You feel it before you can prove it. A transaction you never signed. A token approval you don't remember granting. A balance that dropped while you were asleep. The cold realization that someone else has the keys to your money.
Most people freeze here. Freezing is the worst thing you can do.
A compromised wallet is not a single event. It is a race. On one side, an attacker with a script that drains assets faster than you can read this sentence. On the other side, you, with a narrow window to move what is left somewhere safe. The winner is decided by preparation and speed, not by panic.
Here is the playbook nobody hands you until it is too late.
First, understand what "compromised" actually means
There are two very different disasters, and confusing them wastes the minutes you cannot spare.
The first is a drained wallet from a malicious approval. You connected to a shady site, signed something you shouldn't have, and now a contract has permission to move specific tokens out of your wallet. Your seed phrase is still secret. The attacker can only take what you approved.
The second is a fully compromised seed phrase or private key. Someone has your actual keys. Every asset across every chain tied to that seed is theirs the moment it becomes worth taking. This is the nightmare scenario, and it changes your entire response.
You triage based on which one you are facing. If you don't know, assume the worse one and act accordingly.
The triage: what to do in order
Move the assets that are still safe, but only if your keys are not compromised. If the problem is a bad approval and your seed is intact, send your remaining valuable tokens to a brand new wallet you create on a clean device. Prioritize by value and liquidity. Native tokens and blue chips first, because those are what the attacker wants most.
If your seed phrase is gone, stop sending anything to that wallet. This is counterintuitive and it saves people. When attackers control your keys, they often run a "sweeper" bot that instantly grabs any incoming funds. People try to rescue an NFT by sending gas to cover the transaction, and the bot eats the gas before they can act. You cannot outrace a bot from a compromised wallet. Abandon it.
Revoke active approvals on wallets you are keeping. Use a reputable approval checker to see every contract that can touch your funds and cut off the ones you don't recognize. This closes the door on the malicious-approval attack. It does nothing for a stolen seed, which is why triage order matters.
Disconnect and disconnect again. Kill active sessions, log out of connected apps, and unplug from anything the wallet was talking to. If you use a browser extension wallet, treat the browser itself as suspect.
The part most guides skip: assume the device is the problem
Here is the uncomfortable question almost no one asks in the moment. How did they get in?
If you moved your assets to a new wallet but created that wallet on the same infected laptop or phone, you just handed the attacker a fresh set of keys. Malware that logs keystrokes or screenshots your seed phrase does not care how many wallets you make.
So before you generate anything new, you isolate. Use a different device entirely. Ideally one that has never touched the compromised environment. If you only have one device, that is exactly the situation a hardware wallet exists to solve, because the keys never leave the device and never appear on the screen of a machine that might be watching.
The new wallet is only as safe as the place you birth it.
Forensics you can actually do yourself
You are not a detective, but a few minutes of looking will tell you a lot.
Open a block explorer and read the transaction that drained you. Look at the timestamp. Look at where the funds went. Look at whether it was a single transfer or a contract interaction. A direct transfer points toward a stolen key. A contract call that pulled approved tokens points toward a malicious approval.
Then retrace your last 48 hours. What did you sign? What did you connect to? Did you download a "trading bot," a free mint, a job-application file, a fake update? Attackers rarely break cryptography. They get you to open a door. Finding that door tells you whether the threat is contained or whether everything you own is exposed.
What recovery actually looks like (and what it doesn't)
Be honest with yourself about this part, because false hope is expensive.
On most public chains, transactions are final. There is no support line that reverses a theft, no chargeback, no fraud department. Anyone who slides into your replies promising to "recover your funds" for an upfront fee is running the second scam of your day. The recovery scam preys on the freshly robbed because they are desperate and emotional. Block them.
What you can sometimes do is report the destination address to exchanges and analytics services so it gets flagged if the thief ever tries to cash out through a regulated venue. File a report with the relevant authorities in your jurisdiction. None of this guarantees recovery, but a flagged address is a leash, and occasionally that leash matters later.
Build the wall before the next attack, because there will be one
Surviving once teaches you nothing if you rebuild on sand. The people who get hit twice are the ones who treated the first time as bad luck rather than a system failure.
Separate your wallets by job. A "vault" wallet that holds long-term assets and signs almost nothing. A "hot" wallet with only what you can afford to lose for daily trading and minting. The vault never touches a website you haven't trusted for months.
Put the vault behind hardware. A signing device that requires physical confirmation turns a remote attack into a non-event, because malware cannot press the button for you.
Make revoking approvals a monthly ritual, the same way you'd renew anything else that protects you. Old approvals you forgot about are sleeping liabilities.
And treat your seed phrase like the single most dangerous object you own, because it is. It goes nowhere near a screen, a cloud drive, a photo, a password manager, or a text field. Ever. The moment it becomes digital, it becomes stealable.
The mindset that actually keeps you safe
The strongest security tool you have is a specific kind of doubt. Not paranoia, which freezes you, but the habit of pausing before you sign. Every signature is a contract. Every connection is a door. The attacker's entire business model depends on you moving fast and trusting reflexively.
So slow down at exactly the moments designed to rush you. The limited mint ending in two minutes. The airdrop you must claim now. The DM from "support." Urgency is the weapon. Patience is the shield.
A compromised wallet feels like the end. For most people, it is the beginning of finally taking custody seriously. The ones who come out stronger are not the ones who never got hit. They are the ones who turned the worst day into the reason they never had a second one.
Your keys, your coins, your responsibility. Make the next ten minutes count, and then make sure you never need them again.
