iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Stop signing, close the suspicious site, and assume the wallet is unsafe until you know why it was exposed. From a different clean device or browser profile, create a wallet with a completely new recovery phrase, then move any funds that can be moved safely. If a sweeper script may be watching the old address, do not send it more ETH or tokens for gas: the attacker may take those too. A self-custody wallet provider cannot reverse a confirmed transaction or restore missing funds, so the order of your actions matters.
The first 60 seconds
Work through these steps before investigating, replying to messages, or trying to “test” the wallet. If you are viewing a malicious page, close the tab and do not reconnect to it.
- Stop interaction. Do not connect the wallet, sign a transaction or message, approve a token, or enter a recovery phrase on the suspicious site. A wallet security warning is a reason to stop, not a guarantee that the wallet is safe; warnings can be overridden.
- Identify what actually happened. Open a reputable block explorer directly, rather than through a link in a message, and inspect the transaction time, recipient, contract or dapp, asset, and amount. This separates an unfamiliar display or pending request from a transaction you truly did not authorize.
- Isolate a replacement wallet. On another browser, a fresh browser profile, or a different mobile device, create a new wallet and write its new recovery phrase offline. Do not reuse a Google or Apple account that could also be compromised.
- Move remaining assets only when it is safe. Check first for signs that an automated sweeper is immediately taking deposits. If the old wallet is being swept, adding ETH or another gas token can simply fund the attacker. If no sweeper is evident, transfer assets to the replacement wallet, prioritizing anything exposed by a known approval or signature.
- Retire the old wallet. Once assets are removed, stop using every account derived from the old recovery phrase. A changed password does not repair a leaked phrase or private key.
- Remove ongoing permissions. Disconnect suspicious dapps, then separately revoke token allowances and operator permissions. A disconnection changes the dapp connection; it does not necessarily cancel an allowance that can spend tokens later. Revoking an on-chain permission costs a network fee.
- Secure devices and accounts. Treat malware as a possible cause. Preserve browser history, scan the computer, change passwords for related accounts, and use a trusted malware-removal provider if you cannot establish that the device is clean.
- Preserve evidence and report. Save transaction hashes, addresses, timestamps, domains, screenshots, and messages. Contact an exchange or wallet provider only through its official channel. In the United States, the Federal Trade Commission directs victims to ReportFraud.ftc.gov; use the appropriate authority in your country as well.
No legitimate support agent needs your seed phrase, password, two-factor code, remote access, a software installation, or a transfer to a “new” address. Anyone asking for one of those is attempting another theft.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Choose the response by cause and control
The safest sequence depends on what was exposed, whether funds remain, whether the device can be trusted, and which permission was granted. Use the closest match below instead of applying one generic fix.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
| Likely cause | What it can allow | Priority action | Important limitation |
|---|---|---|---|
| Recovery phrase or private key leaked | Control of every account derived from that secret | Create a new wallet on a clean environment, move funds if no sweeper is active, and abandon all old accounts | Changing an email, app, or wallet password does not invalidate the leaked secret |
| Malicious token approval or operator permission | A contract or operator may transfer specified tokens later, sometimes up to an unlimited allowance | Move exposed tokens to a new account and revoke the allowance or operator permission from the old account | Revocation requires a network transaction and fee; disconnecting a dapp alone is insufficient |
| Phishing or off-chain signature, including Permit2-style permission | Delayed token transfers without another obvious wallet pop-up | Move at-risk tokens to a different account and cancel or revoke the associated permission where the network supports it | A signature can remain dangerous even when no token moved immediately |
| Malware or hostile browser extension | Phrase capture, altered destination addresses, or automatic signing and sweeping | Stop using the device, create the replacement wallet elsewhere, then clean and secure the device | A scan does not make the old wallet trustworthy; treat its secret as exposed |
| Exchange-account takeover | Withdrawals, password changes, or loss of account access | Use the exchange’s official recovery and fraud process, secure email and two-factor authentication, and preserve logs | This is different from a self-custody compromise; the exchange may be able to freeze activity, but no outcome is guaranteed |
How to create a replacement wallet safely
The replacement wallet must have a new recovery phrase generated in a trustworthy environment. Reinstalling the same extension on a potentially infected computer is not isolation.
- Select a clean environment. Use a device you control that has current operating-system updates and no suspicious extensions, or a newly created browser profile on a known-clean device. If the original device may contain malware, do not enter either the old or new phrase there.
- Install the wallet from its official source. Navigate to the provider’s published website yourself. Ignore search-ad, social-media, and unsolicited support links that could lead to a look-alike extension.
- Create a new wallet, not an import. Choose the option to create a wallet and generate a fresh recovery phrase. Importing the old phrase reproduces the compromise.
- Record the phrase offline. Write it down in the order shown and store it where only you can access it. Do not photograph it, paste it into cloud notes, email it, or type it into a website. Anyone with the phrase can control the wallet.
- Verify before funding. Confirm the new public address on the clean device. If using a hardware wallet, compare the address on the device’s own screen before approving a transfer.
- Keep the old wallet only for investigation. Do not reconnect it to dapps or sign messages while you collect evidence. The replacement wallet is for custody; the old one is an incident record and, where necessary, a place to revoke permissions.
Moving funds without feeding a sweeper
A sweeper is an automated process that watches a compromised address and immediately transfers incoming assets. Its presence changes the normal advice to “send gas and move everything.” Look at the block explorer for repeated transfers that occur seconds after deposits, transfers of the entire balance, or activity that continues without your interaction.
If no active sweeper is evident
From the clean environment, send the remaining assets to the replacement address. Check the destination and network on the wallet’s confirmation screen and, when practical, send a small test amount before a larger transfer. Keep enough fee currency only for the transaction you intend to make; do not leave funds in the compromised account after the move.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
If a sweeper may be active
Do not top up the old address with ETH, tokens, or another gas asset. The attacker may capture the deposit before you can use it. Pause and seek incident-response help that understands the specific network and timing; a rushed deposit can increase the loss. Record the addresses and transaction hashes while you still have access to the evidence.
After the transfer
Consider every account derived from the old phrase contaminated, even if one address shows no loss. A phrase compromise is not limited to the account that first displayed suspicious activity. Do not send future deposits to any old address.
Remove dapp connections, allowances, and signatures
Dapp connections
Disconnecting a site prevents that front end from remaining connected in the wallet interface. It does not erase transactions already signed or automatically cancel token allowances. Remove connections you do not recognize, but continue with the permission checks below.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Token approvals and operator permissions
An approval can authorize a contract to transfer a token from your wallet later. Unlimited allowances are particularly dangerous because they may expose the entire balance of that token. Use the network’s established allowance or approval-management tool, select the unknown spender, and submit a revoke transaction from the affected account. The transaction needs network fee currency, so do not fund an account that appears to be under active sweep without a plan.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Permit-style and other off-chain signatures
Some phishing pages request a signature rather than an on-chain approval. Permit2-style permissions can create delayed exposure: nothing may move at signing time, but a spender can later use the permission. Moving the at-risk tokens to a different account removes permissions tied to the old account; still review and cancel the permission where the protocol provides that control.
Clean the device and secure related accounts
Wallet theft can begin with a fake extension, clipboard-changing malware, a remote-access tool, or a stolen email account rather than with the wallet software itself.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
- Disconnect the suspect computer from sensitive work until you have preserved the browser history and relevant files.
- Remove extensions and software you did not deliberately install. Run a reputable, current malware scan; if results are unclear, obtain help from a trusted malware-removal provider.
- From a known-clean device, change the passwords for email, exchange accounts, cloud storage, and any service that could reset wallet access. Use unique passwords and enable two-factor authentication.
- Review email forwarding rules, active sessions, API keys, and withdrawal addresses on exchanges. Revoke anything unfamiliar.
- Update the operating system, browser, wallet software, and hardware-wallet firmware only through their official update paths.
Device cleanup protects future wallets; it does not recover coins already transferred. Do not restore the old phrase on the cleaned device.
What a hardware wallet can—and cannot—do
A hardware wallet can give the replacement wallet a separate signing screen. That makes it easier to inspect the destination, spender, amount, and network before approval, and it reduces exposure of the new phrase to a computer. Buy through the manufacturer’s official channel and verify the device on arrival; a marketplace listing is not automatically safe. Ledger reported a localized reseller-tampering incident updated October 15, 2026, so inspect packaging and follow the manufacturer’s verification process.
Hardware does not cure a leaked recovery phrase. If the old phrase or private key was exposed, the accounts controlled by it remain compromised regardless of whether the original wallet was hardware-based. When approving an allowance, compare the spender and permission details on the device itself rather than trusting only the computer screen.
Preserve evidence and set realistic recovery expectations
Create a timeline while details are fresh: the first suspicious page, wallet prompts, signatures, transaction hashes, recipient addresses, domains, device changes, and messages from supposed support agents. Keep screenshots and the original message headers where possible. Do not publish your recovery phrase or private key while asking for help.
Notify any centralized exchange involved through the address or phone number listed in its official app or website. Ask whether it can flag or freeze a receiving account, but do not assume it can reverse a blockchain transaction. Self-custody providers state that confirmed transactions cannot be reversed and missing funds cannot be restored. Reports to law enforcement and fraud agencies create a record and may help connect cases, yet they are not a promise of reimbursement.
Quick Recap
Mistakes that commonly make the loss worse
- Sending gas to a watched address: a sweeper can take the gas before you move the intended asset.
- Reusing the old phrase: an imported backup is still compromised.
- Only changing a password: passwords do not revoke a blockchain key or approval.
- Confusing disconnect with revoke: the dapp may be disconnected while its allowance remains live.
- Signing a “verification” message: an off-chain signature can grant delayed spending rights.
- Trusting unsolicited recovery offers: no genuine agent needs your phrase, a transfer to a new address, remote access, or a 2FA code.
- Continuing on an infected device: malware can alter addresses or capture the new phrase.
- Assuming a warning means safety: alerts and transaction simulations are useful signals, not guarantees.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
