How to Know If Your Crypto Wallet Has Been Hacked: 10 Warning Signs

A confirmed transfer you did not authorize is the clearest warning that something is wrong. But a wallet can become unsafe before any money disappears. A stolen recovery phrase, a hidden spending permission, or a change to who controls the wallet can give an attacker access while your balance still looks normal.

Some warning signs below point to actual theft. Others show that your wallet or device may be exposed. The difference matters because the fix depends on how the attacker gained access.

If funds are leaving right now, stop sending money into the wallet and skip to the response steps near the end.

What does a hacked crypto wallet actually mean?

Your crypto is recorded on a blockchain. Your wallet helps you control it using private keys or other authorization rules. A recovery phrase, also called a seed phrase, can recreate the keys for many wallet accounts.

People use the word "hacked" for several different problems:

• Stolen keys: Someone has your private key or recovery phrase and can authorize transactions from another device.
• Abused permissions: You approved a contract or signed a request that lets someone move certain assets. Your keys may still be private.
• A compromised device or app: Malware, a fake wallet, or a malicious extension steals information or changes what you are about to send.
• A compromised exchange account: Someone accesses the account where a company holds crypto for you.

A hardware wallet helps protect private keys, but it cannot make a harmful permission safe. If you authorize the wrong action, the hardware wallet may sign it correctly.

1. Real crypto leaves your wallet without your authorization

You find a completed transfer, NFT sale, or withdrawal that you cannot explain. It may happen while your phone is off or while you are away from your computer.

First, rule out something you arranged earlier, such as an automated payment, an exchange withdrawal, or an action inside a trading app. Then check the actual transaction on the blockchain.

Confirm that a genuine asset moved and that your balance decreased. A strange entry in your wallet's activity feed is not enough on its own. Scammers can create misleading token records that appear to show transfers from your address.

Once you confirm an unauthorized movement of real assets, act immediately. You do not need to wait for the whole wallet to be emptied.

2. New deposits disappear almost immediately

You send ETH or another network coin into the wallet to cover transaction fees. Within seconds, it goes to an unfamiliar address. The same thing happens again with the next deposit.

This is a common pattern with a sweeper bot, a program that watches an exposed wallet and automatically takes available funds. After ruling out automation you deliberately set up, repeated withdrawals like this are a strong warning of unauthorized access.

The bot can run on the attacker's computer. Closing your wallet app or restarting your phone will not stop it. Some bots leave small balances alone until a larger deposit arrives, so money sitting untouched does not prove the wallet is safe.

Do not keep adding gas money or send a test deposit. You may simply be funding the attacker.

3. You find token or NFT permissions you do not recognize

Many crypto apps ask for permission to spend a token. These approvals can remain active long after you stop using the app.

Warning signs include a recently added spender you do not recognize, access granted after visiting a suspicious site, or a spending limit far larger than the action required. An NFT permission may let an operator transfer every NFT you hold in a particular collection.

An unlimited approval is common in legitimate apps, so it does not prove a hack. What matters is who has access, what they can move, and whether you intended to grant it.

Check the network, the real token contract, the spender, and the amount. Disconnecting the website from your wallet does not cancel an approval already recorded on the blockchain.

4. A supposed login request gives spending rights

You visit a site to sign in, claim a reward, or verify your wallet. It asks for a signature with no transaction fee. The request includes a token amount, a spender, or an NFT sale order that you did not intend to approve.

Some signatures can authorize spending without a separate approval transaction from you. Features called Permit and Permit2, along with marketplace order signatures, are useful examples. Legitimate apps use them, but scammers can disguise them as harmless login steps.

The lack of a gas fee tells you nothing about the signature's safety.

There is another catch: an unused signed permission may stay off the blockchain until someone submits it. Your usual transaction list, and sometimes your approval checker, may look clear while that permission is still usable.

If you signed a suspicious request, stop interacting with the site and investigate what the signature authorized. Cancellation depends on the type of permission. A normal approval revocation does not invalidate every unused signature.

5. The wallet has a new owner or unfamiliar control permission

Some wallets have several owners, recovery contacts, temporary signing keys, or software modules that can perform actions. These are often called smart wallets or smart accounts.

An owner you never added, a reduced number of required signatures, an unfamiliar recovery method, or a new module deserves immediate attention. Depending on its powers, that change may let someone move funds without your usual approval process.

On Ethereum and compatible networks, a feature called EIP-7702 also lets an ordinary wallet authorize code to operate through its address. A malicious authorization can create ongoing access without exposing your recovery phrase.

One detail is easy to miss: under this feature, an accepted delegation can remain even when the transaction's execution fails. A "failed" label does not always mean the wallet's control settings stayed unchanged.

Check these permissions using the wallet's official tools. Removing token approvals alone will not remove an unfamiliar wallet owner or delegation.

6. Your recovery phrase or private key was exposed

You entered your phrase on a website, sent it to someone claiming to be support, or imported it into a wallet app that turned out to be fake. You may also discover that a readable backup was accessible through a breached cloud account or shared file.

Treat the accounts controlled by that secret as compromised, even if nothing has moved yet. Someone can recreate the wallet elsewhere without triggering a login alert in your app.

Changing the wallet app's password will not change the exposed private keys. Creating another account under the same recovery phrase will not solve the problem either.

The scope matters. A leaked recovery phrase can expose many accounts. A leaked, separately imported private key may affect only the account it controls.

7. Your wallet app or extension appears to have been replaced

You discover an extension you never installed, a fake wallet download, or a security alert identifying software that steals wallet data. Your familiar wallet may also suddenly ask you to restore it after an unexplained change.

A restore prompt can have an ordinary cause, such as a reinstall or cleared app data. It is a reason to check the software before entering secrets, rather than proof of theft by itself.

Verify the app through the wallet provider's official website and check the extension's identity. A familiar name and logo are easy to copy.

If you already entered your recovery phrase into suspicious software, treat it as exposed. Removing the app does not remove a copy the attacker already has.

8. The receiving address changes when you paste it

You copy a recipient's address, paste it into your wallet, and get a different address. Clipboard malware can replace crypto addresses with ones belonging to an attacker.

This points to a problem with the device or software. It does not necessarily mean someone has your private key, but it makes that device unsafe for transfers.

Attackers can use replacement addresses that resemble the original. Checking only the first and last few characters can miss the switch. Compare the full destination against a trusted copy. With a hardware wallet, check the address on the device's screen before approving.

Cancel the transaction if the addresses differ. Repeatedly copying and pasting until one looks right is not a fix.

9. Unexplained losses spread across accounts or networks

One missing token can result from a specific spending permission. Unauthorized transfers across several accounts derived from the same recovery phrase raise concern about broader key exposure.

For example, losses on two networks plus activity from another account under the same phrase deserve a wider investigation. Check every affected account and network, rather than assuming the problem is limited to the first token you noticed.

This pattern helps narrow the cause, but it is not conclusive. Several malicious permissions, or a wallet authorization valid on multiple networks, can also create widespread losses.

A matching wallet address on different Ethereum-style networks is normal and is not a warning sign by itself. The warning is unexplained activity involving those accounts.

10. Your exchange account shows unfamiliar access or withdrawals

If you keep crypto on an exchange, check for unknown sessions, changed recovery details, new withdrawal addresses, or withdrawals you did not request. Unrequested two-factor changes are especially serious.

Open the official app or website yourself to verify the alert. A scary email can be phishing. An unfamiliar location can also result from a VPN or mobile network, so review the device, time, and account actions together.

An exchange account takeover requires an account-security response. Use the provider's account lock or withdrawal restriction if available, contact official support, and secure your email and authentication methods.

These login checks do not apply in the same way to a basic wallet controlled by a recovery phrase. Someone with its keys may never need to log in to your app.

Strange activity that does not prove a hack

Several common events can look alarming:

• A lower dollar balance: The price may have fallen while you still hold the same number of coins.
• Missing tokens in the app: You may have selected the wrong account or network, hidden the token, or encountered a display problem.
• An unknown Bitcoin output: A payment can send leftover funds back to a new change address controlled by your own wallet.
• An unsolicited token or NFT: Spam alone is not evidence that your keys were stolen. Hide it rather than following its links or signing a transaction to remove it.
• Tiny or zero-value transfers involving a familiar-looking address: These may be address poisoning, where scammers plant a lookalike recipient in your history so you copy it later.

Some fake tokens copy a genuine token's name and symbol. They can even create misleading outgoing transfer records. Check the real token contract and balance before treating a record as evidence of theft.

Avoid copying a recipient from recent activity. Get the address from a verified recipient or a trusted address book.

How to check what actually happened

Use a reputable blockchain explorer for the correct network. You can inspect a public address without connecting a wallet, paying a fee, or revealing a recovery phrase.

Check these details:

1. The account and network: Make sure you are inspecting the address that held the missing assets.
2. The transaction status: Separate pending activity from completed movements. For wallet delegations, also check whether permissions changed despite failed execution.
3. The actual asset: Confirm the token contract or NFT collection, rather than relying on its name or logo.
4. The balance change and destination: Identify what left and where it went. Review token and NFT transfers as well as the main transaction list.
5. Earlier permissions: Look for approvals, signatures, or wallet control changes connected to the loss.

The transaction's sender may be someone else's account when they use a token approval to take your assets. That does not make the transfer harmless. Likewise, a token record showing your address as the source does not prove that you personally signed a transaction.

If the chain records are difficult to interpret, share the public address and transaction hash with verified wallet support. Those details can help an investigation without exposing your keys.

What to do if the warning signs check out

Stop adding funds and signing requests

Pause deposits into the affected wallet. Reject new signing requests, including offers to "repair," "validate," or "unlock" it. Stop using a device that may be infected and continue from a separate trusted device.

If a recovery phrase or private key leaked

For an ordinary wallet controlled by the exposed secret, create a new wallet with a completely new recovery phrase on a trusted device. Move remaining assets if you can do so safely, then retire the affected accounts. Update any payment destinations that point to them.

If a sweeper is active, do not top up the old wallet for gas. Rescuing remaining assets may require specialist transaction handling, and success is not guaranteed.

If the problem is an approval or signed permission

Revoke the relevant permissions through a verified tool and confirm that the revocation completed. An approval for one token on one network does not automatically apply everywhere else.

For a suspicious signature that has not been used, follow the wallet or protocol's specific cancellation process. Moving assets may be necessary while you determine whether the permission remains usable.

Revocation cannot return assets already taken. It also cannot secure a wallet whose keys have leaked.

If wallet control settings changed

Use the wallet's official recovery or permission-management process to remove unauthorized owners, modules, signing keys, or delegations. If an owner key leaked, replace that signer where the wallet supports it. Get provider-specific guidance before treating the account as secure again.

If an exchange account was accessed

Lock the account or restrict withdrawals through the provider's official process. From a trusted device, secure your email, change affected passwords, remove unknown sessions, and review recovery details and two-factor authentication.

Keep evidence and report the loss

Save transaction hashes, public addresses, timestamps, suspicious URLs, and relevant messages while you protect remaining funds. Report the incident to the wallet or exchange and the appropriate authorities.

Confirmed blockchain transfers generally cannot be reversed by wallet support. Recovery may depend on an exchange freezing funds, an investigation, or funds being returned. Be wary of anyone promising guaranteed recovery, especially if they ask for an upfront payment or your recovery phrase.