What to Do if Your Crypto Wallet Gets Hacked
If crypto leaves your wallet without your permission, protect what remains. Stop signing requests from the suspicious site. Stop deposits to the affected address, including recurring payments. Do not pay anyone to verify, repair, or unlock the wallet.
Confirm what actually left
Check the correct network and your public address in a trusted block explorer, a website showing blockchain records. Reading it does not require connecting your wallet or entering your recovery phrase.
On Ethereum and similar networks, fake tokens and zero-value transfers can create outgoing-looking entries without your signature. A scary history entry alone does not prove your keys were stolen. Check the genuine asset's balance and, for tokens, compare the contract address, its on-chain identifier, with the issuer's official documentation.
If a harmful transfer is still pending, follow your wallet's official cancellation instructions immediately. Cancellation depends on the network and may fail. Wallet support generally cannot undo a confirmed transfer.
Lock an affected exchange account
If an exchange holds your funds, use its account-lock feature if available and contact support through its real app or website. Secure the associated email, change compromised passwords, and remove unknown login sessions and API keys, which let software access the account. Follow the exchange's recovery process.
If your bank or card was charged
Check bank and card statements for purchases or transfers you did not approve. Contact the bank's fraud team through its app or the number on your card. Ask about blocking further payments, disputing unauthorized charges, and recalling recent transfers. Report the incident to the exchange or payment service involved too.
Explain whether someone made the payment without your permission or you were tricked into making it. The bank may handle those situations differently. A bank or card dispute is separate from recovering crypto already stolen on the blockchain.
If your email or phone was compromised
Secure the email linked to your exchange accounts from a clean device. Change its password, remove unknown signed-in devices, and check recovery phone numbers, recovery emails, and forwarding rules. Remove anything you did not set up. Then review your exchange's security settings and saved withdrawal addresses for unauthorized changes.
If your phone suddenly loses service or stops receiving login codes, contact your carrier from another phone and ask about a possible SIM swap. Regain control of the number and secure the carrier account. Where supported, switch financial accounts from text-message verification to an authenticator app or security key.
Replace exposed wallet keys
For a wallet you control yourself, a stolen recovery phrase or private key requires a new wallet. A recovery phrase recreates the wallet's keys. A private key controls a particular account. Changing the app password does not remove an attacker's access to those keys.
Create an independent wallet on a trusted, clean device using official software and a new recovery phrase. Importing the old phrase or adding another account under it keeps the same exposure. Treat every account derived from the leaked phrase as at risk. Avoid a compromised social login when creating the new wallet.
Remove harmful spending permissions
An attacker may have permission to move tokens without knowing your keys. That permission can remain active and drain future deposits without another signature. In a study of 3,514 Ethereum victim addresses affected by approval scams, about 69% suffered multiple drains. Treat even a small first loss as a reason to stop deposits and remove access immediately.
Use an approval checker reached through your wallet provider's official guidance or the network's block explorer. Revoke suspicious token and NFT permissions on each affected network, then check that the revocation confirmed. This usually requires a network fee. Disconnecting a website does not cancel existing token approvals. Other signed permissions may need separate removal. If the cause is unclear, treat the wallet as unsafe and move assets to an independent wallet.
Do not feed a sweeper bot
If deposits disappear almost immediately, a bot may be automatically stealing incoming funds. Do not add more crypto for transaction fees or try to beat it by clicking faster. Revoking approvals does not solve stolen-key access. Use your wallet provider's verified guidance for specialist help with trapped assets. Avoid recovery scripts offered in private messages.
Move remaining assets carefully
If transfers can be made safely, move assets promptly. Get the destination directly from the new wallet's Receive screen. Do not copy it from transaction history. Address-poisoning research shows that attackers insert lookalike addresses whose first and last characters match legitimate ones. Compare the entire address against the trusted destination, including on the hardware wallet screen when available.
Confirm that the destination supports the asset and network. Check every affected account for coins, tokens, NFTs, and staking or lending positions. Keep enough of the network's fee-paying coin to finish transfers before moving the rest. Locked funds may need a separate rescue plan. Update saved deposit addresses and anyone who pays the old wallet.
If USDT or USDC was stolen
Report stolen stablecoins to their issuer promptly. Tether and Circle have ways to block certain token transfers, so contacting them can matter even after the theft.
| Stolen token | Where to report |
|---|---|
| USDT | Contact Tether support and ask for the Information Requests team. Tether directs theft, hack, and scam reports to that team. |
| USDC | Contact Circle support. Also report to the exchange or provider you used, since Circle limits its formal complaint process for noncustomers. |
Send the network, amount, transaction IDs, receiving addresses, time of theft, and a short description. Provide addresses and IDs as copyable text, not just screenshots. Add your police report number when available. Ask whether the stolen tokens can be frozen and what documents investigators need to provide. Circle says freezes require appropriate legal authority. A freeze or refund is not guaranteed.
If stolen funds reach an exchange
Contact the receiving exchange's official support immediately, even if the theft happened outside that exchange. Send transaction links, the receiving address, amounts, times, and your police report when available. Ask for an urgent stolen-funds review, keep the ticket number, and give it to the investigating officer. For Binance, follow its stolen funds reporting steps.
Ask police to use the exchange's law-enforcement channel. For example, Binance says freezing requires an appropriate official order from law enforcement or a court. It also says customer support cannot disclose confidential investigation information to you. Opening a support ticket and involving investigators are both useful steps.
Save evidence and report the theft
Before deleting apps or wiping a device, save wallet addresses, transaction IDs, networks, amounts, times, scam websites, messages, and screenshots. A transaction ID is a transfer's unique reference. Never include wallet secrets in a report. Report promptly to local police or your country's cybercrime unit. In the United States, use ic3.gov, even if some details are missing.
Clean the device and avoid fake support
Review recent downloads, extensions, fake wallet apps, and requests you signed. Update software and scan for malware. Before wiping a device, preserve evidence and confirm that you can still access your funds through a valid backup or the new wallet. If the device was compromised, clean or reinstall it before using the new wallet. Secure other credentials that may have been exposed.
A 2024 IEEE study found that fake helpers target public wallet-help posts, then move conversations to email, Telegram, or other channels to request wallet secrets or fees. Initiate support contact yourself through the official app or website. A helpful reply or a move to private chat does not verify someone's identity. Reject guaranteed recovery, release fees, requests for your recovery phrase, and remote access from strangers.
Make the next wallet safer
Keep long-term savings separate from the wallet you use with apps. Store the new recovery phrase offline and privately. A hardware wallet reduces some risks of key theft, but cannot protect you from a harmful approval you sign.
In a 2026 simulated-wallet experiment, a five-second warning and review prompt increased rejection of malicious approvals. A useful habit to borrow is to pause before signing and check the token, the address allowed to spend it, and the maximum amount. For a 50 USDC swap, approve 50 USDC rather than unlimited access. Cancel if the details are unclear, and remove permissions you no longer need.