What to do if you think your wallet was compromised

The idea in plain English

Stop interacting with the suspicious site and do not approve new rescue prompts. Identify what may have been exposed: a login, a permission, a signed transaction or the actual recovery material. These are different incidents. Preserve transaction references and screenshots that do not reveal secrets, then seek help through independently verified official channels.

The distinction that matters

An exposed signing key or phrase is not repaired by changing an app password or revoking one approval. Remaining assets may require migration to a newly secured setup, but automated sweepers or complex contract positions can make improvised transfers risky. Avoid adding gas blindly to a compromised wallet and get qualified, independently verified assistance when the situation is complex.

A practical example

If you only connected a site without signing, that is different from revealing the entire recovery phrase. If you granted a harmful permission, revocation may limit future use but cannot return already transferred funds. Correctly classifying the incident prevents one generic “fix” from creating false confidence.

Try this without moving money

• Stop signing and document what happened without sharing private material.
• Secure affected provider accounts and contact official support where relevant.
• Report the incident to appropriate local authorities and preserve the evidence trail.

A mistake to avoid

Do not pay unsolicited recovery agents or assume anyone can reverse a confirmed transaction. This guide cannot diagnose a live compromised wallet.

Before you act

A checklist lowers some risks but cannot certify a person, link or wallet as safe. When uncertain, stop signing and return through a destination you independently verified. Keep evidence without sharing secrets. If money or credentials are already exposed, use the incident-response guidance and official support rather than a stranger offering a guaranteed recovery.