allowance or NFT operator approval is a separate capability that lets a contract call a token contract on the owner’s behalf:

Transfer path = wallet signature or previously authorized contract call

Revoking an allowance closes the second path only. It cannot invalidate a leaked private key, undo a confirmed transaction, or remove an already signed off-chain order unless the protocol provides cancellation or nonce invalidation. Permit extensions and typed data make this distinction important: a signature can be collected off-chain and submitted later.

Most blockchain transfers are irreversible. Official support should never ask for a seed phrase or private key. Use the chain explorer and the wallet or hardware-device display to verify the network, destination, contract, method, amount, token ID, spender, and deadline before signing.

Example

The old wallet has:

  • 15,000 USDC;
  • 3 ETH;
  • NFTs worth $2,000;
  • 5 ETH supplied as collateral and 4,000 USDC debt in Aave;
  • Miscellaneous tokens worth $300.

If a key leak is suspected, first use a clean environment to prepare a new wallet and move liquid assets that can be transferred without interacting with the compromised device. Keep enough trusted gas for the reviewed sequence, but do not repeatedly top up an address that is being swept. For the Aave position, prepare 4,000 USDC only from a safe source, then check the health factor, repayment route, withdrawal order, and whether a trusted third party can repay or execute on behalf of the account; transferring a receipt token does not automatically settle the debt.

Assuming 5 ETH is worth $15,000 at $3,000 and the debt is $4,000, the position has a buffer, but liquidation thresholds and prices can change. Do not attempt complex contract calls from the old wallet unless the calldata and signer are independently reviewed.

Expected preserved value = asset value × probability of successful transfer − incremental operation risk

This is a decision aid, not a valuation formula. A risky rescue signature for a small balance can delay or endanger a much larger, straightforward transfer.

Risks

  • Pending approvals, vesting, staking withdrawals, and future airdrops can create later exposure; monitor the old address without signing from it.
  • A clean-looking balance does not restore trust. Attackers may wait for gas, an unlock, or a larger deposit.
  • Use separate layers: a cold wallet for long-term value, a transaction wallet for routine protocols, a temporary wallet for experiments and airdrops, and an observation address with no imported private key.
  • Set approval limits, revoke unused permissions after a reviewed interaction, and check all relevant chains from trusted devices. Avoid connecting every tool on a fixed schedule.
  • Practice recovery with an empty wallet or test seed. Hardware wallets protect key extraction, not malicious transactions that a user confirms.
  • Preserve evidence: transaction hashes, chain IDs, URLs, domains, wallet prompts, extension versions, and timestamps. Report theft to the relevant exchange, protocol, wallet vendor, and law-enforcement channel; do not promise that a report will reverse a confirmed transfer.

Common misconceptions

Myth 1: The balance has not moved, so the seed is safe

An attacker may be waiting or may not have detected the address. Exposure of a seed or private key is enough to retire the address.

Myth 2: Revoking an approval makes a leaked key safe

Revocation removes a contract capability; it does not rotate or invalidate the private key.

Myth 3: A new address in the old wallet is a clean wallet

Addresses derived from the same seed remain controlled by that seed. Generate a new seed in a trusted environment.

Myth 4: Sending more gas guarantees a rescue

Automated sweepers can take the gas immediately. Use a reviewed private-transaction or third-party-relay plan only when its trust assumptions and calldata are clear; never keep topping up blindly.

Myth 5: An “on-chain recovery hacker” can unlock the funds

Secondary scams target incident victims. Never share a seed, install remote-control software, or pay an “unfreezing” fee.

Sources

Navigation

Search the wiki...