What to do first after a crypto wallet was drained
If you are searching for how to respond after crypto wallet was drained, the first priority is to stop further loss and preserve evidence.
Act quickly, because blockchain transfers are usually irreversible and delays can make recovery harder.
Start with the simplest goal: secure every account that may still be exposed, then document exactly what happened.
A calm, methodical response gives you the best chance of limiting damage and supporting any later report to law enforcement, an exchange, or a forensic specialist.
Confirm what was taken and how the drain happened
Before you change too many things, identify the wallet involved, the chain used, and the assets removed.
Note whether the drain came from a hot wallet, a browser extension like MetaMask, a mobile wallet, a hardware wallet, or a centralized exchange account with withdrawal access.
- Check the transaction hash on a block explorer such as Etherscan, Solscan, or Blockchain.com.
- Record the token type, amount, timestamp, and destination address.
- Look for approvals, permit signatures, or unlimited token allowances that may have enabled the theft.
- Review recent messages, pop-ups, downloads, and dApp connections for signs of phishing or malware.
This step matters because the response differs if the breach came from a seed phrase leak, a malicious smart contract approval, a SIM swap, or a compromised device.
Secure remaining funds and access immediately
If any assets remain in other wallets or accounts, move them to a fresh, uncompromised wallet as soon as possible.
Use a clean device if you suspect malware, and avoid restoring the old seed phrase into a browser extension or phone you do not trust.
Prioritize these actions
- Disconnect the affected wallet from all dApps.
- Revoke token approvals using a trusted tool such as Revoke.cash or the relevant chain explorer.
- Change passwords for email, exchange, and cloud accounts tied to the wallet.
- Enable two-factor authentication with an authenticator app, not SMS, when possible.
- Lock or replace compromised devices if you suspect remote access software, keyloggers, or clipboard hijackers.
If a centralized exchange is involved, contact support immediately and ask whether withdrawals can be paused or addresses whitelisted.
Document evidence before it disappears
Good documentation is often the difference between a useful report and a dead end.
Save screenshots, transaction links, wallet addresses, email alerts, login notifications, and any suspicious messages or website URLs tied to the incident.
- Write down the exact time you noticed the drain.
- Keep a chronological log of every action you take after discovery.
- Export wallet history and transaction records if the app supports it.
- Preserve phishing emails with full headers if possible.
- Store copies of the incident on an offline device or secure cloud account.
Do not delete browser history, wallet extensions, or app logs until you understand the entry point.
Those details can help a fraud investigator, cybersecurity firm, or exchange compliance team trace the attack.
Report the theft to the right parties
Once the evidence is preserved, notify relevant organizations.
If the stolen funds touched a centralized exchange, submit the transaction hashes, destination addresses, and any KYC information that may help them flag the account.
File a report with local law enforcement and include the blockchain evidence, because many agencies now work with cybercrime units that understand crypto tracing.
In the United States, you can also submit a complaint to the FBI Internet Crime Complaint Center (IC3).
In other jurisdictions, report through the national cybercrime portal or police fraud unit.
If the theft involved a stablecoin issuer, a bridge, or a major protocol, contact the project’s security or abuse team.
They may not reverse a transfer, but they can sometimes freeze assets, provide intelligence, or warn other users.
Can stolen crypto be recovered?
Recovery is possible in some cases, but it depends on where the assets went and how quickly you respond.
Funds sent to a self-custody wallet controlled by the thief are difficult to retrieve unless they are later moved to an exchange that cooperates with investigators.
Recovery becomes more plausible when:
- The thief deposits funds into a regulated exchange with KYC records.
- The stolen assets are bridged or swapped through traceable routes.
- A stablecoin issuer can freeze funds tied to a verified theft report.
- Law enforcement acts fast and the destination platform preserves records.
Be skeptical of anyone promising guaranteed recovery for an upfront fee.
Recovery scams are common, especially after high-value thefts, and they often target victims who are already under stress.
How to analyze the attack path
Understanding the entry point helps you avoid a second loss and strengthens your report.
Common causes include phishing sites, fake wallet update pages, malicious browser extensions, clipboard hijacking malware, leaked seed phrases, and approval scams that trick users into signing harmful transactions.
Ask a few focused questions: Did you enter your recovery phrase anywhere?
Did you sign a transaction you did not understand?
Did you connect to a new dApp right before the drain?
Did you recently install a wallet helper, browser add-on, or APK file from an untrusted source?
If you are not sure, a blockchain security company or digital forensics specialist can review wallet activity, contract approvals, and device indicators of compromise.
How to protect yourself after the incident
After you respond after crypto wallet was drained, the next phase is rebuilding your security stack.
This is the time to replace weak habits with controls that reduce future risk.
Practical prevention measures
- Use a hardware wallet for long-term holdings.
- Keep only small spending balances in hot wallets.
- Store seed phrases offline in multiple secure locations.
- Use separate wallets for trading, minting, DeFi, and long-term storage.
- Review token approvals regularly.
- Verify domain names manually before connecting a wallet.
- Avoid signing messages or permits you do not fully understand.
For larger holdings, consider a multisig setup such as Safe, which requires multiple approvals before a transaction can move funds.
This adds friction for attackers and reduces single-point failure risk.
What to tell your exchange, insurer, or advisor
If your holdings are material, inform any exchange, insurer, legal advisor, or tax professional that may be affected.
Provide only verified facts: wallet address, transaction hashes, timestamps, asset names, and the current status of remaining funds.
Some cryptocurrency insurance policies, custody agreements, and enterprise compliance programs require rapid notification.
If you use a crypto accountant or tax professional, they may also need the transaction records to document the theft properly for reporting purposes.
Signs that your wider environment is still compromised
Even after the wallet is emptied, the attacker may still have access to your email, browser, device, or connected accounts.
Watch for unexplained password reset emails, new login alerts, changed recovery settings, or new wallet connections you did not authorize.
- Unexpected mobile carrier alerts can indicate a SIM swap attempt.
- Browser extensions reappearing after removal may signal device compromise.
- New approvals or transfers from other wallets may indicate exposed seed phrases.
- Unfamiliar recovery email changes may indicate account takeover.
If you see these signs, isolate the device from the internet and have it checked before using it for further crypto activity.
Key terms that matter in a wallet-drain incident
Knowing the terminology helps when speaking with support or investigators.
A seed phrase or recovery phrase controls wallet access.
A private key signs transactions.
Token approvals allow smart contracts to move assets on your behalf.
A transaction hash is the unique identifier for on-chain transfers.
A block explorer lets you verify where funds moved.
Using the correct terms can speed up support interactions and reduce confusion during an already stressful event.