When something goes wrong with a wallet, answer one question before you transfer anything: does the other party have your seed phrase or private key, or only an approval you once signed? The two call for different responses. Take the wrong one and you either do a lot of work for nothing or leave the real opening untouched.
First decide: a leaked seed phrase, or only a malicious approval
Seed phrase or private key leaked: the other party can sign any transaction just as you can. Every account on every chain under that seed phrase is no longer safe. Revoking approvals does nothing here, because they do not need an approval. There is one remedy: generate a new seed phrase and move the assets to it.
Malicious approval: the other party can move only the token you approved, up to the amount you approved. The seed phrase has not leaked, the address can stay in use, and revoking the approval stops the loss.
The table below shows how to tell which one you are dealing with:
| What happened | Treat it as | Why |
|---|---|---|
| You typed or sent the seed phrase or private key on a web page, in a form or in a chat | Leak | Whatever the other side called it: restoring a wallet, verifying an address or claiming an airdrop |
| The seed phrase was screenshotted or photographed, or was ever stored in cloud storage, email or chat history | Leak | Once someone logs in to that cloud or chat account, they have the seed phrase |
| You find an unfamiliar browser extension, process or remote-control login on the device | Leak | The clipboard and your keystrokes may both have been read |
| An outgoing transfer you did not initiate appears on-chain, and the transaction's sender (From) is your own address | Leak | Someone signed that transaction with your private key |
Tokens were taken, but the transaction's sender is someone else and the call is transferFrom |
Malicious approval | They used an approval you gave earlier |
| You signed an approval or signature on a suspicious site and nothing has moved yet | Check as a malicious approval first | Also think back over whether you entered the seed phrase on that site |
The difference between the fourth and fifth rows has to be read in a block explorer: open the outgoing transaction and see who is in the From field. If you cannot tell which case you are in, treat it as a leak. The only extra cost is one move to a new wallet.
Seed phrase or private key leaked: the order to work in
The outline of this path matches MetaMask's Help Center guidance for a compromised wallet: create a new wallet on a different device, send the remaining assets to it, and stop using the old wallet for good. The steps below go through it in order.
Take stock first, without moving funds
First find out how much there is to move, looking at data only. Three tasks:
1. List every address this seed phrase controls. One seed phrase can derive many accounts (Account 1, Account 2 and so on in MetaMask), and a hardware wallet has addresses under each derivation path as well. Keep the list on the device or on paper, not in a notes app that syncs to the cloud.
2. Check balances address by address and chain by chain. EVM chains each have their own block explorer (Etherscan, BscScan, Arbiscan and others). Use Solscan for Solana, mempool.space for Bitcoin and Tronscan for Tron. Check every chain you have used. Looking only at Ethereum Mainnet and missing a layer 2 such as Arbitrum is an easy oversight.
3. Rank the assets by value and by how hard they are to move. The rest of the work follows this list.
Taking stock does not take long, and it decides whether anything gets missed later: assets in other accounts and on other chains all sit under the same seed phrase.
Create a new wallet on a clean device
The new wallet has to meet three conditions:
- A freshly generated seed phrase. Do not reuse the old one, and do not open a new account under it either. MetaMask's guidance is to discontinue the old wallet and every account associated with the compromised Secret Recovery Phrase, and an account added under the old phrase is still one of those.
- Generated on a device that has had no problems. The safest option is a brand-new hardware wallet. Without one, use a phone or computer that had nothing to do with this incident, install the wallet from the official source and create the new wallet there.
- The seed phrase recorded with pen and paper only. No photos, and nothing stored on any internet-connected device. In a hurry it is tempting to save it in a notes app and delete it later. Do not do that.
For choosing a hardware wallet, see the hardware wallet comparison table.
A restart does not fix it. If the device has a keylogger or a clipboard hijacker on it, the new seed phrase can be read the moment it appears on screen. What has to change is the device. Changing browsers or wallet apps does not count.
If there is no time to prepare a new wallet, you can first send the assets to the deposit address of an exchange account in your own name as a temporary landing place. The network you choose on the exchange's deposit page must match the chain you are sending from. The condition is that the exchange account's email, password and 2FA were not touched by this incident. Once the funds arrive, change the password, reset 2FA and check the API keys and withdrawal allowlist, then prepare the new wallet.
Move assets out in order
With the new address ready, transfer in the order of the table below. Assets that leave in a single transfer go first, and those that need several steps come later.
| Order | Asset type | How to move it | Transactions to sign |
|---|---|---|---|
| 1 | Stablecoins and spot holdings of major coins (ETH, SOL, BTC, BNB and so on) | Transfer straight to the new address | One per coin |
| 2 | Liquid staking tokens (such as stETH) | They are tokens in their own right, so transfer them directly without unstaking first | One per token |
| 3 | Deposits in lending protocols | Withdraw first, then transfer | At least two |
| 4 | Liquidity positions (LP tokens or LP NFTs) | Transfer the LP token or NFT to the new address and remove the liquidity from there | One per position |
| 5 | NFTs | Transfer them one by one to the new address | One each |
| 6 | Shares in lockup or vesting contracts | See whether the contract allows the beneficiary address to be changed. If it does not, note down the contract address and the unlock time | Depends on the contract |
| Last | Complex positions that take many steps to exit | Estimate the time and fees an exit would take. Leave the ones that are not worth it until last, or give them up | — |
What to do about gas when a sweeper bot is watching the old address
After a seed phrase leaks, the other party may put a sweeper bot on your address: any coin that arrives is moved out at once, including the little you send in to pay for gas. MetaMask's Help Center makes several points on the page What to do if you have a sweeper bot on your wallet:
- Do not deposit more funds to this address. Whatever goes in will most likely be lost as well.
- The remaining assets can potentially be recovered using Flashbots, with another account paying the gas for the compromised one. MetaMask also states that this takes significant technical know-how, and that the page is a general guide only.
- The other route is to ask the Flashbots whitehat team for help. According to that page, the team requires a $1,000 asset recovery minimum and takes a 5% to 10% cut of the recovered assets.
So there are two cases. If the gas already in the old address is still there and nothing suggests it is being swept, use that gas and transfer directly in the order of the table. If gas you send in disappears as soon as it arrives, a sweeper bot is on the address. Do not keep topping it up. Use the route on the official page above to weigh whether the remaining assets are worth retrieving.
Once the assets are out, retire every address under the old seed phrase and send nothing more to them. On this path there is no need to revoke approvals on the old addresses: the other party has the private key, so revoking changes nothing, and what limits the loss is getting the assets out.
Only a malicious approval: revoking is enough
If you conclude that the seed phrase has not leaked and only an approval went wrong, the address does not need replacing. Do four things:
- Revoke the suspicious approvals. Using Revoke.cash or a block explorer's Token Approval Checker, revoke the approvals you cannot identify and the unlimited ones. The same address has separate approvals on Ethereum, Arbitrum, BNB Chain, Polygon and other chains, so check every chain you have used. The detailed steps are in how to check and revoke token approvals.
- If you signed a suspicious Permit or Permit2 signature, deal with it in the Signatures tab on your Revoke.cash account page and in the approval list, and move the affected token to another address. These signatures have a stage before activation and a stage after it, handled differently, and that article has a section on it.
- Top up gas as normal. Revoking is an on-chain transaction and costs gas. The private key has not leaked in this case, so gas you send in will not be taken. Send what you need.
- Recheck with a different tool. If you revoked through Revoke.cash, look again in a block explorer and confirm that those approvals are gone.
If at any point in this check you find a sign pointing to a leaked seed phrase, go back to the previous section and treat it as a leak.
In both cases: close the entry point
Once the assets are settled, work out where the other party got in. If the entry point stays open, the new wallet or new approvals will run into trouble again. Four tasks:
1. Check the device. MetaMask's guidance is to go through your browser history and scan the computer. I would add: review recently installed apps and browser extensions, update the operating system and software, and run a malware scan on every device the wallet was installed on. If you can, reinstalling the operating system on the affected device is more thorough.
2. Clean up browser extensions. Remove every extension you do not need, reinstall the ones you keep from the official store, and check the publisher before installing.
3. Check linked accounts.
- Email: change the password, reset 2FA, and look for any mail forwarding rule you did not set up.
- Exchanges: first shut off withdrawals with the freeze-account or pause-withdrawals function in the security center (the name differs between exchanges, so go by the help center), then reset 2FA and check the API keys and withdrawal allowlist.
- Social accounts (X, Discord, Telegram): remove every logged-in device you do not recognize.
- Third-party sign-in: review the apps authorized on your Google and Apple accounts.
4. Think back over the entry point. Did you recently enter the seed phrase on any website? Was it ever stored in cloud storage, email or chat history, or screenshotted? Did you install a wallet app, extension, document or cracked software from an unknown source? Was the device ever lent out, sent for repair or lost?
The tokens are already gone: what can still be done
On-chain transfers cannot be reversed. MetaMask's guidance for a compromised wallet is explicit: transactions cannot be reversed, and MetaMask cannot restore missing funds. What you can do is limited, but worth doing:
- Keep the evidence. Transaction hashes, the other party's addresses, chat logs, screenshots of the suspicious site, the original emails (with full headers) and account login logs.
- Report it. In the United States, file with the FBI's IC3 and the FTC. In the United Kingdom, use Report Fraud. In Australia, use ReportCyber and Scamwatch. In Canada, contact the Canadian Anti-Fraud Centre. In Hong Kong, contact the police Anti-Deception Coordination Centre (ADCC). In Taiwan, contact the 165 anti-fraud hotline. Bring the material above when you report.
- Flag the other party's address. You can report the address through the block explorer and submit a report to Chainabuse.
After a theft, people calling themselves on-chain analysts, hacker recovery teams or an official security group may message you and ask for an investigation fee or an unlocking deposit up front. Treat any recovery service that approaches you first and wants payment in advance as a scam.
Habits that keep the loss small when something goes wrong
- Separate main holdings from everyday interaction. Use two different seed phrases for the address that connects to dapps and the address that holds your main assets. If one is compromised, the other is not dragged in.
- Keep large amounts on a hardware wallet. Leave in a hot wallet only what you could accept losing.
- Keep the seed phrase off anything connected to the internet. Cloud notes, cloud drives, email and chat history are all out. The moment someone logs in to one of those accounts they have the seed phrase, and you may not find out until the assets move. For backup methods, see how to store your seed phrase.
- Clear approvals regularly. Revoke approvals for dapps you no longer use and lower the unlimited ones.