Crypto Wallet Hacked or Drained? What to Do in the First Hour

First, the Hard Truth: On-Chain Transactions Cannot Be Reversed

There is no fraud department on a blockchain. Once a transaction is confirmed, no bank, wallet vendor or validator can claw it back. That sounds bleak, but it clarifies your job in the first hour: you are not trying to undo the theft — you are trying to stop it from continuing. Many drains are not a single event. Attackers who hold your seed phrase, or a standing token approval, can keep taking assets as they arrive. Speed matters more than perfect decisions right now.

Step 1: Move What’s Left to a Fresh Wallet — Fast

Create a brand-new wallet with a brand-new seed phrase, ideally on a device you trust more than the one that may be compromised. Then transfer every remaining asset to it: tokens first, starting with the highest value, then NFTs, then leftover native coins. Do not send anything to another address derived from the same seed phrase — if the seed leaked, every address under it is burned. If a sweeper bot instantly steals any gas you deposit, that is strong evidence the seed itself is compromised rather than a single approval.

Step 2: Revoke Token Approvals So the Drainer Can’t Come Back

Many hacks never touch your seed phrase. Instead, you signed a malicious approval that lets a contract spend your tokens indefinitely — the classic wallet drainer playbook. Even after moving funds, that permission follows the old address, and any tokens sent there later can be swept. Use a reputable approval-checker to list every contract allowed to spend from the compromised address and revoke anything suspicious or unlimited. Our guide on how to revoke token approvals walks through the exact process. Note that each revocation is itself a transaction, so keep a little native gas available.

Step 3: Document Everything — Transaction Hashes, Addresses, Timestamps

Before memories blur, capture the evidence: the transaction hashes of the theft, the attacker’s receiving addresses, exact timestamps, and what you were doing right before it happened — a link you clicked, a signature you approved, an app you installed. A block explorer shows all of this publicly; if the interface feels unfamiliar, see how to read a block explorer. Screenshots plus saved explorer links are enough. This record is what makes every later step — reports, tracing, tax loss claims — possible.

Step 4: Report It — Exchanges, Explorers and Law Enforcement

Stolen crypto usually has to pass through an off-ramp eventually. Report the attacker’s addresses to major exchanges’ fraud teams so they can flag deposits, and use the report or label feature many explorers offer to tag the address publicly. File a report with your local cybercrime unit — in the US that is the FBI’s IC3 portal — with your documented hashes attached. Recovery is rare, but flagged addresses do get frozen at exchanges, and reports build the case files that occasionally lead there. Ignore anyone who contacts you promising guaranteed recovery for an upfront fee: that is a second scam targeting fresh victims.

EVM vs Solana vs TON: How Triage Differs by Chain

On EVM networks (Ethereum and its L2s), token approvals are the big aftercare item — ERC-20 allowances and NFT operator approvals persist until revoked. On Solana, the equivalent is token account delegation, which is less commonly abused but worth checking; drains there more often come from malicious transaction signatures or a leaked key, so a fresh keypair is the priority. On TON, approvals as EVM users know them largely don’t exist — jettons sit in per-token wallet contracts — so a compromise almost always means the key itself leaked, and migration to a new wallet is the whole fix. As of 2026, cross-chain drainer kits target all three, so triage every chain the compromised seed touched.

Figure Out How It Happened Before You Rebuild

Do not restore from a backup or reuse the old device until you know the entry point. The usual suspects: a phishing site that harvested a signature, a fake wallet app or browser extension, malware or a clipboard hijacker on your machine, a seed phrase photographed or typed into a website, or a poisoned airdrop that lured you into a malicious approval. Match your documentation from Step 3 against these. If malware is plausible, wipe the device or move to a clean one before typing any new seed phrase. Rebuilding on an infected machine just schedules the next drain.

How WATS Uses This: Hardware 2FA With the NFC Metal Card

WATS adds a physical second factor for actions initiated inside the app: the NFC Metal Card. It is tap-to-authenticate hardware 2FA, not key storage — your private keys never touch the card. Each card carries a unique ID and pairs exclusively with one device on its first tap in the WATS mobile app, so an attacker who remotely gains access to your app or account still cannot approve app-initiated actions without physically tapping your card on your paired phone. Be clear about its scope: it blocks remote compromise of the app itself, but it cannot stop a leaked seed phrase — an attacker holding your seed can import it into any other wallet software and never touch the WATS app or the card, which is why the hygiene steps above still matter. The card is built on NTAG 216 with AES-128 over ISO/IEC 14443, rated IP68 and MIL-STD-810, from $54.90. The wallet itself stays pure self-custody across EVM, Solana and TON — you hold your keys, and WATS never holds a key — so the recovery playbook above remains yours to run; the card simply closes off one common entry point, unauthorized actions from a remotely compromised app.