If a wallet may be compromised, stop suspicious interactions, check outgoing records on the correct network, and distinguish asset movements from display problems. Then assess approvals and exposed secrets, identify affected accounts, and preserve public evidence. If a seed phrase is exposed, a sweeper bot is suspected, or a signature is unclear, stop funding and signing on your own and seek help through verified official channels. MetaMask’s guidance explains why changing a password does not replace exposed control. This hypothetical walkthrough uses references checked through October 27, 2026, and promises no recovery.
When tokens suddenly disappear, it is tempting to do something immediately: change a password, revoke an approval, or send in more ETH to pay a fee. ETH is Ethereum’s native coin. On-chain execution is billed in gas, so topping up gas usually means adding the native coin used for network fees. Depending on the cause, that same action may help—or simply expose more funds.
Put the known facts in order first. Is the balance merely missing from the display, or did assets actually leave? Was one token allowance used, or was a seed phrase also disclosed? We will add clues to one teaching incident and show how each new fact changes the response.
First Establish Whether Assets Actually Moved
A blank balance display, an unfamiliar incoming token, and an actual outgoing transfer are different clues. Check public on-chain information through entry points you have verified yourself. Do not follow a stranger’s instructions to connect to another site while investigating. For the relationship between wallets and on-chain accounts, see wallets and account control.
Separate Display Problems, Unfamiliar Deposits, and Real Outflows
If tokens are missing after switching devices, check the account address, network, and token contract before concluding there was a theft. Conversely, if the correct network shows an unexpected successful outflow, reinstalling the app or adding the token to its display is not enough.
Assess unfamiliar incoming records separately. MetaMask’s official Address poisoning scams explains how similar-looking addresses or transaction records can trick users into copying the wrong recipient. An unfamiliar small incoming record does not itself prove a private key has leaked. Do not open URLs attached to unknown tokens or copy the next recipient directly from recent transaction history. Check direction, asset, and what you actually did. A block explorer lets you inspect public on-chain records; an ordinary lookup requires no keys.
Keep Observations Separate from Possible Causes
Finding a successful outgoing transfer is an observation. Concluding that a seed phrase must have leaked is a causal claim requiring more evidence. Tokens may move through an earlier spending permission, exposed keys, a compromised device or login, or another protocol mechanism. One screen usually cannot rule out every route.
Write down confirmed public information, then list what remains unknown. You may know which token moved, on which chain, and when, without knowing what was signed. Mark the signature content as unknown rather than inventing it. This is more useful than rushing to label the incident and gives official support a clearer starting point.
Decide Whether a Permission or Account Control Is Exposed
The response depends on whether exposure involves a specific permission or the material that can create new transactions. A suspicious approval may narrow down the route used for one spend. It does not automatically prove the keys remain safe. A known seed-phrase leak requires more than revoking that one allowance.
A Suspicious Approval Still Requires Checks for Other Exposure
If the current evidence concerns a specific token allowance, verify the network, account, token contract, and spender through trusted sources, then assess whether the corresponding permission can be safely revoked. After successful revocation, query the state again. Check for other token permissions, non-fungible token (NFT) permissions, or signature-based permissions too; disconnecting the site does not cancel them all.
This branch assumes a trusted operating environment and no known exposure of control material or signs of a sweeper bot. Do not directly fund a possibly compromised account just to cover revocation fees. If a request is unclear, stop signing and ask verified official support to help interpret public information.
Disclosed Seed Phrases or Private Keys Expand the Scope
If you entered a seed phrase on an unfamiliar page, or someone else may have obtained a private-key copy, they may be able to reconstruct the relevant control in another environment. Changing a local password does not retrieve that copy. Adding an account under the same seed phrase does not replace the compromised source.
MetaMask’s official I've been hacked/scammed and Kraken Wallet’s My Kraken Wallet has been compromised both identify a new, secure source of control as an important direction. This does not guarantee that every asset can immediately be moved. Sweeper activity, asset transferability, the operating environment, and network fees all affect what is feasible.
One Incident: How New Evidence Changes the Response
This is a paper analysis, not a real police report, on-chain operation, or asset-recovery record. We retain the series’ account map: A1 and A2 derive from seed phrase Alpha, with no additional passphrase in this example. B uses a separate independent private key; C uses hardware backup Beta. These are labels, with no usable addresses, keys, or transaction hashes.
Step 1: Stop New Actions and Preserve Original Public Records
The scenario begins when A1’s token T balance drops by 30 units. Stop interacting with the suspicious site and refuse its requests for additional signatures, verification, or payments. If the original device may be infected, do not enter recovery material there. Use a trusted clean environment to inspect public information and preserve original records.
This does not mean immediately deleting the entire wallet. Keep useful public account information, transaction identifiers, and incident clues. If an independent backup has not been checked, do not erase the only usable local data in the name of resetting security. Stop sensitive activity on the suspect device; decisions about resetting it and preserving evidence are separate from account-control questions.
Check the correct network, A1, and the T contract, and confirm a successful outflow of 30. Label it event E1. E1 is a teaching label, not a real transaction identifier or TxID. At this point, the only established conclusion is an unexpected outflow of A1’s T. Other accounts’ exposure remains unknown, and no unverified signature content is added.
Step 2: An Allowance-Based Spend Does Not Prove the Key Is Safe
Inspect E1’s public call and token-transfer information. In the scenario, spender S uses transferFrom to spend 30 units of A1’s T and send them to R. The earlier allowance to S was 100. Under our assumptions of a finite allowance that decreases with spending and no other changes, the token balance falls by 30 and the remaining allowance is 100 − 30 = 70.
This identifies a spending route consistent with an existing permission. It does not establish that only the approval is compromised. In a real investigation, inspect the call, token contract, and transfer records together rather than relying on one action label in an explorer. Finding S is not a reason to stop asking whether the seed phrase was exposed.
If subsequent evidence identifies only this permission as problematic, and the environment and fee conditions permit it, assess revoking the allowance and then verify success. That still does not recover the 30 already transferred. Approve and signature permissions explains allowances separately from unsubmitted signatures.
Step 3: A Disclosed Seed Phrase Changes Which Accounts Are Affected
Add a new fact: the user recalls entering seed phrase Alpha into an unfamiliar recovery-verification page. The response must now expand. A1 and A2 share Alpha and have no additional passphrase in this example. Revoking A1’s allowance to S is not sufficient grounds to keep using A2 for storage.
B and C have different control sources, so Alpha’s disclosure does not automatically mean their independent material was obtained too. It does not establish their safety either. If they exposed secrets or signed suspicious requests in the same infected environment, investigate those separately. Mapping accounts by source helps include accounts sharing exposed secrets without presenting unproven exposure as fact.
The distinction between wallet passwords and recovery matters here. An app-password change affects local access, not the control material derived from Alpha. Importing Alpha into another phone restores the same source; it does not create new independent control.
Step 4: Signs of a Sweeper Mean Stop Funding the Old Account
Add one more clue: A1 previously received native coins for fees, followed immediately by an unexpected outflow. A sweeper bot—software monitoring incoming funds and quickly moving assets out—now becomes a serious possibility. Verify the public transactions; close timing alone does not establish every detail of the software’s behavior.
MetaMask’s official What to do if you have a sweeper bot on your wallet explicitly warns against continuing to deposit ETH into a suspected affected account. Our example therefore stops ordinary gas top-ups and does not demonstrate a manual race against a bot. New fee funds may disappear while the tokens needing a fee remain stuck.
The teaching conclusion is now: assess A1 and A2 based on Alpha’s exposure; investigate B and C separately; stop ordinary funding because a sweeper is suspected. No recovery was performed and there is no successful transfer to a new wallet to record. Recognizing the limits of the evidence and available capabilities is more useful than assuming everything can simply be moved.
Establish Trusted Independent Control Before Protecting Remaining Assets
New control requires an independent, trusted source—not a renamed wallet, another device, or another account under the same phrase. This is a distinction in the mechanism. Whether and in what order assets can actually move still depends on the assets and attack conditions.
Use a Safe Environment and Independent Material
In a trusted secure environment, follow the product’s official process to establish independent control and check backups and receiving information. Do not reuse exposed Alpha as the new wallet’s recovery material or share new secrets with anyone investigating the incident. If a social-login or cloud account is also suspected to be compromised, address it too. A different wallet interface does not make the same affected login safe.
After creating a backup, check its coverage and recoverability. Urgency does not make an unchecked backup complete. If the environment cannot be trusted, avoid exposing further secret material. Keep a clear public-address map distinguishing affected accounts from intended receiving accounts.
Assess Asset Constraints and Transaction Order
Native coins, tokens, NFTs, locked positions, and borrowing positions have different transfer conditions. Available fees, unlocking times, liquidation risk, or multiple operations may matter. An ordinary transfer sequence may conflict with a sweeper scenario. One fixed order of moving asset types cannot cover every incident.
If professional help is needed, start through independently verified official support and understand its scope and limits. A service’s name is not a guarantee. Executed self-custody transactions have no universal support undo button. Even where an issuer or platform has specific mechanisms, that does not establish that you can freeze or recover the assets.
Share Public Evidence When Seeking Help, Not Secrets
Support needs public information sufficient to identify the incident, not your seed phrase or private key. Recovery depends on the circumstances. Preserving records supports interpretation and investigation; it does not guarantee a result.
Contact Official Support and Authorities with Public Incident Information
Collect the network, affected public addresses, transaction hashes, token contract, amounts, times, and actions before and after the event. Separate observed results, actions you took, and remaining uncertainty. If no signature record was preserved, say so rather than guessing. Public addresses are not control secrets, but share them through appropriate channels to avoid unnecessarily revealing personal associations.
Enter support through an official website you have checked yourself. For suspected fraud, provide records to local police or the appropriate law-enforcement channel. If platform deposits or a wrong network are involved, identify the receiving platform and operation type too. On-chain completion does not prove platform credit. Crypto transfer checks explains that additional layer.
Reject Guaranteed-Recovery Messages and Upfront Unlock Fees
An unsolicited rescuer asking for an unfreezing fee or recovery material is not made trustworthy by successful-recovery screenshots. Reject guaranteed-recovery claims and advance verification payments to unfamiliar addresses. Investigating public transactions does not require handing over either the old or new wallet’s secrets.
Before sharing screenshots, check for seed phrases, private keys, recovery codes, or sensitive exports. Explaining the incident should not create another usable copy of account-control material. If secrets have already been disclosed, include that fact in the exposure assessment rather than merely deleting the conversation.
Close the Actual Gaps After the Incident
Improvements should address the incident’s failures; logging in again is not proof of resolution. Our example calls for keeping recovery material out of websites, mapping accounts by source, understanding spending permissions, and stopping top-ups when a sweeper is suspected. An incident caused by copying the wrong address would need different improvements.
Keep a timeline without secrets, recording permissions addressed, accounts checked, and unresolved questions. Check the new wallet, backup, and device separately. Mark only actions actually completed and verified as complete, so an unresolved control source is not used for storage again.
This article provides security education through a hypothetical incident. No real transfer, revocation, recovery, or police report was performed. It is not individual asset-handling or legal advice. Seek trusted official and professional help based on the actual evidence; no process guarantees recovery of losses.