Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Assume a compromise when you see an outgoing transaction, login, account change, token approval or secret-key exposure you cannot explain. Preserve the evidence, stop using suspicious links and decentralized apps, and continue from a clean device. If a recovery phrase or private key may have been exposed, create a genuinely new wallet and move the remaining assets immediately; changing an app password does not replace compromised signing keys.
What counts as a compromise?
A crypto incident is not limited to a complete drain. It can be an exchange account takeover, a stolen recovery phrase, malware on the phone or computer, a malicious token allowance, or a phishing attempt that has not yet succeeded. The response depends on which control was lost.
- Self-custody wallet: Whoever controls the recovery phrase or private key controls the signing authority. There is no central operator who can reset that authority or reverse a confirmed blockchain transfer.
- Custodial exchange account: The provider holds the keys. An attacker may control your login, withdrawal settings or API credentials, while the provider may still be able to reset access, add alerts or freeze activity.
- Approval incident: You signed a transaction giving a contract permission to spend specified tokens. The permission can be abused even when the recovery phrase has not been stolen.
- Device incident: Malware or an intruder can read passwords, clipboard contents, browser sessions and unencrypted files, then use those secrets to reach a wallet or exchange.
Confirmed on-chain transfers are generally irreversible. Fast containment can still protect assets that remain and may give an exchange, payment provider or law-enforcement agency a chance to freeze related activity.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The strongest warning signs
An outgoing transaction you did not authorize
Open your address in a reputable public blockchain explorer and inspect the complete history. Look at native-coin transfers, every token movement, NFT transfers and contract interactions. Match each item with your own actions, including test transactions and automated services. An unexplained outgoing transfer is an urgent possible compromise even if the amount is small.
#1 Best Overall
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Check the entire destination address character by character. The FBI warns that address-poisoning attacks create a look-alike address with matching beginning and ending characters, hoping you copy it from a shortened transaction display. A familiar first and last few characters do not prove that the recipient is yours.
Unexpected contract interactions or token approvals
A token approval is a permission, not a transfer. When you sign an approval, a smart contract can be allowed to spend a token balance up to the approved amount. Trezor explains that a malicious contract owner may then gain access to the approved funds. Review the wallet’s established permission or allowance screen, identify approvals you do not recognize, and revoke them through the wallet or chain’s official tool.
Revoking an allowance prevents future spending under that permission; it does not undo tokens already taken, make an exposed recovery phrase safe, or prove that the device is clean. Treat an unexplained approval as an incident requiring a wider review.
Exchange logins, settings or withdrawals you did not make
In the exchange’s official app or site, review:
- Login history, device sessions and security notifications
- Password, recovery-email or telephone-number changes
- New withdrawal addresses, address-book entries and withdrawal limits
- API keys, their permissions and recent API activity
- Two-factor-authentication enrollment, removal or method changes
- Orders, conversions, deposits and withdrawals you cannot explain
The FBI identifies suspicious login attempts, unauthorized account changes, unrecognized transactions and compromised credentials as activity to monitor. A notification can be delayed, so compare the provider’s records with your own timestamps and device history.
Exposure of a recovery phrase or private key
MetaMask describes the Secret Recovery Phrase (SRP) as “the master key to your wallet (whoever controls the SRP controls the wallet).” Treat it as compromised if it was typed into a website, pasted into a chat, sent to supposed support, photographed, stored in cloud notes, saved in an unencrypted file, shown on a screen, or seen by another person. The same rule applies to an individual private key.
A wallet-app password or browser PIN protects local access to that installation; it does not change the blockchain keys derived from an exposed phrase. Assume an attacker can sign transactions and move the assets that remain at that address.
Signs that the device itself may be unsafe
Unexpected browser extensions, disabled security software, new administrator accounts, unexplained remote-access tools, pop-ups requesting seed phrases, clipboard addresses that change after copying, or files encrypted without your action all justify isolation. CISA warns that an attacker with device access may read, manipulate, steal or deny access to data that is not encrypted.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #2
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
How to check a self-custody wallet safely
Do not investigate by repeatedly connecting the wallet to the suspicious website. Use a read-only explorer where possible and perform recovery from a clean device.
- Write down the wallet address. Copy it from a trusted wallet view, not from a message or a transaction receipt. If you use several chains, record the address and network for each one.
- Open a reputable public explorer independently. Type or bookmark the explorer address yourself. Do not follow a link supplied by a caller, pop-up or social-media account.
- Inspect all activity. Review native-coin transfers, token transfers, NFT movements, contract calls, bridges and staking transactions. Expand each item to see the full recipient address, amount, network and timestamp.
- Compare the complete destination address. Do not rely on a truncated address, a contact label or a matching prefix and suffix. Check against the address you intended to use.
- Check allowances and permissions. Use the wallet’s established approval-management screen or the chain’s recognized permission tool. Note the token, spender contract, allowance limit and approval time.
- Record evidence before changing anything. Save transaction hashes, addresses, amounts, timestamps, screenshots and suspicious contract names. Do not sign a new transaction merely to “test” whether the wallet is safe.
If the phrase or private key might have been exposed, skip attempts to repair the old wallet. On a clean device, install the wallet software from its verified publisher, generate a new wallet and write its new phrase offline. Transfer remaining assets to the new address, checking every destination character before signing. Leave enough native currency to pay network fees, but do not keep funds in the old address while you investigate.
How to check a custodial exchange account
- Reach the exchange without using an incoming link. Open the app already installed on your device or type the provider’s known address. The FBI advises that a caller or message claiming an account emergency should not be trusted, even when it appears official.
- Review active sessions and login history. Look for unfamiliar locations, devices, browsers, impossible travel times and failed-login bursts. Sign out sessions you do not recognize.
- Inspect security and recovery settings. Confirm that the password, recovery email, phone number, two-factor method, withdrawal whitelist and notification destinations are yours.
- Audit withdrawal and API controls. Remove unknown withdrawal addresses and rotate or delete exposed API keys. Restrict replacement keys to the minimum permissions; trading access should not include withdrawals.
- Contact verified support. Use the in-app help center or support address published by the provider, never a number sent by an unsolicited contact. Ask whether withdrawals, account access or transfers can be frozen while the investigation proceeds.
- Change credentials from a clean device. Use a unique password, enroll a strong available second factor and enable every relevant login, withdrawal and address-change alert.
Do not send a password, one-time code, recovery phrase or remote-access session to “support.” An authentic provider will not need your wallet’s secret phrase to investigate an account.
What to do in the first hour
1. Stop the suspected channel
Disconnect suspicious decentralized applications, close malicious browser tabs and stop replying to unsolicited “security” messages. Do not approve another transaction to cancel an earlier one unless you have independently verified the contract and understand the result. Never enter a recovery phrase or one-time password into a link supplied by a caller or message.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute2. Preserve a complete evidence record
Create a timeline containing the wallet or exchange account, recipient and contract addresses, asset and amount, date and time with time zone, transaction hash, login notification, device used, screenshots and suspicious URLs or messages. The FBI says these transaction details are the most important information for an Internet Crime Complaint Center report. Preserve original messages and export account statements when available.
3. Move funds when signing keys may be exposed
From a clean device, generate a new wallet with a newly generated phrase and transfer the remaining assets. Singapore Police Force guidance says to transfer all remaining cryptocurrency immediately when a seed phrase is compromised. Do not import the old phrase into the new wallet and do not reuse any phrase that has appeared online.
4. Revoke suspicious approvals
Use the wallet or network’s established permission-review interface. Revoke unknown or unnecessarily broad allowances, then inspect whether any tokens were already transferred. A revocation is containment for that allowance, not a cure for a stolen phrase or infected device.
Rank #3
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
5. Secure the exchange account
Change the password, terminate unknown sessions, rotate exposed API credentials, restore your own recovery details and enable alerts. Ask the provider whether it can freeze withdrawals or flag recipient addresses. Keep a written case number and the exact time you contacted support.
6. Report quickly and ignore recovery offers
In the United States, file an Internet Crime Complaint Center report with the full transaction record; elsewhere, use the relevant national cybercrime authority and the provider’s formal fraud channel. The FBI warns that people offering to recover stolen cryptocurrency may be running a second scam. Never pay an agent who promises guaranteed recovery or asks for your phrase, private key or remote access.
Self-custody versus an exchange account
| Question | Self-custody wallet | Custodial exchange account |
|---|---|---|
| Who controls the keys? | You control the recovery phrase or private key. | The provider controls the blockchain keys; you control account credentials and security settings. |
| Evidence to inspect | Explorer history, token and NFT movements, contract calls, approvals and device records. | Login history, sessions, security alerts, withdrawals, recovery changes, API keys and account statements. |
| First containment action | Stop dApps, revoke allowances and move remaining assets to a new wallet if keys may be exposed. | Terminate sessions, change credentials, rotate API keys and request a withdrawal freeze. |
| Can a provider freeze activity? | No central wallet operator can freeze your address. | The exchange may be able to freeze withdrawals, reset access or flag an address. |
| Can a confirmed transfer be reversed? | Normally no. | The provider may be able to stop an unsettled withdrawal; a confirmed blockchain transfer is still generally irreversible. |
| Where to report | Wallet or chain support for technical evidence, plus the applicable cybercrime authority. | Verified exchange support, the applicable cybercrime authority and, in the United States, the FBI’s Internet Crime Complaint Center. |
Understanding common incident patterns
Phishing that asks for a phrase or one-time code
A message may claim that your account is locked, a transfer is pending or a compliance check is required. The goal is to make you surrender the secret that grants control. Close the message, navigate independently to the official service and check status there. If you entered a phrase, treat the wallet as lost-control immediately and move assets from a clean device.
Address poisoning
An attacker sends a tiny transaction from an address designed to resemble one you use. Later, you copy the wrong address from transaction history. Review the entire address, use a trusted address book and send a small test only when you have independently confirmed the destination.
Malicious dApp approval
A site can appear to offer a mint, claim or airdrop while requesting an unlimited allowance. The signature may not transfer funds at that moment, but it can authorize a later drain. Reject unfamiliar requests, prefer limited allowances where the wallet offers that choice, and review existing permissions periodically.
Recommended Free Tools
Clipboard or browser malware
Malware can replace a copied address, capture passwords or read unencrypted files. If an address changes between copy and paste, stop. Disconnect the device from networks, preserve evidence if appropriate, and perform wallet recovery only from a clean, updated device.
Exchange credential takeover
An attacker who obtains your password and second factor may add a withdrawal address or API key before withdrawing. Session termination, password replacement, second-factor recovery and a provider freeze are the relevant controls; a self-custody wallet transfer will not fix an exchange account takeover.
Rank #4
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
What hardware wallets change—and what they do not
Hardware wallets place key storage outside the computer and require a physical interaction to approve a transaction. MetaMask describes this as a device-based barrier, and Ledger says transactions are reviewed and physically approved on the device. Verify the destination and amount on the hardware screen, not only in the browser.
A hardware device cannot rescue a recovery phrase that has already been exposed. Nor can it make a user safe from approving a malicious contract, confirming a poisoned address or entering the phrase into a phishing site. Keep a newly generated phrase offline in a secure physical location; never store it online or share it with supposed support.
Preventing a repeat incident
- Keep the operating system, browser, wallet software and security tools updated.
- Use a dedicated browser profile or device for high-value wallet activity, with only necessary extensions.
- Store the recovery phrase offline on a durable physical medium in a secure location; do not photograph it or put it in cloud storage.
- Use a password manager for unique exchange passwords, and enable the strongest available second factor.
- Turn on login, withdrawal, address-change and API alerts; read them before approving a transaction.
- Review token approvals periodically and remove allowances that are no longer needed.
- Encrypt important device data and maintain secure backups. CISA recommends encryption because unencrypted data can be read, changed, stolen or made inaccessible after device compromise.
- Verify every network, contract and destination address independently. Ignore urgency, guaranteed returns and unsolicited technical support.
Reported losses from cryptocurrency-ATM scams exceeded $388 million in 2025, according to the FBI Internet Crime Complaint Center figure cited on a 2026 CFTC consumer-advisory page; that page describes a 58% increase from the prior year. The figure concerns reported crypto-ATM scams, not the prevalence of compromised wallets, so it should not be used as a wallet-hacking rate.
When the evidence is inconclusive
A failed transaction, delayed balance, wrong network view or stale wallet display is not automatically a hack. Check the transaction status directly in the explorer, confirm that you are viewing the correct chain and compare the wallet’s displayed address with the address you control. Do not dismiss an unexplained approval or login merely because no funds have moved yet.
If the device, phrase and account all appear intact but a transaction remains unexplained, preserve the record and contact the relevant provider through a verified channel. Avoid “blockchain investigators” who request upfront cryptocurrency, remote access or your secrets. Technical support can explain a transaction; it cannot legitimately ask for the key that authorizes one.
Official warnings worth remembering
- The FBI advises monitoring cryptocurrency accounts for “suspicious login attempts, unauthorized changes to the account, unrecognized transactions, or compromised credentials.”
- Its exchange-scam advisory says: “If you receive a call or message indicating any kind of account problem or compromise, do not respond, even if it appears official and indicates you must act immediately.”
- MetaMask’s security guidance states: “It is the master key to your wallet (whoever controls the SRP controls the wallet).”
- CISA warns: “Threat actors who gain access to your device will be able to read, and potentially even manipulate, steal, or deny you access to any data on your device that is not encrypted.”
These warnings describe control and response principles; exchange procedures, wallet interfaces, explorers and permission tools can change, so use the current documentation of the specific product or network when carrying out the steps above.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
