Watching your wallet balance drop to zero is one of the most disorienting experiences in crypto. One minute it’s there. The next, it’s gone. You feel violated, confused, and probably furious — and now you’re searching for answers as fast as your hands can type.
If your crypto wallet was drained and you’re figuring out what to do, you’re in the right place. Take a breath. You’re not alone, and there are specific steps to take right now — in the right order. This guide walks you through exactly what to do when your crypto wallet has been drained.
Note: I’m not a lawyer or a licensed investigator. I cannot promise your funds will be recovered — and anyone who does promise that is lying to you. What I can give you is 12 years of on-chain experience and a clear action plan.
Stop the Bleeding — Your First Five Minutes Matter
If the attacker still has access to your wallet, they may not be finished. Move first; ask questions second.
1. Transfer any remaining assets to a fresh wallet immediately
Open your wallet, find anything still there — even small amounts — and send it to a brand-new wallet you create right now. Do not send funds to another wallet you already have. If your seed phrase is compromised, the attacker may already have access to all your existing wallets.
2. Create a new wallet on a clean device
Download a fresh wallet app (MetaMask, Trust Wallet, Phantom — whichever chain you use). Generate a new seed phrase. Write it down on paper and store it somewhere physically secure. Do not save it digitally right now.
3. Go to revoke.cash right now and cancel all approvals
This step is time-critical. Most wallet drains exploit a “token approval” — a permission you signed at some point that lets a smart contract move your tokens without further confirmation. Think of it like a signed blank check. Go to revoke.cash, connect your compromised wallet address, and revoke every single approval listed. This may stop an automated drainer from finishing the job before it completes.
Crypto Wallet Drained? First Figure Out How It Happened
Different attacks require different responses. Work through these questions:
Did you recently click a link in Discord, Twitter/X DMs, or a promotional email?
That points to a phishing attack. You were directed to a fake dApp or fake wallet site that stole your credentials or tricked you into signing a malicious transaction.
Did you sign an “approve” transaction for a new dApp you didn’t fully recognize?
That’s likely a malicious approval or a “token drainer” — a contract disguised as a legitimate swap or NFT mint that was actually harvesting your approvals.
Did you enter your seed phrase anywhere — a website, a support chat, a “wallet rescue” tool?
Your wallet is fully compromised. This is the worst-case scenario. Move everything immediately to a new wallet with a freshly generated seed phrase. Treat every wallet that shared that seed phrase as burned.
Did you download a new wallet app, browser extension, or “portfolio tracker” recently?
You may have installed malware. Do not use that device for any crypto activity until it is wiped and reinstalled from scratch.
What To Do After a Crypto Wallet Drain — By Scenario
Once you know how you were hit, here is your containment plan. Work through the one that matches your situation.
Phishing attack or malicious approval
- Revoke all approvals at revoke.cash (if you haven’t already)
- Sweep any remaining funds to your new clean wallet
- Change all passwords on related accounts — email, exchanges, anything connected to the compromised wallet
- Enable two-factor authentication (2FA) everywhere that supports it
Seed phrase compromised
- Create an entirely new wallet with a fresh seed phrase — generate it offline if at all possible
- Move all remaining assets to the new wallet immediately
- Treat the compromised device as unsafe for all future crypto activity
- If the device also has banking apps or saved passwords, assume those may be at risk too
Malware or suspicious download
- Disconnect the device from the internet immediately
- Do not use it for any crypto, banking, or sensitive activity
- Perform all wallet recovery and fund transfers from a completely separate, clean device
- After securing your funds, wipe the compromised device and reinstall the operating system
For a detailed walkthrough of building a secure wallet setup from the ground up, read: Crypto Wallet Security: Complete Setup Guide. If you want to understand exactly why the seed phrase is your most critical vulnerability, Crypto Seed Phrase Explained covers it in plain language. And if you want to avoid something similar happening again, My $8K Wallet Mistake (And the 5-Minute Fix) is worth reading once you’re through the immediate crisis.
Document What Happened — Do This Before You Forget
Even if recovery seems out of reach, documentation is not optional. It protects you in three ways: it helps law enforcement build a case, it supports any dispute with a bank or exchange, and it’s essential for any legitimate on-chain investigation.
- Screenshot your wallet’s full transaction history using the block explorer for your chain. For Ethereum: etherscan.io. For Bitcoin: blockchain.com. For Solana: solscan.io. Search your wallet address and screenshot everything.
- Record the attacker’s wallet address — the address that received your funds.
- Copy every transaction hash — each blockchain transaction has a unique identifier, and these are the primary evidence.
- Write down what you did in the hours before the drain: what links did you click, what dApps did you connect to, what files did you download.
- If you interacted with a specific contract or dApp, record its address.
This is exactly what you’ll need for the FBI’s reporting portal, and what any legitimate on-chain investigator will ask for in a first session.
How to Secure Your Crypto Wallet After a Hack — Report It
Reporting will not reverse the transaction. But it matters more than most people think. The FBI and federal agencies do pursue crypto fraud cases — particularly when reports show a pattern targeting the same attacker address or platform.
- ic3.gov — FBI Internet Crime Complaint Center. File here regardless of amount or method. This is the primary US channel for crypto crime reports.
- CISA Phishing Report — If this was a phishing attack, report the site or message at reportphishing.anti-phishing.org.
- The platform where the attack started — Report the Discord server, Twitter/X account, fake dApp, or browser extension. You may protect the next person.
- Your local police — File a report. You will likely need a case number if you ever engage a lawyer.
Is Wallet Drained Crypto Recovery Realistic? (Honest Answer)
In most cases: no.
Blockchain transactions are irreversible. Once funds leave your wallet and land in an attacker’s address, no one — not Ethereum, not Coinbase, not the FBI — can simply reverse it. The chain does not have a “dispute” button.
There is one narrow window where acting fast can help: if you revoke your approvals at revoke.cash quickly enough, an automated drainer script may not have run yet. That’s why revoke.cash is first on this list, not last.
The scam within the scam: If you search “crypto wallet recovery service” and find someone offering to recover your drained funds for an upfront fee — that is a scam. Recovery scammers specifically target people who have just been robbed. They will take whatever you have left. Walk away from any service that charges upfront fees and promises to recover your crypto.
Get Professional Help With What Actually Happened
Sometimes you need more than a checklist. If you’re trying to understand exactly how the drain happened, document it properly for law enforcement, or build a paper trail for your bank — that’s where an on-chain trace helps.
Overwhelmed? Book a Was I Scammed? session ($149) — on-chain trace + a documentation pack for the FBI/IC3, police, and your bank. I will NOT promise to recover your funds; anyone who promises that is scamming you a second time. Book here