Crypto Wallet Emergency Plan: What to Do If You Are Hacked

Crypto Wallet Emergency Plan: What to Do If You Are Hacked

Discovering that your crypto wallet has been compromised is a terrifying experience. The decentralized nature of blockchain means there is no bank to call, no chargeback to file, and often no one to reverse the transaction. However, panic is your enemy. A clear, step-by-step emergency plan can mean the difference between losing everything and saving your remaining assets. This guide outlines the critical actions you must take immediately after a hack, covering recovery, reporting, and future prevention.

1. Immediate Actions: Stop the Bleeding (First 10 Minutes)

The first few minutes are the most crucial. A hacker often has automated scripts running to drain every connected asset. Your goal is to sever their access.

• Disconnect the Device Immediately: If you are on a computer or phone, disconnect from the internet. Pull the ethernet cable, turn off Wi-Fi, or switch to airplane mode. This stops any remote commands or ongoing drainer scripts from executing.
• Do Not Move Funds Yet: Your first instinct might be to send remaining funds to a “safe” address. Do not do this. If your device is compromised with a clipboard hijacker or malware, the hacker will intercept the new address and steal your funds. You must move funds only after you have secured a clean environment.
• Do Not Use the Same Browser or Extension: Close all browser windows. If the hack happened via a browser wallet (like MetaMask, Phantom, or Rabby), do not open that browser again on the same device until it is cleaned.
• Change Passwords (on a Different Device): Using a separate, trusted device (e.g., your partner’s phone or a work computer you know is clean), immediately change the password to your email account. Hackers often target email first to reset passwords on exchanges or wallets. Enable 2FA on your email if not already active.

2. Revoke Approvals: Cutting Off the Drainer

Many hacks don’t steal your private key; they trick you into signing a malicious transaction that gives them unlimited access to specific tokens (like USDC, ETH, or NFTs). This is called a “token approval” or “allowance.” The hacker can now drain those tokens from your wallet without needing your key again.

• Use a Revoke Tool: Once you are on a clean, trusted device, go to a token approval revoker. Popular, reputable options include:
  • Revoke.cash (best for Ethereum and L2s)
  • Etherscan’s Token Approvals (under the “More” menu for any address)
  • DeBank or Zapper (for multi-chain review)
• Revoke ALL Suspicious Approvals: Look for approvals to unknown contracts, high-value allowances (e.g., “Unlimited USDC”), or contracts you do not remember using. Revoke them immediately. This will stop the hacker from draining tokens that are still in your wallet.
• Revoke on All Chains: If you use multiple blockchains (Ethereum, BSC, Polygon, Solana), check each one. Hackers often target the chain where the approval was granted. Tools like Revoke.cash support many chains.

Important Note: If the hacker already has your private key or seed phrase (not just an approval), revoking approvals will not help—they can simply sign new approvals. In that case, the wallet is permanently compromised and must be abandoned.

3. Moving Remaining Funds: The “Clean Wallet” Strategy

Once you have stopped the immediate drain and revoked approvals, you need to rescue any assets that remain. Do not send them to another address you own on the same device.

• Create a Brand New Wallet: On a completely different, clean device (e.g., a fresh phone or a computer that has never touched crypto), create a new wallet. Write down the new seed phrase on paper. Do not take a screenshot or store it digitally.
• Generate a New Address: From this new wallet, generate a single receiving address.
• Send to the New Address (Manually): Go back to your compromised wallet (still on the infected device, but now offline if possible). Manually type the new address character by character (or use a QR code if you can scan it with the clean device). Do not copy-paste. Send all remaining native coins (ETH, SOL, BNB) and tokens to the new address.
• Check for Dust Attacks: Before moving large amounts, send a tiny test transaction (e.g., $1 worth) to confirm the address is correct.
• Abandon the Old Wallet: Once everything is moved, treat the old wallet as “burned.” Never use it again. The seed phrase is compromised.

4. Reporting the Hack: Creating a Paper Trail

While blockchain is pseudonymous, reporting the crime is still critical for legal action, tax loss claims, and helping exchanges blacklist the hacker’s address.

• File a Report with Local Authorities: Contact your local police or cybercrime unit. Provide the transaction hash (TxID), the hacker’s wallet address, and the approximate value lost. In the US, you can also file a complaint with the FBI’s IC3 (Internet Crime Complaint Center) .
• Report to the Relevant Blockchain: Some blockchains (like Solana or Ethereum) have security teams or bounty programs. Report the hacker’s address via their official Discord or website.
• Notify the Exchange (if funds were sent there): If you track the stolen funds to a centralized exchange (e.g., Binance, Coinbase), contact their support immediately. Provide the TxID and the hacker’s address. They may freeze the account if the funds haven’t been withdrawn.
• Report to Wallet Provider: If the hack was due to a wallet vulnerability (e.g., a fake version of MetaMask or a malicious dApp), report it to the official wallet team. This helps protect others.

5. Recovery Options: What Can You Actually Get Back?

The honest truth is that most stolen crypto is never recovered. However, there are rare exceptions:

• Insurance: Did you have a dedicated hardware wallet with a recovery service (e.g., Ledger Recover) or a crypto insurance policy (e.g., Nexus Mutual)? If so, file a claim immediately. Most standard self-custody wallets are not insured.
• Blockchain Tracing Services: Companies like Chainalysis, CipherTrace, and TRM Labs work with law enforcement. If the hack was large (e.g., >$100k), law enforcement may hire them to trace the funds. For small amounts, this is cost-prohibitive.
• Negotiation (Rare): In some cases, white-hat hackers or “ethical” groups may contact you demanding a ransom (e.g., “Pay 10% to get your funds back”). Do not pay. This is a scam. Real white-hats will return funds without a fee.
• Tax Loss Harvesting: While not a recovery, you can claim the stolen crypto as a capital loss on your taxes. You will need the transaction records (TxID, date, value at time of theft). Consult a crypto tax professional.

6. Prevention for Next Time: Hardening Your Security

After surviving a hack, your security posture must be completely rebuilt. Assume nothing is safe.

• Use a Hardware Wallet for Cold Storage: Never keep significant funds in a hot wallet (browser extension or phone app). A hardware wallet (Ledger, Trezor, GridPlus) keeps your private key offline. Even if your computer is hacked, the hacker cannot sign transactions without physical access to the device.
• Never Sign Blindly: Always read the transaction details in your wallet before signing. Use tools like Revoke.cash or Wallet Guard to simulate the transaction and see exactly what permissions you are granting. If a dApp asks for “Unlimited” approval for a simple mint, deny it.
• Use a “Burner” Wallet: For interacting with new or risky dApps (NFT mints, new DeFi protocols, airdrop claims), use a separate hot wallet with only the minimum funds needed. Keep your main wealth in a hardware wallet that never touches dApps.
• Enable Multi-Factor Authentication (MFA): Use a hardware security key (YubiKey) or an authenticator app (Google Authenticator, Authy) for your email, exchange accounts, and wallet extensions. SMS-based 2FA is weak (SIM swapping).
• Regular Security Audits: Every 3-6 months, use a revoke tool to check your wallet for lingering approvals. Remove any that are no longer needed.
• Beware of Phishing: The majority of hacks start with a fake email, Discord DM, or website. Always double-check URLs. Bookmark official sites. Never enter your seed phrase into any website, even if it looks exactly like your wallet provider.

Conclusion

A crypto wallet hack is a devastating event, but it does not have to be the end of your journey. By acting immediately to disconnect, revoke approvals, and move remaining funds to a clean wallet, you can minimize losses. While recovery of stolen assets is rare, reporting the crime and learning from the incident are your best tools. The most important takeaway is this: self-custody requires self-responsibility. The next time you hold crypto, treat every transaction as a potential attack vector. Your future self will thank you for the paranoia.

Frequently Asked Questions

Q: Can I get my stolen crypto back from a hacked wallet?

A: Recovery is rare but not impossible. Most stolen crypto is never recovered due to blockchain’s irreversible nature. However, if the hack is large (over $100k), law enforcement may use blockchain tracing services like Chainalysis. You can also claim the loss as a capital loss on your taxes if you have the transaction records.

Q: What should I do first if my MetaMask or Phantom wallet is hacked?

A: Immediately disconnect your device from the internet to stop any ongoing drainer scripts. Then, on a separate clean device, use a revoke tool like Revoke.cash to remove any malicious token approvals. Do not move funds until you have created a brand new wallet on a different, secure device.

Q: How do I revoke token approvals after a crypto hack?

A: Go to a trusted revoke tool like Revoke.cash, Etherscan’s Token Approvals, or DeBank on a clean device. Connect your wallet address and look for any approvals to unknown contracts or those with “Unlimited” allowances. Revoke all suspicious approvals immediately to stop the hacker from draining your tokens.

Q: Is it safe to move my remaining crypto to a new wallet after a hack?

A: Yes, but only if done correctly. Create a new wallet on a completely different, clean device. Manually type the new address character by character (do not copy-paste) and send a small test transaction first. Once confirmed, move all remaining funds and abandon the old wallet permanently.

Q: Should I report a crypto wallet hack to the police?

A: Yes, you should file a report with local authorities or the FBI’s IC3 (Internet Crime Complaint Center) in the US. Provide the transaction hash (TxID), the hacker’s wallet address, and the value lost. While it may not recover your funds, it creates a paper trail for tax loss claims and helps exchanges blacklist the hacker’s address.

Q: How can I tell if my wallet was hacked via a token approval or a stolen private key?

A: If you still have access to your wallet and can sign transactions, the hack likely involved a malicious token approval (allowance). If you cannot access your wallet at all or see unauthorized transactions you didn’t sign, the hacker likely has your private key or seed phrase. In the latter case, the wallet is permanently compromised and must be abandoned.

Q: What is a “burner wallet” and how does it prevent hacks?

A: A burner wallet is a separate hot wallet with minimal funds used only for interacting with new or risky dApps, NFT mints, or airdrop claims. By keeping your main wealth in a hardware wallet that never touches dApps, you limit potential losses. Even if the burner wallet is compromised, your primary assets remain safe.

Q: Can I claim stolen cryptocurrency as a tax loss?

A: Yes, you can claim stolen crypto as a capital loss on your taxes, which may offset gains or reduce taxable income. You will need the transaction records, including the TxID, date of theft, and the fair market value at the time of the hack. Consult a crypto tax professional for proper filing.