Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A leaked game build is not proof that your device or wallet is infected. If you only saw the leak and never downloaded or ran a file, secure your accounts normally and stay alert. If you downloaded or executed a suspicious build, stop using that device for sensitive activity, recover accounts from a clean device, and treat any wallet recovery phrase or private key exposed there as compromised.
First, identify what actually happened
Your next step depends on whether you merely encountered information about a leak, downloaded a file, executed it, or entered secrets afterward. Do not assume that every leaked build contains malware, but do not treat an executed unknown build as trustworthy without checking the device.
| What happened | Likely concern | Priority action |
|---|---|---|
| You saw a post, screenshot, or download listing but did not download anything | No evidence that your device was exposed | Do not download the file. Keep normal account hygiene and watch for phishing messages using the leak as a lure. |
| You downloaded the build but never opened or installed it | The file may still be unsafe, but execution has not been established | Do not open it. Delete or quarantine it, empty the recycle bin, and run an up-to-date security scan if the download was on a device used for sensitive accounts. |
| You opened, installed, or ran the build | Stored passwords, browser sessions, wallet data, and files may have been exposed | Stop sensitive use on that device. Use a clean device to change passwords, end sessions, and secure accounts while the original device is assessed. |
| You typed a wallet recovery phrase or private key on the suspect device | The wallet’s controlling secret may be copied | Create a new wallet with a new recovery phrase on a clean device and move assets after verifying every destination. |
| You connected a wallet to a site or signed an unfamiliar approval | A smart contract may have spending permission | Review and revoke unneeded permissions through a trusted wallet or chain tool. This does not repair a leaked private key or recovery phrase. |
| You used an exchange account | The exchange’s account, email, sessions, or API access may be at risk | Recover the account through the exchange’s verified website or app, not through an unsolicited message or phone number. |
Keep the categories separate. Device compromise concerns the machine and data stored on it. Secret exposure concerns the wallet itself. Contract authorization concerns permissions granted on-chain. One problem can occur without the others, and fixing one does not automatically fix the rest.
Recommended Free Tools
What to do in the first hour
- Stop entering sensitive information on the suspect device. Do not log in, type passwords, unlock a wallet, paste a recovery phrase, approve a transaction, or enter payment details there while you investigate. The FTC’s malware guidance specifically advises stopping logins with usernames, passwords, or other sensitive information when malware is suspected.
- Disconnect the device from networks if practical. Turn off Wi-Fi and unplug Ethernet while preserving information you may need for an incident report. Do not repeatedly launch the leaked build to “test” it.
- Choose a clean device. Use a device you did not use to run the build, with current operating-system updates and security software. A borrowed device can be suitable if you trust its owner and avoid saving your new credentials on it permanently.
- Secure the email account that controls resets. Email access often unlocks exchanges, games, social accounts, and cloud storage. Change its password first, sign out other sessions, enable two-factor authentication, and check recovery email addresses and phone numbers.
- List accounts in order of impact. Prioritize wallets and exchanges, email, password managers, banking or payment services, work accounts, and then gaming and social accounts. Change unique passwords from the clean device.
- Record what you observe. Note the build’s filename and source, when it was downloaded or run, unusual prompts, new browser extensions, login alerts, unknown transactions, and wallet addresses involved. Do not upload a recovery phrase or private key as “evidence.”
Recover accounts from a clean device
Change passwords and end existing sessions
For each important account, use the provider’s official app or type its known address yourself. Change the password to a new, unique value, then use the provider’s option to sign out all devices or revoke active sessions. If the provider shows remembered browsers, API keys, app passwords, or connected applications, remove anything you do not recognize.
#1 Best Overall
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Do not follow a recovery link, call a number, or reply to a person who contacts you because of the leak. Fraudsters commonly pose as support agents and ask for a recovery phrase, private key, one-time code, or remote-access session. Real support cannot make a self-custody wallet safe by asking for its secret.
Strengthen two-factor authentication
Turn on two-factor authentication wherever it is available, preferably with an authenticator application or hardware security key rather than SMS when the provider supports stronger methods. Generate new backup codes after changing the password and store them offline. Check that an attacker has not added their own authenticator, phone number, passkey, forwarding rule, or recovery address.
Check account activity and alerts
Review sign-in history, password-change notices, withdrawal addresses, trading activity, connected applications, and email-forwarding rules. Enable alerts for new logins, withdrawals, transfers, and security-setting changes. The FBI advises contacting account providers promptly, changing passwords, placing alerts, and monitoring suspicious logins or transactions.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →If you find unauthorized activity, contact the actual provider immediately through its verified support channel. Ask it to freeze withdrawals, disable API keys, lock the account, or investigate transactions where those controls exist. Preserve notification emails and transaction identifiers, but never send secret credentials.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Assess and clean the device that ran the build
Run a reputable security scan
After moving sensitive work to a clean device, update the affected device’s operating system and obtain reputable security software from its official source. Run a full scan and follow the software’s quarantine or removal instructions. A clean scan is useful evidence, but it is not proof that every stolen password, cookie, or wallet file has been recovered or that the machine is safe for high-value activity.
When a reset or professional help is appropriate
If suspicious behavior persists, security tools cannot remove a detection, the build required administrator access, or you cannot confidently determine what ran, stop using the machine for wallets and account recovery. The FTC recommends contacting the device maker or a trusted technician when malware remains or the user cannot clean the device. For a high-value account or business system, an independent forensic investigator can preserve evidence and determine what was accessed.
A factory reset or clean operating-system installation may be appropriate, but back up only documents you have checked. Do not restore unknown executables, cracked installers, browser profiles, wallet directories, or extensions into the rebuilt system. If the device belongs to an employer or studio, involve its security team before wiping it so evidence is not destroyed.
Decide whether the wallet itself is compromised
Recovery phrase or private key exposed
A recovery phrase is the master key to a self-custody wallet. If you typed it, saved it in a file, photographed it, copied it to the clipboard, or otherwise exposed it on the suspect device, assume that wallet is compromised. Changing the wallet application’s password, reinstalling the application, or revoking a contract approval does not replace an exposed phrase.
Rank #3
- Quality materials: these steel crypto wallets are made of 304 stainless steel with a melting point of over 2500 Fahrenheit degrees, designed and tested to be preservative, fireproof, waterproof, and impact-resistant, and can serve you for a long time
- Products quantity: you will receive a 2-in-1 set of steel bitcoin wallets with matching lock screws, and 1 piece of metal plate marking pen, which is a matching set to help you protect your codes, passwords, and further importantly, your cryptocurrency
- Functions: with these steel crypto wallets you can record information such as fieldworks passphrase in tandem with the BIP39 word list, and they are also compatible with 12 or 24-word seed in most languages, suitable to store your private cryptocurrency information or for many instances where you may need a private cold storage system
- Suitable size: the cold wallet backups are compatible with BIP39 wallets, can work with most hardware wallets, supports up to 24 mnemonics seed phrases, convenient for you to use in coordination with other crypto seed storage devices and wallets
- Multiple ways of locking: you can use the matching screws to lock up the steel bitcoin wallets; You can also lock them up and hide them in other places if you still feel unsafe; The hole on the bitcoin wallet measures 6 mm/ 0.24 inch in diameter, suitable for hanging
- On a clean device, create a new wallet that generates a completely new recovery phrase.
- Write the new phrase on paper or another offline method. Never paste it into a website, support chat, form, cloud note, screenshot, or “wallet checker.”
- Verify the new receiving address on the trusted device or wallet hardware before sending funds.
- Transfer assets from the old wallet to the new wallet, starting with a small test amount when practical.
- After confirming receipt on the correct network and address, move remaining assets and stop using the old wallet for value.
Check every network, token, non-fungible token, and staking position separately. Transaction fees, network selection, and destination addresses must be verified before signing. Blockchain transactions are generally irreversible; an incorrect address or an attacker who moves funds first may leave no technical method to undo the transfer.
The phrase was never entered, but the wallet was connected
If the wallet was only connected to a site, the private key may not have been disclosed. However, a site can request messages, token approvals, or other permissions. Review the wallet’s connected sites and the relevant chain’s approval records, then revoke permissions that are unnecessary. Use a trusted wallet or chain tool reached through a known source, and read each transaction before signing.
Revoking an approval limits a contract’s authorization; it does not protect a phrase or private key that was already exposed. Avoid signing unfamiliar messages, unlimited spend approvals, or transactions that you cannot explain. Use limited allowances for future applications when the wallet and network support them.
Use hardware storage for future protection
Hardware wallets can keep private keys offline and reduce the chance that ordinary malware can read them during routine computer use. They do not restore a compromised phrase, reverse an unauthorized transaction, or protect a phrase that was typed into a compromised computer. Set up any hardware wallet with a new phrase after the incident, verify addresses on the device’s own screen, and keep its backup offline.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Ethereum.org’s wallet-security guidance states: “Never, for any reason, share your recovery phrase or private keys!” Treat anyone requesting either secret as an attacker, even if the person claims to be from a wallet, exchange, game studio, investigator, or recovery service.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Self-custody wallet versus custodial exchange
| Account type | Who controls the key or account system | What recovery looks like |
|---|---|---|
| Self-custody wallet | You control the recovery phrase or private key. | Create a fresh wallet if the secret may be exposed and transfer assets. There is no central organization that can reset the old key. |
| Custodial exchange account | The exchange controls the wallet infrastructure while you control an account login. | Use the exchange’s verified recovery and security process, request a freeze when needed, change credentials, revoke API access, and monitor withdrawals. |
Some services combine both models, so read the provider’s documentation for the specific account. Do not assume that an exchange password change replaces a compromised self-custody phrase, or that moving coins between exchange subaccounts creates a new self-custody key.
What game studios and developers should do
If you maintain the build, repository, build server, or distribution channel, treat the event as an organizational incident rather than only a consumer malware question. CISA guidance for compromised software supply chains emphasizes reviewing affected developer systems and rotating accessible secrets.
- Preserve relevant build artifacts, access logs, CI/CD logs, cloud audit trails, repository events, and endpoint alerts before making destructive changes.
- Identify which developer machines, runners, signing systems, storage buckets, and distribution accounts handled the build.
- Revoke and rotate every password, token, signing key, API key, certificate, cloud credential, and secret accessible from a potentially compromised system.
- Invalidate active sessions and review unusual repository changes, new build steps, altered dependencies, unexpected releases, and outbound connections.
- Rebuild trusted environments from known-good sources and restrict release credentials so ordinary developer machines cannot use them unnecessarily.
- Notify affected users and partners with verified contact details and clear instructions; never ask users to send wallet phrases or private keys.
- Consider an independent forensic investigator when the source, scope, or persistence of the compromise is unclear. FTC business guidance recommends this option for breaches that need deeper analysis.
Use clean administrative systems for credential rotation where possible. If the leaked build was signed or distributed through an official channel, review signing-key exposure and distribution controls with the platform or service involved.
Monitor after you regain control
- For several weeks, check email, exchange, wallet, gaming, social, and cloud-account alerts for unfamiliar logins or security changes.
- Watch wallet addresses and exchange activity for unauthorized approvals, withdrawals, or transfers. Record transaction hashes and contact the relevant provider immediately when something is unfamiliar.
- Keep the old wallet read-only for investigation if necessary, but do not fund it or sign new transactions from it after its phrase is considered exposed.
- Remove unknown browser extensions, applications, scheduled tasks, and remote-access tools from the rebuilt device.
- Update the operating system, browser, wallet software, and security tools through their official update mechanisms.
- Use separate browser profiles or a dedicated device for high-value wallet operations, and avoid installing untrusted game builds on that system.
Common mistakes that make the damage worse
- Logging in to investigate from the suspect machine: this can expose the new password and session again.
- Testing the build repeatedly: execution gives an unknown program more opportunities to access files or sessions.
- Changing only a wallet-app password: an exposed recovery phrase remains usable elsewhere.
- Confusing approval revocation with key replacement: permissions and private keys are different security problems.
- Sending a phrase to “support”: no legitimate recovery process needs your secret phrase or private key.
- Assuming a scan proves safety: malware may have already copied data, and a scan may not identify every alteration.
- Promising that transferred crypto can be recovered: confirmed blockchain transfers are ordinarily irreversible; report fraud promptly, but do not pay an unsolicited recovery service.
When to escalate immediately
Contact the exchange, wallet provider, email provider, employer security team, or law-enforcement reporting channel promptly if you see an unauthorized transaction, an account takeover, a changed recovery method, a stolen signing key, or a build that affected other users. The FBI’s alert on fraudulent non-custodial wallet airdrops says: “Contact your account providers immediately to regain control of your accounts, change passwords, and place alerts on your accounts for suspicious login attempts and/or transactions.” Use the provider’s verified contact route and preserve the original messages, files, and timestamps.
If only a leak was observed and nothing was downloaded or executed, there is no established device compromise to remediate. Avoiding the file, securing accounts with unique passwords and two-factor authentication, and staying alert for targeted phishing is proportionate. If the build ran or wallet secrets touched the device, follow the stronger response above even if no theft is visible yet.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
