Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If your recovery phrase or private key may have been exposed, treat the wallet as compromised: stop using that phrase, create a new wallet with a newly generated phrase on a secure device, and move any remaining assets. If the concern is only a suspicious token approval, review and revoke that permission instead; revoking an approval does not protect a wallet whose phrase has leaked. If funds have already left, save the transaction details and report the incident—do not pay anyone promising to reverse it.
- Do not enter or share the phrase again, or follow unsolicited support links.
- If the device may be infected, stop using it for wallet activity and switch to a secure device.
- Secure linked sign-in and exchange accounts, especially for embedded wallets.
- Preserve addresses, transaction hashes, times, and relevant messages if anything unauthorized happened.
First identify what may be compromised
Different incidents call for different protective actions. A recovery phrase or private key gives control over the wallet and accounts derived from it; a token approval gives a contract a particular permission; and access to a device or sign-in account may expose the wallet through a separate route. Determine what happened, but do not delay moving assets if you have reason to believe the phrase or key is exposed.
| What happened or what you observed | Immediate priority | What the action does not solve |
|---|---|---|
| You typed a recovery phrase or private key into a website, sent it to someone, or stored it somewhere another person or service could access | Retire that wallet’s phrase/key, create a new wallet securely, and transfer remaining assets | Changing the wallet app password does not invalidate an exposed phrase |
| You interacted with a suspicious dApp or signed an approval, but have no evidence the phrase was exposed | Inspect the interaction and revoke the suspicious approval; disconnect the dApp if possible | Revoking an approval does not erase phrase exposure or reverse transactions already confirmed |
| You suspect malware, unknown software, or unauthorized access to the device | Stop wallet activity on that device and use a secure device for protective steps | Removing an app or changing an account password alone does not establish that a phrase previously entered on the device is safe |
| You use an embedded or account-based wallet | Secure the linked identity and sign-in account, terminate unknown sessions, and contact the provider | Securing email or social login alone may not address exposed wallet keys |
| An unknown transaction appears or assets are missing | Preserve evidence, report it, and promptly contact any exchange the transaction trail appears to reach | Reporting does not guarantee that assets can be recovered |
If your recovery phrase or private key may have leaked
Assume an exposed phrase is unsafe even if you do not yet see an unauthorized transaction. Ethereum.org describes a recovery phrase—also called a secret recovery phrase or seed phrase—as the wallet’s “master key.” Someone who obtains it can control the wallet and accounts derived from it. A wallet password generally protects access through a particular app or device; it does not replace the phrase as the underlying recovery credential. MetaMask Help Center makes this distinction in its guidance on securing the Secret Recovery Phrase and password. Its product-specific sign-in details should not be generalized to every wallet.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Move remaining assets to a genuinely new wallet
- Choose a device you have reason to trust. If malware or unknown software may be involved, do not create or access the replacement wallet on that device. Kraken Support advises disconnecting a potentially affected device; use a secure device for the protective steps.
- Generate a new wallet and phrase. Use the wallet’s official setup process to create a new wallet and a newly generated recovery phrase. Do not restore the old phrase into the new wallet: that would restore the compromised wallet rather than create a new security boundary.
- Store the new phrase privately and offline. Do not send it to support, type it into a website, or save it in a location accessible to someone who should not control the wallet. Follow the wallet provider’s instructions for protecting its recovery information.
- Transfer remaining assets from the affected wallet. Send them to the new wallet address and verify the destination carefully before confirming. The old phrase should no longer be used for wallet access or recovery.
- Check the relevant network and wallet activity. Review for unauthorized transactions and suspicious permissions. If a transaction is already pending or the wallet appears to be actively drained, prioritize moving what remains and contact the wallet provider through its official support channel.
A new app password, a device lock-screen change, or a password reset does not retire an exposed phrase. The security change is the newly generated wallet and the transfer away from the wallet controlled by the old phrase.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
If you signed a suspicious approval or connected a dApp
A token approval is not the same as handing over a recovery phrase. Depending on what was approved, a smart contract may have permission to move specified tokens from your wallet. Ethereum.org and Kraken Support advise reviewing permissions and revoking suspicious approvals. Use the wallet’s trusted interface or a reputable approval checker for the relevant network, reached through its official website. The exact interface and available controls vary by wallet and network, so verify that you are reviewing the network where the interaction occurred.
- Inspect the transaction and permission. Check which network, token, contract, and permission are involved where those details are available. If you cannot tell what you signed, treat that uncertainty seriously rather than assuming the approval was harmless.
- Revoke the suspicious permission. Follow the trusted wallet or network-specific tool’s instructions. Revocation is itself an on-chain transaction in many cases, so check the displayed details before signing and avoid unfamiliar links claiming to offer a quick fix.
- Disconnect the unfamiliar dApp where possible. This can end a connection in the wallet interface, but it is not a substitute for revoking an already granted token permission.
- Inspect wallet activity for transactions you did not authorize. If you discover unauthorized activity, cannot identify what you signed, or find that the phrase may also have been exposed, use the compromised-phrase response and move remaining assets to a new wallet.
Revoking a permission addresses that permission; it does not make an exposed phrase safe, and it cannot undo a transaction that has already been confirmed.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
If the device, linked account, or wallet provider is involved
Device malware or unknown software
Stop using a suspected device to open the wallet or enter credentials. Disconnect it from networks if practical, then use a secure device for wallet protection. If you entered the phrase on the affected device, treat the phrase as exposed and create a new wallet rather than relying on a cleanup or password change. Kraken Support’s compromised-wallet guidance specifically includes disconnecting the affected device.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Embedded or account-based wallets
Some wallets are accessed through a linked email address, Google or Apple account, passkey, or platform account, rather than only through a separately stored phrase. Secure the linked account: change its password where appropriate, enable two-factor authentication when available, review active sessions, and sign out sessions you do not recognize. Also contact the wallet or platform provider through its official channel. The provider’s custody model determines what recovery and transfer steps are available. Kraken’s guidance describes exporting embedded-wallet keys when needed to move assets; do not assume that procedure applies to another provider.
Rank #3
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Lost or stolen hardware wallet
A missing physical device alone does not establish that its recovery phrase has leaked. The risk depends on the incident details, including whether the phrase, PIN, or device access may also be compromised. Because procedures and protections vary by wallet model, do not rely on a blanket claim that a lost device is either harmless or equivalent to a known seed-phrase leak. Consult the manufacturer’s official instructions and assess whether the recovery information could have been accessed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If funds have already left the wallet
Confirmed Ethereum transactions are final: Kraken Support states, “Onchain transactions cannot be reversed,” and Ethereum.org likewise warns that confirmed Ethereum transactions cannot be reversed. This means you should act on practical leads rather than trust anyone claiming they can simply undo the transaction.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
- Record the evidence. Save the affected wallet address, transaction hash or hashes, date and time, messages, websites, and other relevant details. Keep original messages and screenshots where possible.
- Report the incident to the appropriate authority. Use the police or cybercrime reporting channel for your jurisdiction. The Singapore Police Force and Cyber Security Agency of Singapore advisory dated 29 November 2024 gives Singapore-specific guidance; its local reporting contacts should not be treated as contacts for other countries.
- Contact a centralized exchange promptly if the trail points there. Provide the transaction details and report that the funds may be connected to fraud. Ethereum.org notes that an exchange may sometimes freeze an account flagged for fraud, but this is not guaranteed and does not reverse the on-chain transaction.
- Continue securing wallets and accounts. If assets remain in a wallet whose phrase is exposed, move them to a new wallet; if the incident involves a linked account, secure that sign-in path as well.
Be wary of people who approach you after the incident claiming they can recover funds. Ethereum.org warns that recovery scammers target prior victims. Never pay an upfront fee or share your recovery phrase with someone who promises to retrieve or reverse a transaction.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How the wallet type changes the response
The central question is who or what can authorize transactions. With a self-custody wallet, the recovery phrase or private key controls access, so a known leak requires a newly generated wallet and transfer. With an embedded wallet, a provider or linked identity account may form part of the access path; secure that account and follow the provider’s custody-specific instructions. A suspicious contract approval is a separate permission to investigate and revoke. These routes can overlap: a phishing incident could involve both an approval and phrase exposure, in which case addressing only the approval is insufficient.
Ethereum.org describes hardware wallets as a way to keep private keys offline, and the Singapore government advisory recommends them as less vulnerable to online attacks. That can be a preventive choice for a future wallet, but moving an exposed phrase onto a hardware device does not rehabilitate it. Generate a new wallet with a new phrase before transferring assets to it. No particular hardware wallet model is established as best by the cited guidance.
What to avoid while responding
- Do not share the phrase with “support.” A legitimate support conversation should not require you to hand over the master recovery credential. Never enter it into a site reached through an unsolicited message.
- Do not assume a password change fixes phrase exposure. An exposed recovery phrase must be retired by moving to a wallet created with a new phrase.
- Do not sign another transaction without checking it. Unexpected prompts can grant further permissions or authorize a transfer. Confirm the network and transaction details using a trusted wallet interface.
- Do not wait for proof of theft if exposure is clear. A lack of visible unauthorized activity does not make a leaked phrase safe.
- Do not trust paid recovery promises. Confirmed Ethereum transactions cannot be reversed, and recovery scams often target people who have already lost funds.
Sources and scope
This guidance reflects Kraken Support’s “My Kraken Wallet has been compromised,” last updated 15 September 2026; Ethereum.org’s “Scam help & reporting” and “Ethereum security and scam prevention”; the Singapore Police Force and Cyber Security Agency of Singapore advisory published 29 November 2024; and MetaMask Help Center’s guidance on securing a Secret Recovery Phrase and password. Wallet interfaces, provider custody models, and jurisdiction-specific reporting procedures differ. The Singapore advisory’s reporting contacts apply in Singapore, and MetaMask’s product-specific login details do not necessarily apply to other wallets.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
