Wallet Compromised / Funds Drained
Suspicious activity detected — tokens moved without your authorization.
This guide covers 5 verified steps to resolve "Wallet Compromised / Funds Drained". Follow each step in order before moving to the next. If the steps below don't resolve your issue, use the community support options at the bottom of this page.
Stop Further Damage Immediately
Do NOT try to send more tokens to the compromised wallet. The attacker likely has a bot monitoring it. Any new deposits will be swept instantly.
Create a New Wallet OFFLINE
On a clean device (never connected to internet), create a new wallet. Write down the seed phrase on paper — do not photograph or type it digitally.
Rescue Remaining Assets
If any tokens remain, you need to move them before the attacker's bot does. Use a "sweeper" script or Flashbots bundle to frontrun the attacker. This is complex — seek help in official protocol Discords.
Identify the Attack Vector
How were you compromised? Phishing site? Malicious contract approval? Leaked seed phrase? Identifying the source prevents it from happening again. Check revoke.cash for unauthorized approvals.
Report and Document
Report to: the platform where scam occurred, local cybercrime authorities, and crypto scam databases (chainabuse.com). Document all transaction hashes for any future legal action.