Safety brief
What to Do If Your Wallet Is Drained
The first hour matters, and instinct gives the wrong advice. What can still be saved, what cannot, and why recovery services make it worse.
Finding that assets have left your wallet without your instruction is disorienting, and the actions that help are not the ones instinct suggests. Two facts set the frame. Confirmed transactions cannot be reversed by anyone, so what has already gone is gone. And a drain is usually not a single event — it is access that persists until you remove it.
Stop the ongoing access first
Assume the wallet is compromised and will be drained again, including anything you send to it. Do not deposit funds to cover a network fee before moving assets out; drainers commonly watch the address and take the top-up within seconds. If the compromise came from an approval or a signature rather than a stolen key, moving assets to a new wallet works. If the recovery phrase itself is exposed, nothing left in that wallet is safe, and neither is any other address derived from the same phrase.
Create the new wallet properly
Generate a fresh recovery phrase on a device you have reason to trust, not on the one you suspect. If a hardware wallet was involved, set it up as new rather than restoring the old phrase onto it. Move what remains, highest value first, and accept that some small balances will not be worth the fee to rescue.
Then work out how it happened
The cause determines whether the new wallet is any safer than the old one. The common routes are a recovery phrase typed into a website or stored as a photo or text file, a malicious approval or signature granted on a site you visited, malware on the device, and a compromised browser extension. A block explorer shows exactly which transactions moved the assets, and whether they were transfers you signed or transfers a contract pulled using a permission you had granted. That distinction narrows the cause considerably.
Report it, and set expectations
If the funds moved to an address belonging to an exchange, reporting quickly to that exchange and to the police in your jurisdiction is worth doing — freezing is occasionally possible, and it always requires the receiving platform's cooperation and usually a legal instruction. Keep transaction hashes, timestamps and screenshots. Recovery is uncommon, and the honest reason to report is that it is the only route that ever works.
Key takeaway
Nobody can retrieve them for a fee
Within hours of a loss becoming public, offers to recover the funds arrive — as a reply, as a direct message, as a search result for the phrase you just typed. They are a second theft. No technique reverses a settled transaction, so an upfront fee buys nothing, and any service asking for your recovery phrase in order to scan or restore the wallet is asking for whatever is left.
More guides
Next