Wallet Drained? The First 15 Minutes Matter
What to do immediately after a suspected wallet drain, including approvals, transaction records, and safe escalation.
Stop Interacting With The Suspect Site
If you think a wallet has been drained, stop using the site, contract, or link involved. Do not approve new transactions to 'fix' the problem. Do not enter the seed phrase anywhere, including into a website that claims to be a recovery portal.
Protect Remaining Funds
If funds remain in the wallet, consider moving them to a new wallet that was created on a clean device and has a new seed phrase stored offline. If you are unsure whether the device is compromised, slow down and get help from an official support or security source.
Collect Evidence
- Public transaction hashes
- Destination addresses
- Screenshots of the suspicious site or message
- Time of the incident
- Token approvals or signatures you remember giving
- Official support ticket ID
Revoke Approvals Carefully
Token approvals can sometimes be revoked using reputable tools, but scammers also create fake revoke pages. Navigate from trusted official sources and check the domain carefully. Revoking approvals does not recover already stolen funds, but it may reduce future exposure.
What Support Can And Cannot Do
Support can help preserve evidence, identify known scam patterns, and route reports. It usually cannot reverse a confirmed on-chain transaction. Anyone promising guaranteed recovery should be treated with caution.