iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Close the site, stop signing prompts, determine exactly what you approved, and treat any exposed recovery phrase or private key as a total wallet compromise. A connection alone is different from signing a transaction, granting a token approval, entering your recovery phrase, or installing software. Your next action depends on which of those events occurred.
What to do in the first 10 minutes
Work from a device and wallet you believe are safe. Do not return to the suspicious page through an advertisement, message, search result, or unsolicited “support” link.
- Close the page and reject every new prompt. Do not sign a transaction, typed message, permit, token approval, or “verification” request just to disconnect or claim funds.
- Record what happened. Save transaction hashes, destination and contract addresses, screenshots of prompts, the site address, messages, and any support conversation. This information can be useful when reporting the incident.
- Classify the event. Decide whether you only connected, signed a transaction or message, approved token spending, exposed a recovery phrase or private key, or downloaded software. These cases have different remedies.
- Protect any exchange accounts linked to the wallet. Change their passwords and enable two-factor authentication. If an exchange account may also be affected, contact the exchange through its official support channel.
- Do not pay anyone who promises recovery. Blockchain transfers cannot be reversed, and a person asking for a fee or your recovery phrase is likely attempting a second scam.
Connection, signature, approval, and phrase exposure are different
A website cannot be assessed safely from the fact that a wallet pop-up appeared. The important question is what the wallet actually allowed. MetaMask identifies phishing sites and malicious decentralized-application approvals as possible compromise vectors, while Ethereum.org distinguishes a connection from the permissions that follow it.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute| What happened | What it normally means | Priority action |
|---|---|---|
| Connection only | The site was added to the wallet’s connected-app list. No asset movement is established by the connection itself. | Close the site, avoid further prompts, review activity, and remove the connection using your wallet’s normal connected-sites controls if available. |
| Signed a transaction | You authorized an on-chain action. It could have transferred assets, changed a contract state, or granted another permission. | Inspect the transaction hash and contract, check balances and approvals, and move remaining assets if the wallet or credentials may be compromised. |
| Signed a token approval or permit | A contract may be allowed to spend a specified token, sometimes up to an unlimited amount, according to the approval’s terms. | Check active approvals on the correct chain and revoke suspicious ones. Revocation does not undo a transfer already completed. |
| Entered or shared a recovery phrase or private key | The person or site holding it can recreate and control the wallet without asking you again. | Assume the wallet is compromised and transfer remaining assets to a newly created wallet from a safe device. |
| Downloaded or installed software | Malware could capture credentials, alter destinations, or interfere with wallet use. The risk depends on what was installed and what the device contained. | Stop using that device for wallet operations, preserve evidence, and perform remediation from a device you believe is clean before moving funds. |
Do not assume a connection was harmless, but do not assume it was a theft either. Verify the wallet request, the resulting transaction, and the chain activity before choosing the response.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
If your recovery phrase or private key was exposed
Ethereum.org calls the recovery phrase “the master key to your wallet.” Anyone who obtains it can generally restore the wallet elsewhere. Treat a phrase typed into a website, pasted into a form, photographed for a stranger, or sent in chat as exposed even if no unauthorized transfer is visible yet.
Create the replacement wallet safely
- Use an official wallet application or device setup process obtained from the wallet maker’s genuine distribution channel. Do not follow the suspicious site’s download link.
- Create a completely new wallet on a device you believe is safe. Never generate the replacement phrase on the compromised device if you suspect it contains malware.
- Write the new phrase down offline and keep it private. Never enter it into a website, cloud note, form, or support chat.
- Verify the new receiving address on the wallet or hardware device before sending funds.
- Move remaining assets from the exposed wallet to the new address. Prioritize assets that can be transferred before an attacker spends them, while allowing for the network’s required transaction fee.
- Stop using the exposed wallet for new deposits. A phrase cannot be made safe again by changing a password or disconnecting a site.
When a hardware wallet helps
A hardware wallet can keep the private keys of a newly established wallet offline and require physical confirmation for transactions. It is an optional security measure for the replacement wallet, not a repair for an exposed phrase. Buying a hardware wallet does not invalidate or protect the old phrase; funds must first be moved to a wallet created with a different secret.
If you signed a token approval
A token approval is a permission granted to a smart contract to spend a token from your wallet. A malicious approval can let the contract continue taking tokens later, subject to the allowance and contract behavior, even after you leave the site. Look for approval, allowance, permit, or spending-permission language in the wallet prompt and inspect the transaction on the relevant chain.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Check active approvals
Ethereum.org names three examples of approval-checking services: Revoke.cash, Revokescout, and Etherscan Token Approval Checker. They are alternatives for viewing permissions; none can recover assets that have already been transferred.
| Checker | Use it for | What you must verify |
|---|---|---|
| Revoke.cash | Reviewing and revoking token allowances on supported networks. | That you reached the genuine service, selected the correct network, connected the intended wallet, and recognized each contract before signing. |
| Revokescout | Inspecting token permissions and submitting revocations where supported. | Network, token, spender address, allowance amount, and the exact transaction presented by your wallet. |
| Etherscan Token Approval Checker | Checking approvals associated with an address on an Ethereum-compatible network covered by the service. | That the network and address match the wallet you used and that the revocation transaction is going to the expected contract. |
Revoke a suspicious permission
- Open the checker by typing a known official address or using a bookmark you created previously. Do not use a link sent by the suspicious site or an unsolicited helper.
- Select the exact blockchain network on which the approval exists. An approval on one network does not automatically appear on another.
- Connect only the affected wallet and review the listed token, spender contract, allowance, and last activity.
- Identify permissions you do not recognize or no longer need. Check the destination and transaction details in the wallet window, not only in the web page.
- Sign the revocation transaction and wait for it to confirm. The network fee is a normal cost of changing on-chain state.
- Refresh the checker and verify that the allowance is zero or otherwise reduced as intended.
Revoking prevents future use of that allowance; it does not reverse a transfer that already occurred. If the wallet’s phrase or private key was exposed, revoke approvals only as an interim measure while you move funds to a new wallet.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
If you signed a transaction or an unauthorized transfer occurred
Find the transaction hash in the wallet’s activity and inspect the chain record. Note the time, assets, amounts, destination addresses, contract address, and whether the transaction was confirmed. Also check token balances and approval pages for activity that happened after the suspicious connection.
Ethereum.org’s published guidance is explicit: “No one can reverse blockchain transactions.” A confirmed transfer normally cannot be canceled by your wallet, the receiving exchange, or a revocation service. You can still document and report it, and an exchange may be able to freeze funds if they reach an account it controls, but there is no guaranteed recovery path.
Free tools Windows power users keep installed
One-click scans. No signup required.
Preserve evidence and report it
- Keep the transaction hashes and full wallet and contract addresses; do not shorten them in your notes.
- Capture screenshots of the deceptive page, wallet prompts, messages, advertisements, and any fake support interaction.
- Record which device, browser, wallet account, and network were involved.
- Report the scam to the relevant wallet, exchange, platform, or law-enforcement channel using its official website, not contact information supplied by the scammer.
Recognize recovery scams
After a theft, impersonators often claim they can trace or recover the funds. Ethereum.org warns that anyone offering recovery for a fee is almost certainly a second scam. Never send an advance payment, install remote-access software for a stranger, or disclose a phrase, private key, password, or one-time authentication code.
Secure linked accounts and the device
Exchange and email accounts
Change passwords for exchanges, email accounts, and other services that can reset wallet-related accounts. Use a unique password for each service and enable two-factor authentication. If you reused a password on the suspicious site, change it anywhere else it was used. Contact an exchange through its official support channel if you see unauthorized withdrawals, changed security settings, or unfamiliar API keys.
Browser extensions and software
If you installed a browser extension, desktop application, or mobile package from the suspicious site, stop signing transactions on that device. Remove software you do not recognize, update the operating system and browser, and use a trusted security scan or professional incident-response service. Until the device is trusted again, create and operate the replacement wallet from a different clean device.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Wallet connections
Use the wallet’s own connected-site management screen to remove the suspicious connection when that option exists. This stops the site from seeing the account through that connection, but it does not revoke token allowances and does not erase a transaction already signed. Handle those separately.
Recommended Free Tools
How wallet warnings should influence your decision
MetaMask describes security alerts and transaction simulations as tools that surface risk signals before you approve an action. They can reveal suspicious destinations, unexpected balance changes, or contract behavior, but they do not guarantee detection and do not prevent you from proceeding. Treat a warning as a reason to stop and investigate, not as proof that a transaction is safe when no warning appears.
- Read the complete wallet prompt, including the network, contract, token, amount, spender, and requested permissions.
- Reject requests that do not match the action you intended to take.
- Be especially cautious of unlimited allowances, “free” claims that require an approval, and messages that demand your recovery phrase.
- Verify the destination address on a trusted channel before sending a high-value transfer.
Choose the response that matches your situation
| Your evidence | Immediate response | Follow-up |
|---|---|---|
| Connected, then rejected every prompt | Close the site and remove the connection. | Review activity and approvals; monitor the wallet for unfamiliar transactions. |
| Connected and signed an ordinary transaction | Inspect the transaction and current balances. | Revoke any unexpected approvals and move funds if credentials or device security are in doubt. |
| Signed an approval or permit | Check the allowance on the correct chain. | Revoke suspicious permissions and investigate any transfers that occurred before revocation. |
| Entered a phrase or private key | Create a new wallet on a safe device and transfer remaining assets. | Retire the exposed wallet permanently; change linked account passwords and enable two-factor authentication. |
| Installed suspicious software | Stop wallet use on that device. | Remediate or replace the device, then move funds from a clean environment. |
| Confirmed theft is visible | Preserve hashes and screenshots. | Report through official channels and ignore paid-recovery offers. |
Prevent the next incident
Separate routine use from high-value storage
Keep only the amount needed for a dapp or short-term activity in a wallet used for frequent connections. Store long-term assets in a separately established wallet, and consider offline key storage for that wallet. Separation limits the damage from one approval or one deceptive site.
Review permissions regularly
Token approvals can remain active after you stop using a dapp. Periodically inspect approvals on every network where the wallet holds tokens and revoke permissions that are no longer necessary. Record the network and spender address when you grant an approval so an unfamiliar entry is easier to spot later.
Use deliberate verification habits
- Reach dapps through a bookmark or a project’s verified communication channel rather than an advertisement or unsolicited message.
- Check the spelling of the domain and confirm that the wallet shows the expected chain and contract.
- Never type a recovery phrase into a website or give it to support. Genuine support does not need it.
- Pause when a prompt uses urgency, promises guaranteed profit, or asks you to disable security controls.
- For a new wallet, write the phrase offline and keep backup copies in secure physical locations.
Common mistakes after a suspicious connection
Assuming disconnection fixed everything
Removing a site connection does not cancel an approval, undo a signed transaction, or protect an exposed phrase. Check each of those separately.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Revoking from the same unsafe page
A malicious page can present another dangerous prompt while pretending to revoke access. Use a known official checker, inspect the wallet transaction, and reject anything unrelated to the intended revocation.
Moving funds to another account in the same compromised wallet
If the phrase or private key is exposed, every account derived from that secret is at risk. Create a genuinely new wallet with a different recovery phrase; changing the account index does not create a new secret.
Waiting for proof of theft
An attacker with a phrase, key, or active allowance may act later. Preserve evidence, secure the replacement wallet, and move remaining assets promptly when you can do so safely.
What “secure” means after the incident
A wallet is back in service only when you know which permissions exist, the device and accounts used to operate it are trusted, and no secret controlling the funds was exposed. A connection that produced no signature may require cleanup and monitoring. A phrase exposure requires retirement of the wallet. A signed approval requires an on-chain allowance review. A confirmed theft requires evidence preservation and reporting, because the transfer itself cannot be reversed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
