My Crypto Wallet Got Drained: What to Do in the First Hour

By the Guardian team Updated November 2026 5 min read

Quick answer. On a trusted device, see if funds are still leaving and revoke any live approval. Move the rest to a new wallet on a clean device, then record every hash, request freezes and report to IC3 or police.

Watch: My Crypto Wallet Got Drained: What to Do in the First Hour 1:35

Video transcript

Your crypto wallet got drained. The next hour decides whether you lose more, so work in order.

Stop the losses, move what is left, preserve evidence and request freezes, then report the theft.

Check a block explorer for funds still leaving. If one contract is draining tokens, revoke that approval. If assets left several chains at once, assume your seed phrase is exposed.

Move what is left to a new wallet on a clean device. Do not top up the old one for gas. A sweeper bot will likely take it first.

Losses across chains suggest a key compromise. One token taken by a contract suggests a bad approval. A payment to a lookalike is address poisoning.

Record every hash and address, then ask issuers and exchanges to freeze funds. In one December 2025 theft, the attacker swapped nearly fifty million USDT to DAI within 30 minutes.

Report it. In the US, use the FBI's Internet Crime Complaint Center. Elsewhere, go to local police for a reference number. For an active incident, contact SEAL 911.

Then expect recovery scams. The FBI warns fake firms charge up-front fees, and private recovery companies cannot issue seizure orders. No real recovery process needs your seed phrase. Ever.

Plan as if the funds are gone, and fix the cause. Read the full checklist, or talk to Guardian about Managed Security.

Take a breath and work in order. The first steps decide whether you lose more.

This checklist is for individuals, founders and small teams. Protocols and exchanges should run it alongside their own incident plan.

Stop Further Losses

First 15 minutes.

On a device you trust, open your address on a block explorer. Check whether funds are still leaving.
Assets left several chains or wallets at once? Assume your seed phrase or key is exposed. Skip to the next section.
A contract you approved still taking tokens? Revoke that approval now, with Revoke.cash or your wallet's approval tool.
If malware or a bad extension is possible, sign nothing on that device. Disconnect it and use another.
Never enter your seed phrase on a website or share it with anyone.

Revoking helps only against approvals. Revoke.cash is blunt: a compromised seed phrase gives an attacker "full, permanent access to everything in your wallet."

A signed but unused permit will not show in revoke tools until it is submitted. Our guide to Permit2 phishing explains how to cancel one.

Move What Is Left

Next 15 minutes.

Create a new wallet on a clean device, ideally a hardware wallet, with a new seed phrase.
Move remaining assets there, most valuable first, signing only on a device you trust.
If the key is exposed, do not send ETH to the old wallet for gas.
For high-value assets stuck there, Revoke.cash suggests the Flashbots Whitehat Hotline.
Never reuse the old seed phrase or any address made from it.

A sweeper bot is a script that watches a compromised address and moves anything that lands in it. That is why topping up for gas "rarely works", per Revoke.cash.

Work Out How It Happened

The pattern of the theft points to the cause.

What you see	Likely cause	What it means
Assets gone across chains or wallets	Seed phrase or key compromise	Abandon the wallet and check the device
Funds swept seconds after arriving	Sweeper bot on an exposed key	Stop sending funds to it
One token taken by a contract	Malicious approval or permit signature	Revoke the approval
NFTs taken through one marketplace	Marketplace listing signature	Revoke that marketplace's approval
Your payment went to a lookalike	Address poisoning	Nothing to revoke: go to freezes

Think back over the last few days: a signature request, a downloaded file, a support chat, a new extension.

If the key leaked, Revoke.cash advises a malware check and new passwords for important accounts.

Record Evidence and Request Freezes

Next 20 minutes.

Record

Every transaction hash of the theft, with times in UTC.
The attacker's addresses and where the funds went next.
The site, link, file or message that started it.
Screenshots of chats and pages before they are deleted.
Your own addresses and the amounts lost.

Ask for freezes

Stablecoins can sometimes be stopped. Tether can freeze USDT in flagged wallets, and the USDC contract has a blacklist role that can block an address.

Attackers know it. In a December 2025 theft, the attacker swapped 49,999,950 USDT to DAI within 30 minutes, per The Block.

Send the issuer the hashes, the receiving addresses and your report number.
If funds reached an exchange deposit address, send the same to that exchange's security team.
Keep following the trail and update both as funds move.

Report the Theft

Before the hour is out.

US: file a complaint with the FBI's Internet Crime Complaint Center at ic3.gov.
Elsewhere: report to your local police or national cybercrime service. Get a reference number.
Active or imminent incident: contact SEAL 911 on Telegram at @seal_911_bot.

SEAL 911 is the Security Alliance's "free, around-the-clock emergency hotline" for anyone facing an active or imminent incident. Volunteers run it and handle tickets as they have bandwidth.

Our explainer on whether stolen crypto can be traced covers what happens next. Teams should also read our DeFi incident response plan and exchange incident response plan.

Avoid Recovery Scams

Expect offers to get your funds back. The FBI has warned about them repeatedly since 2023.

August 2023: fake recovery firms "charge an up-front fee", then go silent or deliver an incomplete tracing report and ask for more.
June 2024: fake law firms contact victims, claiming authority to investigate recovery cases.
August 2025: the schemes claim ties to several government agencies, some fictitious. "There are no law firms which are officially authorized partners of US Government agencies."

The FBI also says private recovery companies "cannot issue seizure orders", and law enforcement does not charge victims a fee. The IC3 says it does not work with law firms or crypto services to recover funds.

Red flags

Unsolicited contact that already knows your loss.
Guaranteed recovery, or a fee up front, often in crypto.
A request for your seed phrase or to connect your wallet.
Claimed links to the FBI or another agency.
Pressure to act before a "recovery window" closes.

As Revoke.cash puts it: "There is no legitimate recovery process that requires your seed phrase. Ever."

Can Funds Be Recovered?

Sometimes. The best chance is a freeze before the funds are swapped or mixed.

Rarely, an attacker returns funds. In May 2024, an address poisoner returned about $65.7M of a $68M WBTC theft after negotiations, per Cointelegraph.

Plan as if the funds are gone, and fix the cause so it cannot happen twice.

How Guardian Helps Teams

For teams, Managed Security monitors contracts on every block, including multisig transactions and large fund movements. When something fires, a Guardian engineer responds.

Its security operations team also reviews every multisig transaction before it is signed. An OpSec audit maps every path to your funds and who can walk it.

Frequently Asked Questions

What should I do first if my crypto wallet was drained?

On a trusted device, see if funds are still leaving and revoke any live approval. If assets left several chains at once, assume your seed phrase is exposed: skip revoking and move the rest to a new wallet.

Should I send ETH to a drained wallet to pay for gas?

Usually not. If the key is exposed, a sweeper bot watching the address will likely take the ETH first, as Revoke.cash warns. For high-value assets stuck there, it suggests the Flashbots Whitehat Hotline.

Can a recovery service get my crypto back?

Be very wary. The FBI warns that fake recovery firms charge up-front fees and that private recovery companies cannot issue seizure orders. Report to IC3 or your police instead, and never share your seed phrase.

Where do I report stolen crypto?

In the US, file a complaint at ic3.gov. Elsewhere, report to your local police or national cybercrime service. Anyone facing an active or imminent incident can also contact SEAL 911 on Telegram.

Sources

Have an engineer on the next alert

Guardian Managed Security watches your contracts and multisigs around the clock, and a Guardian engineer responds when something fires.

Talk to Guardian Explore Managed Security