If you think your wallet has been compromised, this page is built to be read fast: the first section tells you exactly what to do right now, before anything else. Everything after that explains why, and how to avoid a repeat. Speed matters here in a way it does not in most of our other guides, so act first and read the rest afterwards if you need to.

The first five minutes

Figure 1: two different situations, two different first moves

1. Work out which situation you are in: has someone gained your self-custodial wallet’s recovery key or private key, or has someone accessed your exchange account through your password?
   

2. Self-custodial: move any remaining funds to a brand new wallet with a freshly generated recovery key immediately, before doing anything else.
   

3. Exchange account: change your password, revoke active sessions, reset two-factor authentication, and contact support right away.
   

4. Either way, do this from a device you trust: if the compromise may have come through malware on your usual device, use a different one if you can.

The fact that surprises most people

Figure 2: moving funds out is not the same as making the wallet safe again

Here is the part worth understanding clearly: once a private key or recovery key has been exposed, that wallet is compromised permanently, not temporarily. Moving the remaining funds out does not undo the exposure, because whoever has the key still has exactly the same access they always did. The wallet itself must be treated as retired: never send new deposits to it again, under any circumstances, no matter how much time has passed.

Watch for the second scam

Figure 3: the scam that specifically targets people who were just hacked

Anyone who has publicly mentioned being hacked, in a support ticket, a forum post, or on social media, often becomes the target of a second scam almost immediately: someone offering to recover the stolen funds for an upfront fee. It is virtually always fake. No legitimate service can reverse a blockchain transaction, and paying anyone who claims otherwise simply adds a second loss to the first.

Straight answers

Good to know

Figure out how it happened, once you are safe. Common causes include phishing sites, malware, or a recovery key that was photographed, typed into a device, or shared: our wallet security guide covers closing each of these off.

An exchange hack has a different path forward. Because the exchange holds custody, their fraud and support teams can sometimes freeze activity or investigate in ways that are simply not possible for a self-custodial wallet: our self-custody guide covers this trade-off in full.

This is exactly why prevention gets so much attention. Every habit in our recovery key and wallet security guides exists specifically to prevent the situation this page addresses: a few minutes of setup against an outcome that cannot be undone.

Report it, even if funds cannot be recovered. Reporting a theft to the relevant platforms and authorities does not guarantee recovery, but it contributes to broader efforts against the same attackers and scam patterns.

A fresh, secure wallet is a genuine clean slate. Once funds are moved and the old wallet is retired for good, a properly secured new wallet is exactly as safe as any other: this situation is recoverable in every way that matters going forward.