Crypto Security Incident Response: What to Do After a Wallet, Exchange or Account Compromise

Overview

Crypto transactions are often difficult or impossible to reverse, so speed and order matter. Do not begin by confronting the suspected attacker, clicking links in an alert, or paying someone who promises guaranteed recovery. Start by containing the incident, recording what happened, and using support channels reached through official websites or applications.

A useful decision tree is:

1. Is an unauthorized transfer already visible? Preserve the transaction details and contact the exchange, wallet provider, and relevant authorities immediately.
2. Is a private key or seed phrase exposed? Treat the wallet as permanently unsafe and move remaining assets to a newly created wallet using a clean device.
3. Are login credentials or an email account compromised? Secure the email and identity systems first, then revoke sessions, reset passwords, and review withdrawals.
4. Did you only interact with a suspicious link or approval? Disconnect the wallet, revoke unfamiliar token approvals, and inspect transactions before signing anything else.

If you are unsure which category applies, assume the broadest reasonable risk until you can verify otherwise. A connected wallet, compromised email, and exchange account can expose one another through password resets, session recovery, or transaction approvals.

For transaction verification, save the network, asset, amount, destination address, transaction hash, and approximate time. A blockchain explorer can help you confirm whether a transfer was submitted, confirmed, or merely displayed by a misleading website. See our guide on how to read a blockchain explorer for the fields to check.

Checklist by scenario

1. Suspected phishing or a malicious website

• Close the suspicious page and do not return through the message, advertisement, or search result that led you there.
• Disconnect the wallet from the site. In the wallet’s connected-sites or permissions area, remove access you do not recognize.
• Review recent signatures and token approvals. An approval may allow a contract or spender to move tokens later, even if no transfer happened immediately.
• Revoke unfamiliar approvals using a reputable permission-management tool appropriate for the network. Compare the contract address and network carefully before confirming a revocation transaction.
• If you entered a password, seed phrase, or private key, treat those credentials as exposed. Changing a wallet password does not make an exposed seed phrase safe.

Do not assume a familiar-looking domain, support badge, or social-media account is genuine. Navigate to the provider’s known official domain by using a saved bookmark or independently verified contact route. Our token-approval cleanup guide covers the review process in more detail.

2. Stolen exchange or email credentials

• Use a trusted, clean device to change the email password first if the email account may be involved.
• Enable an authenticator-app or hardware-security-key method where supported. Avoid relying solely on text messages when stronger options are available.
• Sign out of all sessions, revoke unknown devices and application connections, and remove unfamiliar email-forwarding rules or recovery addresses.
• Contact the exchange through its official help center and request an account freeze or withdrawal restriction if that option exists.
• Check API keys, withdrawal addresses, address books, trading bots, linked payment methods, and recent login history. Disable anything you did not create.
• Change reused passwords on other services, beginning with financial, email, cloud-storage, and password-manager accounts.

Do not use a support number or link supplied in an unsolicited message. A real support team should not ask for your seed phrase, private key, one-time authentication code, or remote access to your device.

3. Unauthorized transfer from a wallet or exchange

• Preserve the transaction hash, source and destination addresses, network, asset, amount, timestamps, screenshots, and relevant messages.
• Stop interacting with the compromised wallet. Do not send a small “test” transfer to the same address and do not sign further transactions from it.
• If assets remain on an exchange, request a withdrawal freeze immediately. If assets remain in a self-custody wallet and the signing key is safe, consider moving them to a newly created wallet from a clean device.
• Notify the exchange, wallet provider, affected blockchain or application, and any legitimate service that may be able to flag the destination. Recovery is not guaranteed, but early reporting preserves options.
• Report the incident to the appropriate law-enforcement, cybercrime, consumer-protection, or financial authority for your jurisdiction. Keep the report number and all supporting evidence.

Be precise and factual. Distinguish confirmed transfers from suspicious activity, and avoid publicly posting your full email address, account identifiers, seed phrase, or other information that could enable another attack.

4. Exposed seed phrase or private key

• Assume every account controlled by that phrase or key is compromised, even if no unauthorized transaction is visible.
• Create a new wallet with a fresh seed phrase on a clean device or hardware wallet. Do not generate it on a device that may contain malware.
• Write the new recovery phrase offline and store it securely. Never photograph it, upload it to cloud storage, or enter it into a website or chat.
• Transfer remaining assets after checking the destination address on the device screen and confirming the correct network.
• Review and recreate only the applications, delegations, multisignature permissions, and approvals that are genuinely needed.

Revoking token approvals does not repair an exposed private key. The key itself can still authorize transfers, so migration to a new wallet is the essential step.

What to double-check

Evidence: Save original emails, headers where available, website addresses, chat logs, screenshots, wallet notifications, transaction hashes, and device timelines. Keep copies in a location that the suspected attacker cannot alter.

Scope: Review every wallet, exchange, email address, device, browser extension, API key, and cloud account connected to the incident. Check other chains and token accounts, not only the asset you first noticed.

Approvals and sessions: Disconnecting a website is not the same as revoking an on-chain approval, and changing a password is not always the same as ending active sessions. Perform both where relevant.

Official recovery paths: Type the provider’s known domain yourself or use an independently verified bookmark. Confirm whether the provider offers emergency freezes, fraud forms, device management, or withdrawal-address controls; procedures can change.

Tax and records: Keep a dated incident log and transaction history. Depending on your jurisdiction, theft, loss, transfers, or reimbursement may have tax and reporting implications. Seek qualified local advice rather than assuming a stolen asset automatically receives a particular tax treatment.

Device health: Watch for unknown browser extensions, new administrator accounts, unexplained remote-access software, disabled security tools, unusual battery or network activity, and repeated password-reset messages. If malware is plausible, stop using the device for financial activity and obtain professional technical assistance or securely reinstall it.

Common mistakes

• Waiting for certainty: A pending drain or exposed seed phrase warrants containment before every detail is known.
• Using the compromised device: Password changes and wallet migrations made on an infected device may be captured again.
• Sending recovery fees: “Recovery agents” who demand upfront crypto, remote access, or private credentials are a common follow-on scam.
• Sharing secrets with support: Legitimate providers do not need a seed phrase or private key to investigate an account.
• Forgetting non-crypto accounts: Email, phone, cloud, password-manager, and social accounts can provide routes back into an exchange.
• Making public accusations too early: Preserve evidence privately and provide it to the relevant provider or authority. Public posts can reveal useful details to another attacker.
• Assuming a reversal is possible: Blockchain confirmations and self-custody transactions may not be reversible. Report quickly, but do not rely on a promised recovery.

When to revisit

Use this checklist immediately after a suspicious message, unexpected login, unfamiliar approval, lost device, or unauthorized transfer. Revisit it after changing an exchange, wallet, email provider, authenticator, hardware wallet, or browser extension, because the available security controls and emergency contacts may differ.

Schedule a periodic audit at least before major trading or travel periods and whenever you move substantial assets. Confirm that recovery information is current, backups are accessible, old sessions and API keys are removed, and wallet approvals still match your actual use. Recheck official support procedures whenever a platform announces a security incident or changes its account-recovery workflow.

For a broader wallet migration plan, see our wallet selection and migration checklist. If an exchange holds a significant balance, reviewing custody and solvency risks alongside account security can also be useful; our guide to exchange proof of reserves explains what those claims do and do not establish.

Final action: If you suspect an active compromise, stop signing transactions, secure email and exchange access from a clean device, preserve evidence, revoke unsafe permissions where appropriate, and contact official support and relevant authorities. Never trade speed for secrecy with someone promising guaranteed recovery.