I've been hacked: the first-hour checklist

If funds are leaving your wallet or you think something is compromised, act now and in this order. Do not wait to understand exactly what happened: you can investigate later.

Danger: Anyone who contacts you offering to recover your funds is almost certainly running a second scam. Do not pay anyone upfront. See recovery scams.

Step 1: Work out what was exposed

Pick the case that fits best:

• You entered your seed phrase or private key somewhere (website, app, form, chat): the whole wallet is compromised. Go to step 2.
• You signed an approval or permit on a bad site, but never revealed your seed: specific tokens are at risk. Go to step 3, then do step 2 for safety.
• You ran a suspicious file or command: assume the computer and everything stored on it is compromised. Use a different device for everything below, then go to step 2.
• An exchange or email account was taken over: go to step 4.

Step 2: Move what is left to a new, clean wallet

• Use a device you trust, not the possibly infected one.
• Create a new wallet with a new seed phrase. Do not just add a new account to the same seed.
• Move the most valuable assets first.
• If the wallet has no gas left, attackers may have set up a bot that takes any gas you send. Move fast, or ask for help in the official support channels of your wallet about specialised rescue options. Never accept help offered in DMs.
• Stop using the old wallet and seed completely.

Step 3: Revoke approvals

• Use an approval checker you reach by typing its address yourself. See token approvals.
• Revoke approvals to the malicious spender and to anything you do not recognise, on every chain.
• Remember that revoking does not help if the seed phrase is exposed. Then step 2 is what matters.

Step 4: Secure your accounts

• From a clean device, change the password of your email account first, then exchanges, then social accounts.
• Log out all other sessions on each account. Stolen session cookies can bypass passwords and 2FA until ended.
• Check email forwarding rules and recovery options for changes.
• Check exchange withdrawal allowlists and API keys, and delete anything you did not create.
• Contact the exchange through its official app or site if funds were withdrawn.

Step 5: Record everything

• The malicious website address and any messages that led you there (screenshots).
• Your wallet address and the attacker's addresses.
• Transaction IDs (hashes) of the theft.
• Dates and times, with time zone.

Step 6: Report

• Report to the police and your national fraud reporting service. A report reference is often needed by exchanges.
• Report the phishing site and the scam addresses so others are warned. See where to report scams.
• If stolen funds went to a known exchange, contact that exchange's official support with the transaction IDs and police report.

Step 7: Clean up

• If malware was involved, wipe and reinstall the affected device before using it for crypto again.
• Review what led to the incident and adjust your setup: separate wallets, hardware wallet, better 2FA. See start here.