Crypto Hacked? What to Do in the First Hour

If your wallet is being drained or an exchange you use was hacked, the first hour matters. This is the order to work through, based on guidance from the FBI and ethereum.org.

Join on Whop Try a Free Week

4.92 from 119 reviews

4.5

Security checklist

First: Nobody Can Reverse It for a Fee

Blockchain transactions can't be undone. People who lost crypto are targeted again by fake "recovery" services and fake law firms that ask for an upfront fee. The FBI's warning is plain: law enforcement does not charge victims to investigate. Don't send money or personal details to anyone who contacts you offering to get your funds back.

It's general information, not legal or financial advice.

If Your Own Wallet Is Being Drained

1.
Stop Signing
Disconnect the site you were using and don't approve or sign anything else from that wallet. Never type your seed phrase into a website or send it to anyone, whoever they say they are.
2.
Make a New Wallet on a Device You Trust
If your computer or phone may be infected, use a different one. Create a brand-new wallet with a new seed phrase and write it on paper, not in a screenshot or a cloud note.
3.
Move What's Left, Most Valuable First
If funds are leaving right now, speed matters more than anything else. Some drained wallets are watched by bots that grab any gas you send to them, so move the largest balances first and expect to lose small amounts.
4.
Revoke Token Approvals
Scams often trick you into approving unlimited spending of a token. Check and revoke approvals with Revoke.cash or Etherscan's Token Approval Checker. It costs a little gas. Treat the old seed phrase as burned for good: anyone who has it can approve again.
5.
Save the Evidence
Transaction hashes, the addresses involved, screenshots of your balances and history, and every message with the scammer.
6.
Report It
In the US, file a complaint with the FBI's Internet Crime Complaint Center (IC3); elsewhere, your national fraud office or local police. Report the addresses on Chainabuse. If the funds went to an exchange, contact that exchange's support at once: exchanges can sometimes freeze flagged accounts.

If an Exchange You Use Was Hacked

1
Get News Only From the Exchange Itself
Open its website, status page or official X account from your own bookmark. Fake "compensation", "verify your account" and "withdraw now" links appear within hours of a hack.
2
Don't Act in a Panic
If withdrawals are paused, there is nothing to do but follow the official updates. If they're open, decide calmly whether to move funds to a wallet you control.
3
Lock Down Your Account
Change your password, use an authenticator app or security key instead of SMS for two-factor authentication, turn on the withdrawal address allowlist if the exchange has one, and delete any API keys you don't use.
4
Screenshot Your Balances and History Now,
in case there is a claims process later.
5
Ignore Direct Messages From "Support"
Real support doesn't contact you first with a link or ask for your seed phrase, password or 2FA code.

If a DeFi App You Use Was Exploited

Revoke the approvals you gave that protocol's contracts.
Only use "migration", "refund" or "claim" links announced on the protocol's official channels, opened from your own bookmark.
Withdraw only when the team's official channels say it's safe to interact with the contracts.

Five Minutes Now That Make a Hack Less Likely

Keep long-term holdings on a hardware wallet, and use a separate hot wallet with small amounts for trading and new apps.

Bookmark your exchanges and wallets; don't reach them through search ads or links in messages.

Use an authenticator app or security key for two-factor authentication, not SMS.

Turn on withdrawal address allowlists where your exchange offers them.

Never copy a wallet address from your transaction history. Scammers send tiny transfers from look-alike addresses so a fake one shows up there ("address poisoning"). Copy the address from the exchange's deposit page or your saved address book, and check every character, not just the first and last few. A small test transfer won't catch it.

Check and revoke old token approvals once a month.

Never share your screen, seed phrase or 2FA codes with anyone offering help.

Questions People Ask

Can stolen crypto be recovered?

Usually not. Confirmed blockchain transactions can't be reversed. What can help: reporting quickly, and contacting any exchange the funds were sent to, because exchanges can sometimes freeze flagged accounts. Anyone who offers to get your crypto back for a fee is very likely running a second scam.

Are crypto recovery services legit?

Treat any unsolicited recovery offer as a scam. The FBI has warned about fake law firms and recovery services that contact victims, claim to work with government agencies and ask for upfront fees. Law enforcement does not charge victims a fee for investigating crimes.

What should I do first if my wallet is being drained?

Stop signing anything, create a new wallet with a new seed phrase on a device you trust, and move what's left to it, largest balances first. Then revoke token approvals, save the evidence and report it.