Your wallet was drained — the first 30 minutes, and why approval abuse and a leaked seed need opposite responses
A transaction that has been included in a block has no cancel button and no chargeback, so the only thing this half hour can change is what is still there. The first decision is not who did it, but which of two accidents this is: a permission you once signed is being used against you, or your seed phrase is in somebody else's hands. The fixes are opposite — revoking approvals stops the first and does nothing for the second, where the only move that works is getting whatever remains onto an address from a brand-new seed phrase. Below: triage, stop the bleeding, move, document, report, and the second wave.
⚠ Educational content only — not financial, legal or security advice, and no substitute for law enforcement or a qualified professional. On-chain transactions are irreversible. Full disclosure → disclaimer.
The unwelcome part first: do not plan the next thirty minutes around getting the missing funds back. Once a transaction is in a block, no support desk can reverse it. Three goals here and no others — stop losses still in progress, protect what has not been touched, leave evidence in a shape you can hand to somebody. The thirty minutes in the title ranks priorities; it is not a promise, and plenty of incidents are finished before the victim sees a notification. You cannot tell yet which one you are in, so act as though there is time.
Work out which accident this is before you touch anything
Almost every self-custody incident lands in one of two buckets: an allowance you once signed is being used to move your tokens, or your seed phrase or private key is now in somebody else's possession. The responses are not interchangeable — someone whose seed has leaked, patiently revoking allowances one contract at a time, is signing transactions while the rest of the balance walks out the door. Read the chain first, then reconstruct what you did; matching one or two rows below is enough to point you down a path.
| What you can observe | More likely to be | Why, mechanically |
|---|---|---|
| One token left the address; the native coin and your other tokens are untouched | Approval abuse | An allowance is granted per token contract, so only that token can move — and the attacker paid the fee from their own address |
| The native coin — the ETH, BNB or SOL you pay fees with — is gone too | Key or seed compromise | There is no allowance mechanism for a native coin. The only party who can move it is somebody able to sign for that address |
| Several addresses under one seed phrase, or addresses on several chains, were hit at once | Key or seed compromise | One approval covers one address, one chain, one contract. A seed phrase is the root of an entire tree of keys |
| An entire NFT collection left in one go | Could be either | NFT standards allow a single approval covering a whole collection, but a key holder can do the same. Use the native balance as the tie-breaker |
| The loss happened immediately after you confirmed something on a website | Approval abuse | What you confirmed was the allowance itself, or an off-chain signature granting an equivalent permission |
| Your seed phrase has ever been typed into a web page, sent to "support", photographed, or saved anywhere that syncs | Key or seed compromise | Whichever chain the loss appeared on is beside the point. Once those words leave your hands, the whole tree stops being exclusively yours |
When the signals are ambiguous, treat it as the worse case. Migrate the remainder to a brand-new seed phrase and, if it turns out to have been "only" approval abuse, you have spent some fees and some time. Treat a compromised seed as an approval problem and the cost is the rest of your balance leaving while you sign revocations. The errors are not symmetrical, so default to the strict side.
Two clarifications. What you approved may not have been a transaction but an off-chain signature — shown as a signature request, costing no gas — which can still grant transfer or order-filling rights, so it belongs in the first bucket. And this is about self-custody wallets: a compromised centralised exchange account is a different path, starting with contacting the platform to lock the account, and it is out of scope here.
If an allowance was abused: revoking cuts off access, and nothing more
Revoking does one thing: it removes the attacker's permission to keep pulling tokens out of your address. It governs what happens next and has no effect on what already happened.
Checking which allowances exist requires no wallet connection — approval checkers let you paste in an address and see what it has granted and how large each allowance is. Viewing and revoking are separate acts. Actually revoking means the address holding those allowances broadcasts an on-chain transaction, signed inside your own wallet, and pays a fee for it; a checker cannot do that for you, however prominent its buttons look. Any page offering to "import your seed phrase and clean this up" is the next incident, not a cleanup tool. The mechanism and the procedure are in our token approval and revoke guide.
One sequencing decision gets routinely reversed. If the address still holds a meaningful balance, moving the funds out is usually faster than revoking. Revocation is granular — one token, one chain, one contract at a time, each with its own signature and fee — whereas a transfer often clears the bulk in one or two transactions, and stale allowances cannot hurt an empty address you never fund again. Reverse that when a single token is affected and the amount is small. If you cannot remember granting the allowance at all, apply the default above and treat this as a seed compromise.
If the seed phrase or private key leaked: revoking is meaningless
Here revoking accomplishes nothing. Whoever holds your key is, as far as the chain is concerned, you: they need no permission to move anything, and any allowance you revoke they can grant themselves again. Exactly one action helps — generate a brand-new seed phrase, and move whatever can still be moved to an address derived from it. Four things go wrong here more than anywhere else.
Clicking "add account" in the same wallet app is not a refuge
The extra accounts a mainstream wallet offers are all derived from the one phrase you wrote down. BIP-32 describes how a single seed produces an entire tree of keys; BIP-44 adds an account level on top so funds from different accounts are not mixed together. Not mixed together is a bookkeeping property, not a cryptographic one. There is still one seed, and whoever obtained it obtained every address underneath it, on every chain, at once — concepts covered in self-custody wallet basics. The destination must come from a phrase generated fresh.
Smart contract wallets do not follow the same rule
If the drained account is a smart contract wallet — a Safe, or one of the account-abstraction wallets now common on Ethereum and its layer 2s — its ownership model is structurally different. What controls it is a signer set and a threshold recorded in the contract, not one key hanging off a seed. A leaked key compromises that signer; whether it compromises the account depends on the threshold and who else can sign. The reliable takeaway: rotating a signer and rotating a seed phrase are different operations, and doing one does not achieve the other. Work from that wallet's own current documentation rather than any generic procedure, including this one.
Generate the new seed on a device you are confident is clean
The machine the incident happened on may be the leak itself — a malicious extension, a clipboard monitor, software from somewhere you no longer remember. Generating a new phrase on a device that might already be controlled is copying it out in front of them. If it is your only device, borrow a clean one, or move the funds somewhere else you fully control and postpone the new-seed step. Hardware wallets help because the phrase is generated and stored inside the device — no free pass, though, since a phrase you later type into a website is compromised whatever produced it.
The rescue can fail, and repeating it makes things worse
Someone who can sign for the address can also take the native coin you send in to cover fees, so against automation your gas top-up can vanish before your transfer is broadcast. Two funded attempts with no transfer out means the address is watched, and every further top-up is an additional loss. Stop, and move to documentation. On what to rescue: take what moves in a single transaction, largest amounts first. No swapping, no bridging, no selling to cover fees. Staked and locked positions go last; dust is not worth a signature. And the compromised phrase is retired for good, never again the destination of anything of value.
The order of the first half hour, and why it is that order
The principle is one sentence: do the things that can disappear before the things that cannot. Your balance has a time window; the chain's record does not. Funds first, evidence second — a statement about sequence, not about how much reporting matters.
Stop the bleeding (minutes 1–5). Take the affected device off the network or sign out of the wallet application, and end any site session. Equally important is what you do not do: no typing a seed phrase to "verify" anything, no "one-click recovery" pop-ups, no screen sharing with anybody who contacted you first. For these five minutes, treat every prompt asking for a seed phrase as an attack.
Move (minutes 5–15). Approval cases: choose between revoking first and transferring first based on how much is left. Seed-compromise cases: one job, get the remainder onto an address from a brand-new phrase. If you cannot safely produce one right now, another destination you fully control and that has no connection to this incident still beats leaving the funds where they are.
Document (minutes 15–25). Copy the hash of every suspicious outbound transaction, with the counterparty address, the amount and the time. Next section.
Report (minute 25 onwards). Reporting puts your addresses, hashes and account of events into the record. What any agency or platform does afterwards is their process, under their rules and their caseload, and not something you control or should plan around. Report anyway — skipping it removes even the possibility — but do not treat having reported as entitling you to expect anything. If your address was emptied before you saw any notification, the first two steps have nothing to act on; start at documentation.
What to preserve, and where to report it
Four things matter: the transaction hash, the addresses involved, the amount and asset, and the date and time. That is not a list I invented — it is the set of transaction details laid out, one per row, in the FBI Internet Crime Complaint Center's public service announcement for cryptocurrency scam victims, published on 24 August 2023 as Alert Number I-082423-PSA.
| The item as the advisory names it | What that means in practice | Where to find it |
|---|---|---|
| Cryptocurrency Addresses | Your address, and the address that received the funds | The From and To fields of that transaction on a block explorer |
| Amount and Cryptocurrency Type | How much left and which asset, copied as-is rather than converted into dollars | The transfer breakdown on the transaction page |
| Dates/Times | When it happened, with the time zone stated | The timestamp on the transaction page |
| Transaction ID (hash) | The long string that uniquely identifies this one transaction | The top of the transaction page, where it can be copied directly |
Do not filter for relevance yourself — you are not positioned to judge which detail matters, so include everything rather than curating a tidy summary. The advisory has a separate section on what other information to provide: the URL you landed on, the post that led you there and your message history with whoever contacted you belong in it, so screenshot them before accounts get deleted. And a hash is worth more than a screenshot — an image can be disputed, while a hash is a public, tamper-evident reference anybody can verify against the chain. Our guide to reading a transaction on a block explorer goes through these fields one at a time; where several transactions are involved, repeat for each in time order.
On where to file: readers in the United States report internet crime, including cryptocurrency theft, to the FBI's Internet Crime Complaint Center at ic3.gov, and that advisory is the FBI's own published guidance on what a victim should submit. If you are elsewhere, follow your own jurisdiction's published guidance — most countries route this through a national cybercrime or fraud reporting body, whose current official page is a better source than anything summarised here. Notifying a centralised exchange that appears in the trail is also reasonable, understanding that what it does with the report is a matter for the platform and whatever legal process applies.
Two things to keep straight meanwhile. Preserving evidence is not continuing to use the wallet — keep the address for reference, send it nothing. And a seed phrase is never part of an evidence package: no legitimate report requires your private key, and anybody who asks for it is the next section's subject.
The second wave: the people who say they can get it back
That same advisory puts a warning in its opening paragraph, worth quoting exactly: "Be wary of anyone claiming they can recover your funds as this may be another scam." The sentence sits at the front of guidance written for people who have just been robbed, which tells you how reliably the approach follows the loss.
A separate IC3 advisory published on 20 July 2026, Alert Number I-072026-PSA, deals with people impersonating the IC3 itself to approach victims. It contains a line usable as a hard test whenever somebody invokes an official name: "IC3 will never ask for payment to recover lost funds, nor will IC3 refer someone to a company requesting payment for recovering funds." If a contact claims official standing and money enters the conversation, that quote has settled it.
Why they reach you so fast is not mysterious: your loss is public. The drained address, the amounts and the timing are visible to anyone who looks, and address-monitoring is trivial to automate — posting a plea for help only speeds it up. Any one of the following should end the conversation:
- They contacted you first — a DM, a reply under your post, a friend request, especially just after you mentioned being drained anywhere public.
- Payment up front. The label makes no difference: retainer, unfreezing fee, processing fee, legal fee, gas.
- They want your seed phrase or private key. No legitimate investigation needs it — not partially, not "just the first four words".
- They want you to sign a "verification transaction" or connect to an "asset verification" page. That is a second approval attack wearing a helpful expression.
- Their evidence is a folder of success-story screenshots. Screenshots are the cheapest artefact in existence.
- They claim to be law enforcement, exchange security or wallet staff, but arrived by social media message. Verify through that organisation's own published contact route — never a link or handle they supplied.
This site does not recommend, review or refer any service claiming to recover stolen crypto, and deliberately names none. Hand the material from the previous section to the appropriate place, then stop. The most expensive loss after a theft is frequently not the theft.
The first 30 minutes, as a checklist
Work down it in order, and do not skip ahead:
- [ ] Close the open channel: leave the network or sign out of the wallet app, end any site session; type your seed phrase into nothing, for any reason
- [ ] Triage: native coin intact and one token missing → approval abuse; native coin gone, or several addresses or chains hit at once → seed compromise; ambiguous → treat as seed compromise
- [ ] Approval case: large balance, move funds out first; small balance, revoke that allowance first. Revoking means signing an on-chain transaction from your own wallet and paying the fee
- [ ] Seed case: on a device you trust, generate a brand-new seed phrase and move what remains to an address under it. A new account in the same app is not a new seed
- [ ] Rescue by "moves in one transaction" and "largest first". No swapping, no bridging. Two failed gas top-ups means stop
- [ ] Document: for every suspicious outbound transaction record the hash, counterparty address, amount and asset, date and time. Screenshot the messages and the URL too
- [ ] Report through the official channel for your jurisdiction with all four transaction details. Include what you are unsure about rather than filtering it out
- [ ] Retire the compromised seed phrase permanently, and ignore everyone who now offers to recover the funds
One-line rule: protect what is left, preserve what can be proved, and do not build your next move on what is already gone.
Once the day is over, change these four things
Write down how it got in — which device, which link, what you signed, when. Whatever you cannot reconstruct is your blind spot. Then, device hygiene: if the verdict was a compromised seed, that machine touches no wallet until its extensions are audited, unaccounted-for software is gone, and the operating system is reinstalled if there is real doubt. Change the password on any cloud account that could have synced a photo of the phrase. Rebuild your backup discipline: the new phrase goes onto paper or metal, offline, nothing that syncs, and you rehearse recovery — uninstall, reinstall, import, confirm the same address returns — before funding it.
Split the funds up, because the ceiling on this incident's loss was the entire balance of one address; see cold, hot and burner wallet tiers. And close the recognition gap: approval incidents almost always begin with one signature nobody fully read, so the lures and the lines to check inside a prompt are in the wallet phishing defense guide, and scheduled allowance cleanup is in the token approval and revoke guide. For anyone still reeling: being robbed on-chain is not evidence that you are careless. The people on the other side do this full time.
FAQ · seven questions people ask in the first hour
My wallet was just drained. What is the very first thing to do?
Work out which of two accidents this is, rather than searching for a way to get the funds back. If exactly one token left and your native coin and other tokens are untouched, an allowance you previously signed is the likely cause. If the native coin is gone too, or several addresses under one seed phrase or on several chains were hit at once, your key or seed phrase has been compromised. The responses are opposite, which is why the classification comes first. Meanwhile, end any active site session and do not type your seed phrase into anything offering to verify or restore your wallet.
Will revoking token approvals get my stolen crypto back?
No. Revoking removes the attacker's permission to keep pulling tokens out of your address from now on, which is useful if an allowance was what got abused, but it has no effect on transfers that already happened. And if your seed phrase or private key leaked, revoking achieves nothing at all, because whoever holds the key is you as far as the chain is concerned and can grant themselves the permission again. One piece of sequencing: when a substantial balance is still sitting there, moving the funds out is usually faster, since revocation happens one token and one contract at a time.
My seed phrase leaked. Can I just create a new account in the same wallet app?
No, that gives you no protection. Multi-account support in mainstream wallets derives every account from the same seed phrase: BIP-32 describes how one seed generates an entire tree of keys, and BIP-44 adds an account level on top so funds from different accounts are not mixed together. Not mixed together is a bookkeeping property, not a cryptographic one. There is still exactly one seed, and whoever obtained it obtained every address under it on every chain. The only effective move is to generate a brand-new seed phrase, ideally on a device you are confident is clean, and transfer whatever remains to an address derived from it.
Is there any realistic way to recover crypto stolen from my wallet?
Plan on the basis that there is not. A transaction included in a block is irreversible: no support desk can undo it and there is no rollback mechanism in the system. Filing a report puts your addresses, transaction hashes and account of events into the record, and what any agency or platform subsequently does is their process under their own rules, not an outcome you can count on or schedule around. The three things genuinely within your control are stopping losses still in progress, protecting whatever has not been touched, and preserving evidence in a form somebody else can verify.
What information do I need to report crypto theft?
The FBI advisory for cryptocurrency scam victims published on 24 August 2023, Alert Number I-082423-PSA, sets out four transaction details: the cryptocurrency addresses involved, the amount and cryptocurrency type, the dates and times, and the transaction ID, which is the hash. A screenshot alone is worth submitting but is much weaker than a hash, because an image can be disputed while a hash is a public, tamper-evident reference anyone can check against the chain. You will find the hash at the top of that transaction's page on a block explorer. Where you file depends on your jurisdiction, so follow your own country's published guidance.
Someone messaged me offering to trace and recover my stolen crypto. Is that legitimate?
Treat it as not legitimate. The FBI advisory for cryptocurrency scam victims warns in its opening paragraph to be wary of anyone claiming they can recover your funds, as this may be another scam. A separate IC3 advisory from July 2026 about people impersonating the IC3 states that the IC3 will never ask for payment to recover lost funds and will never refer someone to a company requesting payment for recovering funds. The red flags: they contacted you first, they want payment up front under any label, they ask for your seed phrase, or they want you to sign a verification transaction.
I only noticed hours later. Does the 30-minute window mean it is already too late?
No. The thirty minutes is a way of ranking priorities, not a deadline or a promise. Many incidents are finished before the victim sees a notification, in which case the stop-the-bleeding and move steps have nothing left to act on and you should start at documentation. In others the attacker only took the one token they held an allowance for, and there is real time to protect the rest. The value of that half hour is the sequence rather than the speed: do the things that can disappear before the things that cannot.
Sources cited
- FBI public service announcement, FBI Guidance for Cryptocurrency Scam Victims (Alert Number I-082423-PSA, 24 August 2023) · ic3.gov/PSA/2023/PSA230824
- FBI public service announcement, FBI Warns of Scammers Impersonating the IC3 (Alert Number I-072026-PSA, 20 July 2026) · ic3.gov/PSA/2026/PSA260720
- BIP-32, hierarchical deterministic wallets · github.com/bitcoin/bips · bip-0032
- BIP-44, multi-account hierarchy · github.com/bitcoin/bips · bip-0044
- ethereum.org · gas and fees overview · ethereum.org/en/developers/docs/gas
- ethereum.org · security and scam-avoidance guidance · ethereum.org/en/security
- Revoke.cash home page (source of figure 1) · revoke.cash