The first ten minutes after a wallet compromise

You signed something a few minutes ago and now the page looks wrong. A token you never bought is sitting in your balance. A wallet compromise is any situation where someone other than you can move assets out of your address, and it arrives in two forms that need opposite responses.

Either an approval leaked, or the seed phrase did. Everything below follows from which one you are in, and the next ten minutes decide what it costs.

Panic produces the wrong order of operations. People move funds first, which in one of these two cases is the move that loses them. So start with a single question, answer it honestly, and let the answer choose the sequence.

Which of the two things actually happened?

An approval compromise means you signed a permission. A contract can now spend one token, or every token of one type, from your address. Your seed phrase is untouched. The address is still yours and still safe to receive into. This is the survivable kind of wallet compromise.

A seed compromise means the twelve or twenty-four words are known to someone else. Every address derived from those words is theirs as much as yours. Nothing you do inside that wallet is private and nothing left in it is safe.

Three signals separate them quickly:

• You signed something on a website and only one token moved. That is an approval.
• You typed your seed into a page, an app, or a support chat. That is a seed compromise, whatever the page looked like.
• Assets moved from several addresses at once, or from an address you never connected anywhere. That is a seed compromise.

The mistake that costs the most is treating a seed compromise as an approval problem, because revoking takes minutes that the attacker is also using.

What to do when only an approval leaked

This is the wallet compromise you can actually undo. Revoking is a transaction: it costs gas and takes a block to confirm, so do the highest-value one first rather than working alphabetically down a list.

1. Open an approval checker for the chain you were on. Etherscan publishes one, and revoke.cash covers a wider set of networks.
2. Sort by value at risk, not by date. An unlimited approval on a stablecoin you hold matters more than a capped one on a token you do not.
3. Revoke the top few. Confirm each one landed before moving on.
4. Only then consider moving what is left, and only if an approval you cannot revoke is still outstanding.

Setting an allowance to zero is the revoke. There is no separate undo, and there is no way to claw back a transfer that already happened. What revoking buys you is the future: the contract cannot come back tomorrow for the rest.

One thing people expect and do not get. Revoking on one chain does nothing on another. The same address on 5 networks carries 5 independent sets of approvals, and a drainer that found you once will try the others.

What to do when the seed phrase is gone

Speed matters more than tidiness. This kind of wallet compromise has no repair, so you are not fixing the wallet, you are evacuating it.

• Create a new wallet on a device you trust, ideally one that was not involved in whatever just happened.
• Move the most valuable, most liquid assets first. Native tokens and stablecoins before anything illiquid.
• Leave the small balances. Gas on a rescue transaction can exceed what a dust position is worth.
• Do not send a rescue transaction from a wallet that has no gas. Fund it with the minimum, then move once.

Staked, locked or vesting positions are the hard case. If the unlock is in the future, the attacker can wait too, and no amount of speed fixes that. Some protocols let you change the beneficiary address; most do not. Check the specific contract rather than assuming either way.

What does not help, and why people try it anyway

Several reflexes feel productive and change nothing.

Sending the remaining tokens to a second address you control does not help after a seed compromise, if that second address came from the same phrase. It is the same key. This is the single most common wasted transaction.

Disconnecting the site does not revoke anything. Disconnecting removes the site's read access in your wallet's interface. The on-chain allowance you granted is a separate fact, recorded on the chain, and it survives the disconnect.

Changing your wallet password does not help either. The password encrypts the local copy. The phrase is what derives the keys, and an attacker holding the phrase never touches your password.

Reinstalling the wallet app does nothing at all, for the same reason. So does moving to a different wallet app while importing the same phrase. The compromise travels with the words.

Reading the damage afterwards

Once the bleeding stops, the transaction that started it is worth understanding, because it usually names the mechanism. Our guide to reading a wallet history for risk covers doing this by hand, and the pattern behind most of these incidents is documented under token approvals.

Scanning the address that received your funds tells you whether this was targeted or automated. Riskira's wallet scan reports what an address has been involved in, which is useful for deciding whether to warn other people holding the same token. It cannot recover anything, and no tool can: a confirmed transfer is final by design.

The last step is unglamorous and it is the one people skip. Write down what you signed and where you were when you signed it. Most repeat victims are repeat victims because the entry point was never identified, and the same phishing route worked twice.

How do you know when it is over?

There is no notification that says the incident finished, and that absence is why people keep checking a balance for days. Two conditions actually close it.

For an approval compromise, it is over when the allowance reads zero on chain and the revoke transaction has confirmed. Check the allowance itself rather than trusting the interface you revoked from. A pending transaction that never landed looks identical to a successful one in most wallet screens for the first minute.

For a seed compromise, it is over when the address holds nothing you would mind losing. That is a lower bar than "empty" and a deliberate one. Chasing the last few dollars of an illiquid token costs more in gas than it returns, and every extra rescue transaction is another chance to send from the wrong account.

Then stop watching it. An address whose phrase is known will keep receiving dust, and some of that dust is bait designed to pull you back — the pattern documented under suspicious addresses. Watching a dead wallet is how people end up signing one more thing.

The ten-minute version

If you remember nothing else from this, remember the order.

1. Decide: approval or seed. Two minutes, honestly answered.
2. Approval — revoke the largest allowances first, one chain at a time.
3. Seed — new wallet, move the liquid value, accept the losses on the rest.
4. Neither case is helped by disconnecting, by a new password, or by a reinstall.

A wallet compromise is survivable when it is an approval and expensive when it is a seed. The ten minutes are worth more than the tooling.