Security

Wallet Hacked? What to Do First, Step by Step

When you find funds missing, do not rush to top up gas. What you do depends on the cause: a leaked seed phrase or private key means abandoning the whole wallet, while abused approvals or signatures can be revoked and the wallet kept. Based on MetaMask's help center and Revoke.cash, here is how to tell which it is and what to do in order.

BlockVar
Wallet Hacked? What to Do First, Step by Step

First, work out what happened

Revoke.cash suggests starting with what was stolen:

  • Many assets across several networks: most likely a leaked seed phrase or private key, giving the attacker full control of the wallet.
  • Several assets approved to the same contract: possibly a marketplace signature scam.
  • A single asset: usually an approval to a malicious contract, or a direct transfer you signed.

Leaked seed phrase or key: new wallet, move what is left

  1. Make sure the device is clean: Revoke.cash recommends malware checks, a full reset if needed, and changing important passwords.
  2. Create a new wallet elsewhere: MetaMask suggests a different browser, browser profile or device; write down the new Secret Recovery Phrase in order, store it safely and never share it.
  3. Move the remaining funds to the new wallet: as quickly as possible.
  4. Watch for sweeper scripts: if a script empties the old wallet as soon as funds arrive, do not send ETH or other tokens to it for gas; they will be swept immediately.
  5. Stop using the old wallet entirely: including every account under the same recovery phrase.

For larger amounts (Revoke.cash suggests more than $1,000), Revoke.cash mentions contacting the Flashbots Whitehat Hotline for help.

Abused approvals or signatures: revoke first

If the cause is an approval or signature, revoke the suspicious contract's access with Revoke.cash or a block explorer's approval checker; see how to check and revoke token approvals. According to Revoke.cash, once approvals are removed you can keep using the wallet, and a signature caught early can sometimes be cancelled within a short window. Disconnecting from a site does not remove approvals; see does disconnecting a wallet remove approvals.

A direct transfer you signed: cannot be undone

Revoke.cash calls a direct transfer you signed a "one and done" event: the funds cannot be recovered, but the wallet itself remains usable.

Report it, and avoid being scammed twice

MetaMask states plainly that transactions cannot be reversed and missing funds cannot be restored; a self-custody wallet provider cannot recover them for you. Collect the transaction hashes and the receiving addresses and report to the authorities; if funds went to an exchange, you can also file the details with that exchange for its records.

The most common next step is a second scam: "hackers", "lawyers" or "tech teams" who claim they can get the funds back. Revoke.cash is blunt: anyone who promises to recover stolen assets is likely a scammer themselves. Ignore anyone who asks for your seed phrase, private key or an upfront fee.

Lowering the risk afterwards

Sources

MetaMask 帮助中心：账户被盗或出现未授权交易 / I've been hacked Revoke.cash：被骗或被盗之后怎么办 / What to do when scammed