To find out whether your DeFi funds are exposed, match your wallet’s activity, assets and approvals against the affected contract addresses, chains and time window in the protocol’s current incident notice. An exploit alert alone does not show that every user—or every wallet that used the protocol—is affected. The checks below help you identify what to verify and what to do next; without a specific incident notice and wallet history, no one can determine your wallet’s exposure from the alert alone.
Why an exploit may put different assets at risk
The vulnerable component and exploit mechanism determine what to check. A flaw may let an attacker take assets held in a protocol contract, or it may let a compromised router use an approval that a user previously granted. Other incidents may involve a combination of risks. Start with the protocol’s disclosure rather than assuming the alert applies to every feature or user.
| Possible exposure | What to check |
|---|---|
| Assets held in a vulnerable protocol component | Deposits, liquidity positions, receipt tokens or other assets associated with the affected pool or contract, on each affected chain. |
| Wallet assets exposed through an approval | Whether the wallet has an active token or NFT permission for the specific spender contract named in the incident notice. |
| Wallet or signature compromise | Whether the seed phrase or private key may have been disclosed, or whether suspicious signatures or transactions occurred. An approval checker alone cannot rule this out. |
1. Find the official incident notice
Open the protocol using a bookmark or a domain or account you have independently verified. Find its incident notice, post-mortem, affected-contract list or user-specific warning. Do not use a link from an unsolicited direct message or a reply to an incident post: OWASP’s Smart Contract Security incident-response guidance warns that attackers may impersonate response teams and use the situation to phish users.
Record the details that define scope before taking action:
#1 Best Overall
- Secure Element Protection: EAL6+ certified secure element with passphrase protection provides robust physical security for your digital assets
- User-Friendly Interface: Two-button pad device interface designed for straightforward and intuitive operation
- Bright OLED Display: Clear and bright OLED screen enables easy and secure hands-on verification of transactions
- On-Device Security Features: PIN and passphrase protection enabled directly on the device for enhanced security
- Open-Source Transparency: Fully open-source design allows for transparent security verification and community auditing
- The affected contract addresses and networks.
- The vulnerable feature or component, and the exploit’s relevant time window.
- Whether the disclosure describes assets held in a contract, approvals that may be abused, or another risk.
- Whether the project says the contracts can be paused or upgraded, whether the issue remains exploitable, and its exact instructions for users.
Incident instructions can be narrower than a general warning. For example, Ekubo’s report on its affected HuffRouter deployments said those deployments were immutable and still vulnerable, and advised users to revoke infinite approvals to the specified deployments. The report said non-infinite approvals had been whitehatted out. That was guidance for those deployments, not a rule for other incidents.
2. Match your wallet’s activity to the affected contracts
- Identify the wallet and chains to check. Include every wallet you used with the protocol and every network on which you interacted with it. A protocol name can cover multiple deployments.
- Open the relevant chain explorer or the protocol’s official interface. Review the wallet’s transaction history and compare recipient or spender addresses with the addresses in the incident notice.
- Compare transaction times with the disclosed window. Check whether the interaction occurred during a period and on a chain relevant to the incident. Do not treat a similar contract name as proof that an address is affected; compare the full address.
- Inspect transactions you do not recognize. Save their transaction hashes and review the addresses involved. If the relationship to the vulnerable contract is unclear, ask through a verified protocol support channel rather than signing a transaction suggested by a stranger.
The address and interaction history matter. In its historical deposit-contract post-mortem, dYdX said wallets that had not interacted with the vulnerable contract were not affected. It reported 730 addresses with allowances and 180 addresses with funds directly at risk when the exploit was discovered. Those are figures from that specific incident, not an estimate of how many users are affected by other exploits.
Rank #2
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
3. Check positions, wallet balances and approvals
Review protocol positions
Check for assets deposited in the affected contract or pool, liquidity-provider positions, receipt tokens and any other holdings specifically named by the project. Use the relevant chain and official interface where possible. A wallet balance page may not show the full value or status of a position held through a protocol contract.
Review wallet-held tokens and NFTs
If the incident involves permissions, check whether the affected spender has an active approval for a token or NFT on the relevant network. Check each affected chain; an approval on one network does not establish whether you have one on another.
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Ethereum.org’s scam guidance lists Revoke.cash, Revokescout and Etherscan’s Token Approval Checker as options for inspecting and revoking approvals. Use a route reached through a source you trust, and compare the spender address with the exact address in the official incident notice. An approval list answers a permissions question; it does not prove that a pool position is safe, that no funds have been stolen, or that a private key or signature is uncompromised.
4. Take the action that matches the risk
If the notice identifies an exploitable approval
Follow the protocol’s specific instructions promptly. Before signing a revocation transaction, check that its network, token and spender match the permission you intend to remove. After signing, verify the transaction on the chain explorer, then check that the allowance or approval is no longer active. Revoking a permission does not reverse a transfer that has already completed.
Rank #4
- All your digital assets in one place. You can manage thousands of crypto including Bitcoin, Ethereum, Solana, Tether and more.
- Defend your identity against hackers: secure your online accounts with passwordless, hardware backed, 2FA logins for all your favorite apps and websites.
- Connectivity: USB-C cable connection only. No Bluetooth.Compatible with the Ledger Wallet crypto app, both desktop (Windows, macOS, Linux) and mobile (Android only). Not compatible with iOS.
- Protect your digital assets with the industry's best security: keep your private keys offline in your private signer, battle-tested by the Donjon's white hat hackers, CC EAL 6+ certified Secure Element, constantly updated Ledger OS.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
If the seed phrase or private key may be exposed
Treat possible key compromise separately from approvals. Use a new, secure wallet that the suspected attacker cannot access, and follow trusted guidance for moving remaining assets. Do not enter the old recovery phrase into a site claiming to scan, secure or recover funds. Ethereum.org’s security guidance says never to share a recovery phrase or private key. A hardware wallet may help protect a new key by keeping it offline, but it cannot repair an already exposed key.
If you suspect a signature or delayed drain
Do not assume that revoking token allowances cancels every signature-based risk. OWASP’s incident-response guidance warns that delayed secondary drains can occur if a drainer kit has already obtained additional signatures. Follow the incident notice and trusted security guidance for the specific signature or contract involved; do not sign a purported fix from an unsolicited message.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBest Value
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
5. Preserve evidence and avoid recovery scams
Save transaction hashes, wallet and contract addresses, timestamps, screenshots and relevant communications. If explorer tracing suggests stolen funds reached a centralized exchange, ethereum.org recommends contacting the exchange’s support team promptly with the transaction details.
Ethereum.org’s “Scam help & reporting” guidance says confirmed Ethereum transactions are final and no central authority can reverse them. Reporting an incident may help an investigation or warn others, but it does not guarantee that funds will be recovered. Do not pay an unsolicited recovery agent or disclose your recovery phrase.
How to assess approval tools and incident instructions
Use an approval tool to inspect a permission, not to decide by itself whether an incident affects you. Check the tool and transaction against the project’s current disclosure:
- Network coverage: Does the tool support the chain and token or NFT permission involved?
- Address match: Can you compare the spender shown by the tool with the affected address named by the project?
- Read and write steps: Can you inspect the permission before signing, and verify the revocation transaction afterward?
- Incident-specific instructions: Does the project say which deployment is affected and whether to revoke, withdraw, migrate or take another action?
- Transaction safety: Did you reach the tool through a trusted route, and does the wallet prompt show the intended chain, token and spender?
Revoke.cash’s approval-hack tracker can provide examples of incidents and chain-specific directions, but a third-party incident list may be incomplete. Use the protocol’s verified, current notice for the scope and response to a particular exploit. The exact affected wallet, contract and action remain incident-specific; the disclosure and your on-chain history are what let you assess them.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
