What to Do Immediately If Your Crypto Wallet Is Compromised: A Triage Guide

A compromised crypto wallet requires immediate, sequential triage to salvage any remaining assets. The correct response depends entirely on whether the attacker gained access through a malicious smart contract approval or a leaked private key. Acting out of order can cost victims their remaining funds by alerting automated malicious scripts monitoring the account.

Diagnosing the Breach

The critical first step in wallet triage is determining the vector of the attack. Cryptographic wallets do not hold assets directly; they hold the cryptographic keys required to sign transactions on the blockchain. When unauthorized outbound transfers occur, they generally stem from one of two events: a malicious token approval or a compromised private key.

If the attacker drained a specific asset, such as USD Coin ($USDC), but left native gas tokens like Ethereum ($ETH) untouched, the vector is often a malicious smart contract approval. In this scenario, the user inadvertently signed a transaction granting a third-party contract permission to move a specific token on their behalf. Users frequently encounter these traps through phishing sites, as detailed in our guide on Common Crypto Scams: How to Spot Phishing, Drainers, and Fraud.

Conversely, if the wallet is entirely drained of all assets, including the native gas token, the attacker likely obtained the underlying seed phrase—the master password that generates all cryptographic keys for the wallet. This distinction dictates the triage strategy. Revoking approvals on a wallet with a compromised seed phrase wastes critical time, while abandoning a wallet over a localized token approval creates unnecessary operational friction.

Scenario A: Malicious Token Approvals

If the breach is limited to a token approval, the core cryptographic architecture of the wallet remains secure. The attacker cannot initiate transactions acting as the wallet owner; they can only pull the specific token they were granted access to.

The immediate remedy is to revoke the malicious approval using a block explorer or a dedicated revocation tool. Users must connect their wallet to a service like Revoke.cash or the approval checker built into Etherscan, locate the contract address that executed the unauthorized transfer, and sign a transaction setting that contract's allowance to zero.

This process requires a small amount of native currency to pay for gas, the computational fee required to process a transaction on the blockchain. Once the revocation transaction is confirmed, the smart contract can no longer access the asset. The wallet itself remains fundamentally secure and can continue to be used, though cautious users often prefer to rotate to a new address regardless.

Scenario B: The Compromised Seed Phrase

If the seed phrase or private key is compromised, the wallet is permanently burned. The attacker has equal cryptographic authority over the address as the original owner. The only viable response is a process known as "sweeping": transferring all remaining valuable assets to a newly generated, secure wallet address as quickly as possible.

This introduces a severe operational challenge. Sophisticated attackers deploy sweeper bots—automated scripts that monitor compromised addresses on-chain. If the victim attempts to send gas to the compromised wallet to fund the rescue transfers, the sweeper bot will instantly detect the incoming deposit and automatically transfer the gas to the attacker's own wallet, leaving the victim unable to move their tokens.

Evading a sweeper bot requires specialized technical intervention. Victims must use a flashbot or a specialized rescue service to bundle transactions privately. These services submit the gas deposit and the asset extraction to miners directly, bypassing the public mempool where sweeper bots monitor unconfirmed transactions.

Executing a Sweep (A Worked Example)

Consider a scenario where a compromised wallet contains 10,000 $USDC but zero $ETH. The victim needs $ETH to pay the gas fee to transfer the $USDC to a safe wallet.

Assume the current network base fee is 20 gwei, and transferring an ERC-20 token costs exactly 65,000 gas units. The transaction fee equals 1,300,000 gwei, or 0.0013 $ETH.

If the victim sends exactly 0.0013 $ETH to the compromised wallet via a standard public transaction, a sweeper bot will likely detect it in the public mempool. The bot will automatically broadcast its own transaction to steal the 0.0013 $ETH, paying a slightly higher miner tip to ensure its transaction is processed first. By utilizing a private transaction relay, the victim can bundle the 0.0013 $ETH funding transaction and the $USDC withdrawal transaction into the same block, ensuring the bot never sees the gas deposit until both transactions are already finalized.

Preserving Evidence and Reporting

After securing remaining assets, the next step is documentation. Victims must avoid deleting the wallet software immediately, as it may contain localized data logs.

The most critical piece of evidence is the transaction hash (TxHash) of the unauthorized transfers. This alphanumeric string is the permanent, public record of the movement of funds on the blockchain. By inputting the transaction hash into a block explorer, investigators can trace the destination of the stolen funds.

Reporting the incident establishes a legal record, which is necessary for tax write-offs and potential future asset recovery. In the United States, victims should file a report with the FBI's Internet Crime Complaint Center (IC3). In the United Kingdom, reports are routed through Action Fraud. While local police departments rarely have the cyber capabilities to investigate on-chain theft, obtaining a police report number is a prerequisite for engaging centralized exchanges where the stolen funds might eventually be deposited. Law enforcement agencies can issue freezing orders to exchanges, though this process is highly dependent on jurisdiction and timing.

Common Misconceptions

• Wallet providers can reverse transactions: Cryptographic networks settle transactions immutably. Neither the hardware manufacturer nor the software developer has administrative access to reverse a confirmed transaction or recover a lost seed phrase.
• Deleting the app stops the hack: Uninstalling wallet software from a phone or computer does nothing to secure the assets. The funds exist on the decentralized ledger, and an attacker with the private key can access them from any internet-connected device in the world.
• Hackers can steal native gas tokens via approvals: The ERC-20 token standard allows for delegated approvals, but native network tokens like Ethereum or Bitcoin ($BTC) do not have this function. If native tokens are stolen, the attacker almost certainly possesses the private key.

What to Watch

The burden of emergency triage currently falls entirely on the user, but wallet architecture is shifting to mitigate these catastrophic failures. The ongoing implementation of account abstraction (ERC-4337 on Ethereum) allows smart contracts to function as primary wallets.

This structural shift enables programmable security features directly at the wallet level. Future iterations of consumer wallets are expected to feature automated tripwires, daily withdrawal limits, and multi-signature requirements that delay large transfers. These mechanisms will provide victims with a critical time buffer to cancel unauthorized transactions before final settlement, fundamentally altering the triage process from a frantic race against bots to an orderly administrative override.