Wallet Drained? Permissions, Remaining Funds and Evidence
After an unexpected balance change, stop signing and adding funds, save suspicious transaction hashes, and identify the assets and permissions still exposed. “Thirty minutes” ranks priorities; it promises no recovery. Whether native coin remains is a clue, not a diagnosis of seed compromise.
⚠ Educational content only — not financial, legal or security advice, and no substitute for law enforcement or a qualified professional. On-chain transactions are irreversible. Full disclosure → disclaimer.
The unwelcome part first: do not plan the next thirty minutes around getting the missing funds back. Once a transaction is in a block, no support desk can reverse it. Three goals here and no others — stop losses still in progress, protect what has not been touched, leave evidence in a shape you can hand to somebody. The thirty minutes in the title ranks priorities; it is not a promise, and plenty of incidents are finished before the victim sees a notification. You cannot tell yet which one you are in, so act as though there is time.
Inspect transactions and permissions before diagnosing from balances
Losses may involve abused allowances, a malicious transfer, off-chain signatures, account delegation or leaked keys. Preserve transaction hashes and signed requests, then inspect initiators, calls and asset transfers on the correct explorer.
| Observation | Investigate | What it does not prove |
|---|---|---|
| Only one token moved | Spender, allowance and transferFrom calls | A key holder could choose to take just one asset |
| Native coin moved too | Original transaction, delegation and account execution | A malicious transfer or EIP-7702 delegation can cause this without leaking a seed |
| Several derived accounts affected | Shared seeds, devices and signing history | A warning about scope still requires evidence of the cause |
| An NFT collection moved | Collection operators, transfers and signatures | The remaining native balance is not a diagnostic tie-breaker |
| Loss followed a confirmation | Transaction, Permit, order or delegation | Not every confirmation is approve |
| A seed was entered on a suspicious page | Protect accounts as potentially key-compromised | Exposure endangers control; it does not automatically set balances to zero |
If key compromise cannot be excluded, prepare independent new keys in a trusted environment. Migration carries address, fee and transaction-racing risks too. One leaked private key has a different scope from a seed leak, and an app may manage independent imported accounts.
For off-chain Permit or order signatures, check deadline, nonce and implementation. Clearing an allowance may not invalidate an unused signature. A compromised centralised exchange account requires the platform's account-lock and credential procedures instead.
If an allowance was abused: revoking cuts off access, and nothing more
Revoking does one thing: it removes the attacker's permission to keep pulling tokens out of your address. It governs what happens next and has no effect on what already happened.
Checking which allowances exist requires no wallet connection — approval checkers let you paste in an address and see what it has granted and how large each allowance is. Viewing and revoking are separate acts. Actually revoking means the address holding those allowances broadcasts an on-chain transaction, signed inside your own wallet, and pays a fee for it; a checker cannot do that for you, however prominent its buttons look. Any page offering to "import your seed phrase and clean this up" is the next incident, not a cleanup tool. The mechanism and the procedure are in our token approval and revoke guide.
Whether to revoke or migrate first depends on available transactions, affected permissions, remaining assets and an active attacker. Moving multiple tokens across chains is not necessarily faster than revoking. Compare the actual actions rather than using balance size as a universal rule; do not fund an address whose risk remains unresolved.
If keys leaked: revocation cannot restore exclusive control
Revocation may remove a particular permission, but it cannot restore exclusive control of an exposed key. For a conventional account, an attacker with the required credentials can sign new transactions or grant permissions again. Prepare independent new keys in a trusted environment and protect what can still be moved. Recovery credentials, account type and other controls determine the actual scope.
Clicking "add account" in the same wallet app is not a refuge
A destination must use an independent, unexposed key source. Deriving another account under the old seed does not isolate a seed leak. An app may also manage independent imported keys or hardware accounts, so check key provenance rather than the app name.
Smart contract wallets do not follow the same rule
If the drained account is a smart contract wallet — a Safe, or one of the account-abstraction wallets now common on Ethereum and its layer 2s — its ownership model is structurally different. What controls it is a signer set and a threshold recorded in the contract, not one key hanging off a seed. A leaked key compromises that signer; whether it compromises the account depends on the threshold and who else can sign. The reliable takeaway: rotating a signer and rotating a seed phrase are different operations, and doing one does not achieve the other. Work from that wallet's own current documentation rather than any generic procedure, including this one.
Generate the new seed on a device you are confident is clean
The machine the incident happened on may be the leak itself — a malicious extension, a clipboard monitor, software from somewhere you no longer remember. Generating a new phrase on a device that might already be controlled is copying it out in front of them. If it is your only device, borrow a clean one, or move the funds somewhere else you fully control and postpone the new-seed step. Hardware wallets help because the phrase is generated and stored inside the device — no free pass, though, since a phrase you later type into a website is compromised whatever produced it.
The rescue can fail, and repeating it makes things worse
Someone who can sign for the address can also take the native coin you send in to cover fees, so against automation your gas top-up can vanish before your transfer is broadcast. Stop at an unexplained gas top-up loss and investigate; do not fund two attempts to test whether someone is watching. Stop, and move to documentation. On what to rescue: take what moves in a single transaction, largest amounts first. No swapping, no bridging, no selling to cover fees. Staked and locked positions go last; dust is not worth a signature. And the compromised phrase is retired for good, never again the destination of anything of value.
The order of the first half hour, and why it is that order
The principle is one sentence: do the things that can disappear before the things that cannot. Your balance has a time window; the chain's record does not. Funds first, evidence second — a statement about sequence, not about how much reporting matters.
Stop new exposure. End the suspicious site session and stop signing; isolate a device you suspect is controlled. Signing out or disconnecting does not revoke on-chain permissions or stop an attacker who has a key. Handle those risks from a trusted environment. Do not share a seed or screen with a recovery service.
Move (minutes 5–15). For permission abuse, choose revocation or migration from the scope, remaining assets, transaction count and ability to sign safely. Seed-compromise cases: one job, get the remainder onto an address from a brand-new phrase. If you cannot safely produce one right now, another destination you fully control and that has no connection to this incident still beats leaving the funds where they are.
Document (minutes 15–25). Copy the hash of every suspicious outbound transaction, with the counterparty address, the amount and the time. Next section.
Report (minute 25 onwards). Reporting puts your addresses, hashes and account of events into the record. What any agency or platform does afterwards is their process, under their rules and their caseload, and not something you control or should plan around. Report anyway — skipping it removes even the possibility — but do not treat having reported as entitling you to expect anything. If your address was emptied before you saw any notification, the first two steps have nothing to act on; start at documentation.
What to preserve, and where to report it
Four things matter: the transaction hash, the addresses involved, the amount and asset, and the date and time. That is not a list I invented — it is the set of transaction details laid out, one per row, in the FBI Internet Crime Complaint Center's public service announcement for cryptocurrency scam victims, published on 24 August 2023 as Alert Number I-082423-PSA.
| The item as the advisory names it | What that means in practice | Where to find it |
|---|---|---|
| Cryptocurrency Addresses | Your address, and the address that received the funds | The From and To fields of that transaction on a block explorer |
| Amount and Cryptocurrency Type | How much left and which asset, copied as-is rather than converted into dollars | The transfer breakdown on the transaction page |
| Dates/Times | When it happened, with the time zone stated | The timestamp on the transaction page |
| Transaction ID (hash) | The long string that uniquely identifies this one transaction | The top of the transaction page, where it can be copied directly |
Do not filter for relevance yourself — you are not positioned to judge which detail matters, so include everything rather than curating a tidy summary. The advisory has a separate section on what other information to provide: the URL you landed on, the post that led you there and your message history with whoever contacted you belong in it, so screenshot them before accounts get deleted. And a hash is worth more than a screenshot — an image can be disputed, while a hash is a public, tamper-evident reference anybody can verify against the chain. Our guide to reading a transaction on a block explorer goes through these fields one at a time; where several transactions are involved, repeat for each in time order.
On where to file: readers in the United States report internet crime, including cryptocurrency theft, to the FBI's Internet Crime Complaint Center at ic3.gov, and that advisory is the FBI's own published guidance on what a victim should submit. If you are elsewhere, follow your own jurisdiction's published guidance — most countries route this through a national cybercrime or fraud reporting body, whose current official page is a better source than anything summarised here. Notifying a centralised exchange that appears in the trail is also reasonable, understanding that what it does with the report is a matter for the platform and whatever legal process applies.
Two things to keep straight meanwhile. Preserving evidence is not continuing to use the wallet — keep the address for reference, send it nothing. And a seed phrase is never part of an evidence package: no legitimate report requires your private key, and anybody who asks for it is the next section's subject.
The second wave: the people who say they can get it back
That same advisory puts a warning in its opening paragraph, worth quoting exactly: "Be wary of anyone claiming they can recover your funds as this may be another scam." The sentence sits at the front of guidance written for people who have just been robbed, which tells you how reliably the approach follows the loss.
A separate IC3 advisory published on 20 July 2026, Alert Number I-072026-PSA, deals with people impersonating the IC3 itself to approach victims. It contains a line usable as a hard test whenever somebody invokes an official name: "IC3 will never ask for payment to recover lost funds, nor will IC3 refer someone to a company requesting payment for recovering funds." If a contact claims official standing and money enters the conversation, that quote has settled it.
Why they reach you so fast is not mysterious: your loss is public. The drained address, the amounts and the timing are visible to anyone who looks, and address-monitoring is trivial to automate — posting a plea for help only speeds it up. Any one of the following should end the conversation:
- They contacted you first — a DM, a reply under your post, a friend request, especially just after you mentioned being drained anywhere public.
- Payment up front. The label makes no difference: retainer, unfreezing fee, processing fee, legal fee, gas.
- They want your seed phrase or private key. No legitimate investigation needs it — not partially, not "just the first four words".
- They want you to sign a "verification transaction" or connect to an "asset verification" page. That is a second approval attack wearing a helpful expression.
- Their evidence is a folder of success-story screenshots. Screenshots are the cheapest artefact in existence.
- They claim to be law enforcement, exchange security or wallet staff, but arrived by social media message. Verify through that organisation's own published contact route — never a link or handle they supplied.
This site does not recommend, review or refer any service claiming to recover stolen crypto, and deliberately names none. Hand the material from the previous section to the appropriate place, then stop. The most expensive loss after a theft is frequently not the theft.
The first 30 minutes, as a checklist
Work down it in order, and do not skip ahead:
- [ ] Stop new signatures and funding, end the suspicious site session and isolate a potentially controlled device. Disconnecting does not revoke permissions; never enter a seed for a requested “verification”
- [ ] Inspect actual transfers, calls, permissions and account delegations. Balances are clues, not a diagnosis. If the cause remains unknown, protect assets against possible key exposure without presenting that precaution as proof
- [ ] Choose revocation or migration from the permission scope, remaining assets, required transactions and ability to sign safely. Revocation requires the relevant on-chain operation and cannot recover transferred funds
- [ ] Seed case: on a device you trust, generate a brand-new seed phrase and move what remains to an address under it. Confirm independent keys rather than another account derived from the old seed
- [ ] Rescue by "moves in one transaction" and "largest first". No swapping, no bridging. Stop at unexplained gas top-up loss; do not repeatedly add funds
- [ ] Document: for every suspicious outbound transaction record the hash, counterparty address, amount and asset, date and time. Screenshot the messages and the URL too
- [ ] Report through the official channel for your jurisdiction with all four transaction details. Include what you are unsure about rather than filtering it out
- [ ] Retire the compromised seed phrase permanently, and ignore everyone who now offers to recover the funds
One-line rule: protect what is left, preserve what can be proved, and do not build your next move on what is already gone.
Once the day is over, change these four things
Record the incident: device, links, signed requests and times. Address suspected device compromise before using it for wallets again. Secure cloud accounts that may have held phrase photos. Keep new backups offline and use the wallet’s official verification process while preserving working access. Do not uninstall your only wallet first or type a hardware seed into online software.
Control future exposure with separate key and permission boundaries; see cold, hot and burner tiers. Learn request checks in the phishing guide and permission cleanup in the approval guide. A theft does not mean you deserved it; focus on preventing further exposure.
FAQ · seven questions people ask in the first hour
My wallet was just drained. What is the very first thing to do?
Stop new signatures and funding, save transaction hashes, and inspect transfers, calls and permissions. Native coin movement alone does not diagnose a leaked key. Disconnecting a website does not revoke existing permissions.
Will revoking token approvals get my stolen crypto back?
No. Successful revocation limits future use of that permission. Leaked keys can still sign new transactions, and unused off-chain signatures may need separate invalidation. Decide migration versus revocation from actual exposure and transaction conditions.
My seed phrase leaked. Can I just create a new account in the same wallet app?
Not if it derives from the same seed. Use an independent new key source in a trusted environment. Check separately whether the app manages any independently imported or hardware accounts.
Is there any realistic way to recover crypto stolen from my wallet?
Plan on the basis that there is not. A transaction included in a block is irreversible: no support desk can undo it and there is no rollback mechanism in the system. Filing a report puts your addresses, transaction hashes and account of events into the record, and what any agency or platform subsequently does is their process under their own rules, not an outcome you can count on or schedule around. The three things genuinely within your control are stopping losses still in progress, protecting whatever has not been touched, and preserving evidence in a form somebody else can verify.
What information do I need to report crypto theft?
The FBI advisory for cryptocurrency scam victims published on 24 August 2023, Alert Number I-082423-PSA, sets out four transaction details: the cryptocurrency addresses involved, the amount and cryptocurrency type, the dates and times, and the transaction ID, which is the hash. A screenshot alone is worth submitting but is much weaker than a hash, because an image can be disputed while a hash is a public, tamper-evident reference anyone can check against the chain. You will find the hash at the top of that transaction's page on a block explorer. Where you file depends on your jurisdiction, so follow your own country's published guidance.
Someone messaged me offering to trace and recover my stolen crypto. Is that legitimate?
Treat it as not legitimate. The FBI advisory for cryptocurrency scam victims warns in its opening paragraph to be wary of anyone claiming they can recover your funds, as this may be another scam. A separate IC3 advisory from July 2026 about people impersonating the IC3 states that the IC3 will never ask for payment to recover lost funds and will never refer someone to a company requesting payment for recovering funds. The red flags: they contacted you first, they want payment up front under any label, they ask for your seed phrase, or they want you to sign a verification transaction.
I only noticed hours later. Does the 30-minute window mean it is already too late?
No. The thirty minutes is a way of ranking priorities, not a deadline or a promise. Many incidents are finished before the victim sees a notification, in which case the stop-the-bleeding and move steps have nothing left to act on and you should start at documentation. In others the attacker only took the one token they held an allowance for, and there is real time to protect the rest. The value of that half hour is the sequence rather than the speed: do the things that can disappear before the things that cannot.
Sources cited
- FBI public service announcement, FBI Guidance for Cryptocurrency Scam Victims (Alert Number I-082423-PSA, 24 August 2023) · ic3.gov/PSA/2023/PSA230824
- FBI public service announcement, FBI Warns of Scammers Impersonating the IC3 (Alert Number I-072026-PSA, 20 July 2026) · ic3.gov/PSA/2026/PSA260720
- BIP-32, hierarchical deterministic wallets · github.com/bitcoin/bips · bip-0032
- BIP-44, multi-account hierarchy · github.com/bitcoin/bips · bip-0044
- ethereum.org · gas and fees overview · ethereum.org/en/developers/docs/gas
- ethereum.org · security and scam-avoidance guidance · ethereum.org/en/security
- Revoke.cash home page (source of figure 1) · revoke.cash