🚨 Crypto hacked? What to do in the first hour

First: nobody can reverse it for a fee

Blockchain transactions can't be undone. People who lost crypto are targeted again by fake "recovery" services and fake law firms that ask for an upfront fee. The FBI's warning is plain: law enforcement does not charge victims to investigate. Don't send money or personal details to anyone who contacts you offering to get your funds back.

If your own wallet is being drained

1. 1. Stop signing.

   Disconnect the site you were using and don't approve or sign anything else from that wallet. Never type your seed phrase into a website or send it to anyone, whoever they say they are.

2. 2. Make a new wallet on a device you trust.

   If your computer or phone may be infected, use a different one. Create a brand-new wallet with a new seed phrase and write it on paper, not in a screenshot or a cloud note.

3. 3. Move what's left, most valuable first.

   If funds are leaving right now, speed matters more than anything else. Some drained wallets are watched by bots that grab any gas you send to them, so move the largest balances first and expect to lose small amounts.

4. 4. Revoke token approvals.

   Scams often trick you into approving unlimited spending of a token. Check and revoke approvals with Revoke.cash or Etherscan's Token Approval Checker. It costs a little gas. Treat the old seed phrase as burned for good: anyone who has it can approve again.

5. 5. Save the evidence.

   Transaction hashes, the addresses involved, screenshots of your balances and history, and every message with the scammer.

6. 6. Report it.

   In the US, file a complaint with the FBI's Internet Crime Complaint Center (IC3); elsewhere, your national fraud office or local police. Report the addresses on Chainabuse. If the funds went to an exchange, contact that exchange's support at once: exchanges can sometimes freeze flagged accounts.

If an exchange you use was hacked

1. 1. Get news only from the exchange itself.

   Open its website, status page or official X account from your own bookmark. Fake "compensation", "verify your account" and "withdraw now" links appear within hours of a hack.

2. 2. Don't act in a panic.

   If withdrawals are paused, there is nothing to do but follow the official updates. If they're open, decide calmly whether to move funds to a wallet you control.

3. 3. Lock down your account.

   Change your password, use an authenticator app or security key instead of SMS for two-factor authentication, turn on the withdrawal address allowlist if the exchange has one, and delete any API keys you don't use.

4. 4. Screenshot your balances and history now,

   in case there is a claims process later.

5. 5. Ignore direct messages from "support".

   Real support doesn't contact you first with a link or ask for your seed phrase, password or 2FA code.

If a DeFi app you use was exploited

• Revoke the approvals you gave that protocol's contracts.
• Only use "migration", "refund" or "claim" links announced on the protocol's official channels, opened from your own bookmark.
• Withdraw only when the team's official channels say it's safe to interact with the contracts.

Five minutes now that make a hack less likely

• Keep long-term holdings on a hardware wallet, and use a separate hot wallet with small amounts for trading and new apps.
• Bookmark your exchanges and wallets; don't reach them through search ads or links in messages.
• Use an authenticator app or security key for two-factor authentication, not SMS.
• Turn on withdrawal address allowlists where your exchange offers them.
• Check and revoke old token approvals once a month.
• Never share your screen, seed phrase or 2FA codes with anyone offering help.

Questions people ask