Crypto wallet hacked: what to do, step by step
If your crypto wallet was hacked, act fast and assume your recovery phrase or private key is in someone else's hands. Move whatever is left to a brand-new wallet, cut off any other access the attacker may have, and collect evidence before you report. This guide covers each step, the usual causes and what can realistically be recovered.
My crypto wallet was hacked: what do I do first?
The first thing to do after a wallet hack is to stop using the old wallet and move any remaining funds to a new one that the attacker cannot touch. Work through these steps in order, and don't wait for someone to confirm the hack first:
How to store a new recovery phrase safely
- Stop sending or receiving anything at the hacked address, and tell anyone who pays you not to use it again.
- On a clean phone, create a NEW wallet with a NEW recovery phrase. Restoring the old phrase in another app doesn't help, because it opens the same compromised addresses.
- Move whatever is still in the old wallet to the new address, starting with the largest balance.
- If tokens were drained on an EVM network through an approval you signed, revoke that approval.
- Change the passwords and two-factor codes of your email and any exchange accounts.
- Scan the phone, remove apps and browser extensions you don't recognise, and stop using that device for crypto until it is clean.
Moving what's left: the network fee problem
To move tokens out of a hacked wallet you need that network's fee coin at the same address. Attackers often take the fee coin first, for example leaving no TRX behind on Tron, so your remaining USDT can't move.
Be careful about topping up the fee coin. Some attackers run automated scripts that grab any coin the moment it lands on a compromised address, so a top-up can disappear within seconds. If you try, send only the minimum needed and move the tokens immediately afterwards.
Anything you manage to move should go to the new wallet you created, never to another address of the old phrase.
Drained through a token approval? Revoke it
A token approval is a permission you sign that lets a smart contract spend a specific token from your address on EVM networks such as Ethereum or BNB Smart Chain. Malicious sites disguise these approvals as a login, an airdrop claim or a routine confirmation, and once signed, the contract can drain that token later without asking again.
Revoking means sending a new transaction that sets the permission back to zero. Many block explorers for EVM networks show the approvals an address has given, and revoking costs a normal network fee.
Revoking only helps when your phrase is still private. If you typed your words anywhere, revoking is not enough: move the funds to a new wallet.
How do crypto wallets get hacked?
Most wallet hacks are not clever code breaking; they come from a leaked recovery phrase or a signature the owner was tricked into giving. Knowing the cause tells you whether a new phrase is enough or whether the phone itself needs cleaning:
| Cause | Typical sign | Prevention |
|---|---|---|
| Leaked recovery phrase | Everything leaves at once, often on several networks | Phrase on paper only: no photos, screenshots, cloud notes or websites |
| Phishing or a fake wallet app | Funds vanish soon after you typed the phrase into a site or new app | Install wallets only from the official site; never enter the phrase on a website |
| Malicious approval or fake airdrop claim | Only one token on one EVM network is drained | Don't connect or sign on unknown sites; read what you approve |
| Address poisoning | You sent funds yourself to a look-alike address from your history | Copy addresses from the source, never from history; compare the whole address |
| Clipboard malware | The pasted address differs from the one you copied | Clean phone, trusted apps only, check the address after pasting |
| Fake support in messengers | A helper asked for your words or to sync your wallet | Real support never asks for your phrase or messages you first |
Can stolen crypto be recovered?
Usually not: a confirmed blockchain transfer can't be reversed by anyone, including the sender, the wallet or the app maker. Only whoever holds the key to the receiving address can send the funds back.
There are two narrow exceptions. Stolen funds sometimes end up at an exchange, which may freeze the account that received them if it gets a report quickly. And for stablecoins such as USDT, the issuer can freeze an address in the token contract, which is often used against hack and scam proceeds.
Neither path is guaranteed or fast, but both depend on speed, so report within hours, not weeks.
Collect evidence and report the theft
Evidence turns a vague complaint into something an exchange, issuer or police officer can act on. Before you report, collect:
How to track a transaction by its TXID
- The TXID of every outgoing transfer you didn't make
- Your addresses and the attacker's receiving addresses, with the network of each
- Screenshots of chats, sites, apps and messages involved, with dates
- A short timeline: when you last used the wallet and when you noticed the theft
Where to report, and the recovery scam to avoid
Report the theft to the police or cyber-crime unit where you live, and if the funds reached an exchange, to that exchange through its official support, with your TXIDs. For stolen USDT, contact the issuer only through its official website.
Be very careful afterwards. Victims who post about a hack are soon contacted by crypto recovery services or hackers who promise to trace and return the money for an upfront fee. These offers are almost always a second scam: they take the fee, sometimes your new phrase too, and return nothing.
How to stop it happening again
The new wallet is only as safe as the habits around it. Use this checklist:
Waletifi security settings, step by step
- Write the new 24 words on paper; never photograph, screenshot or store them online.
- Enter the phrase only in your own wallet app, only to restore it.
- Install wallet apps from the official website only.
- Ignore unknown tokens and never connect your wallet to sites they point to.
- Copy addresses from the original source and check the whole address before sending.
- Keep large amounts away from a rooted phone or one full of unknown apps.
What Waletifi can and can't do after a hack
Waletifi is a non-custodial wallet, so your keys are created and kept on your phone and our server can never move your funds. That also means Waletifi support can't reverse a transfer, freeze an address or recover stolen crypto, and it never asks for your recovery phrase.
What the app does is lower the risk: phrase screens block screenshots, the phrase is never put on the clipboard, and copied addresses are cleared after 60 seconds. The PIN is never stored, and wrong PINs mean a longer wait each time. Before you confirm a send, the review screen warns about look-alike addresses and about an @handle whose address has changed.
