# My crypto wallet got drained. What do I do in the first 30 minutes?

Source: https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/  
Published: 2026-10-25  
Last updated: 2026-10-25  
By: J  
AI-assisted, human-reviewed by J (2026-10-24).

**Short answer:** Don't send more crypto, including gas, into the drained wallet. Create a new wallet on a clean device, move what's left (tokens first, gas coin last), revoke unknown approvals, and report it at ic3.gov. If your seed phrase leaked, a sweeper bot may grab anything you deposit, so abandon that wallet. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-hacked); [Revoke.cash](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-revoke-scammed); [FBI IC3](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-ic3-guidance))

**What this covers:** what to do in the first 30 minutes after your crypto wallet is hacked or drained: a timed checklist (0–5, 5–15, 15–30 minutes), a quick way to tell whether your seed phrase leaked or you signed a bad approval, how to beat a sweeper bot without feeding it gas, and a block explorer for each chain. **Who it's for:** you, if you just saw transactions you didn't make in MetaMask, Phantom, Trust Wallet, Coinbase Wallet or another self-custody wallet, including wallets you sign into with Google or Apple. **What it isn't:** a recovery service or a guarantee. On-chain transfers can't be reversed, and we don't refer anyone to recovery firms or exchanges. If the money left an exchange account (not a wallet you hold the keys to), contact the exchange through its own app first, then [report it in order](https://pausebeforesend.com/blog/how-to-report-crypto-scam/).

## Key facts

- On-chain transactions can't be reversed, and self-custody wallet makers can't freeze or recover your funds. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-hacked); [Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom); [Trust Wallet](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-tw))
- A sweeper bot is an automated script that uses a stolen private key to move any crypto sent into a compromised wallet, usually within seconds. MetaMask says the sweep "can happen almost instantly" because the bot watches pending transactions. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper))
- MetaMask says a sweeper can only get onto your wallet if your Secret Recovery Phrase leaked to a bad actor. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper))
- If assets left across several networks or wallets, or the native coin (ETH, POL, BNB) is taken right after you deposit it, Revoke.cash says your seed phrase is compromised. ([Revoke.cash](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-revoke-scammed))
- Flashbots' Whitehat Hotline only attempts rescues when more than $1,000 remains in the compromised address, and it can't get back funds that already left. ([Flashbots](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-flashbots))

## Wallet drained? What should I not do first?

Three mistakes make a wallet drained once into a wallet drained twice. Avoid them before you do anything else.

1. **Don't send gas (ETH, SOL, BNB, POL) to the drained wallet.** If a sweeper bot is on it, the bot takes the gas before you can use it. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-hacked); [MetaMask sweeper guide](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper))
2. **Don't sign, click or "claim" anything else,** including strange tokens that just showed up. Phantom warns that trying to send or swap scam tokens can put your funds at risk. ([Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom)) More on [scam tokens that just appeared](https://pausebeforesend.com/blog/airdrop-claim-scams/).
3. **Don't reply to anyone offering help** in DMs, replies or comments, and don't call a "support number" from a search result. Phantom and Trust Wallet both say their support will never ask for your recovery phrase. ([Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom); [Trust Wallet](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-tw)) See [fake wallet support scams](https://pausebeforesend.com/blog/fake-crypto-wallet-support-scams/).

## What do I do in the first 30 minutes after my wallet is drained?

Follow these steps in order. Each block should take about the time on its label.

### Minutes 0–5: stop the bleeding and look

1. **Stop using the wallet.** Don't approve, sign or send from it, except to move funds out later. MetaMask says to stop using every account tied to the same recovery phrase. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper))
2. **Take the device offline if you think it has malware,** and switch to a different, safe device. ([Kraken](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-kraken))
3. **Open your address in a block explorer** ([table below](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#explorers)). For each transaction you don't recognize, check the date and time, the recipient address, the app involved and the amount. Some "unauthorized" transactions turn out to be your own swap, deposit or gas fee. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-hacked))
4. **Screenshot it.** Write down the time with your time zone, and copy the transaction hashes. You'll need them for the IC3 report. ([FBI IC3](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-ic3-guidance))

### Minutes 5–15: figure out what happened, and set up a clean wallet

1. **Use the [decision table below](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#decide)** to tell a seed phrase leak from an approval or a login problem. **If you can't tell, treat it as a seed phrase leak.** Phantom says to treat the wallet as compromised when you can't identify the cause. ([Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom))
2. **Create a brand-new wallet with a new recovery phrase** on a clean device or a new browser profile. Don't add a new account under the old phrase; it would be compromised too. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-hacked); [MetaMask sweeper guide](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper); [Kraken](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-kraken)) Install the wallet by typing its address yourself, not from a search result. ([MetaMask migration guide](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-migrate)) Already own a hardware wallet? Use it. ([Revoke.cash](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-revoke-scammed); [MetaMask migration guide](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-migrate))
3. **Write the new phrase on paper, alone.** Never photograph it or store it in the cloud. ([Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom)) Here's [how seed phrases get stolen](https://pausebeforesend.com/blog/seed-phrase-phishing/).
4. **Disconnect apps you don't recognize and revoke unknown approvals.** Use Revoke.cash for Ethereum and EVM chains, and the Solana revoker named in Phantom's help article for Solana. ([Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom)) Full steps: [how to check and revoke token approvals](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/). [Our advice: in a seed phrase leak, revoking on the old wallet doesn't stop a thief who has your keys. Don't fund the old wallet just to pay for revokes. Revoking matters most in the approval case.]

### Minutes 15–30: move what's left, lock the doors, start the report

1. **Move what's left to the new address, one asset at a time:** NFTs and tokens first, **the gas coin last**, because you need it to pay for the other transfers. ([MetaMask migration guide](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-migrate)) Skip tokens you don't recognize. Check for staked or DeFi positions that need extra steps first. ([Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom); [MetaMask migration guide](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-migrate))
2. **Stop if anything you move vanishes in seconds.** That's a sweeper bot. Don't keep trying. Read the [sweeper bot section](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#sweeper).
3. **Secure the accounts around the wallet.** Change important passwords. If the wallet uses a Google, Apple or email login, secure that account now. ([Revoke.cash](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-revoke-scammed); [Kraken](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-kraken); [Chainabuse](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-chainabuse))
4. **Look for the cause.** Check your browser history around the time of the first unauthorized transaction for a phishing link. Review recently installed extensions and apps, and run a malware scan. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-hacked); [MetaMask sweeper guide](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper); [Chainabuse](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-chainabuse))
5. **Start your evidence list:** addresses, amounts, hashes, and times with time zone. Use our [evidence template](https://pausebeforesend.com/blog/how-to-report-crypto-scam/#evidence). ([FBI IC3](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-ic3-guidance))

### After 30 minutes: report it

- **File at ic3.gov** (type it in yourself) with your transaction hashes. Then file at **ReportFraud.ftc.gov**, then **Chainabuse**, then local police for a report number. ([FBI IC3](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-ic3-guidance); [FTC](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-ftc-crypto); [MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper); [Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom-report))
- **Follow the full order** in [how to report a crypto scam in the US](https://pausebeforesend.com/blog/how-to-report-crypto-scam/).
- **Drained from an exchange account?** Contact the exchange through its own app first.

## Was it my seed phrase, an approval, or my login?

Match what you see to a row. If nothing fits cleanly, use the last row.

| What you see | Most likely | What to do | Can you keep the wallet? |
| --- | --- | --- | --- |
| Assets left across **several networks or wallets**; the gas coin is taken **right after you deposit it**; you typed your phrase into a site, form or "support" chat; or you installed a game, meeting app or extension someone sent you | **Seed phrase or private key leaked** ([Revoke.cash](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-revoke-scammed); [Revoke.cash](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-revoke-seed)) | New wallet with a new phrase on a clean device. Move tokens first and gas last. **Never send in gas.** Scan for malware. Ask Flashbots' Whitehat Hotline if more than $1,000 is left on Ethereum. See [how seed phrases get stolen](https://pausebeforesend.com/blog/seed-phrase-phishing/). | **No. Abandon it for good.** ([Revoke.cash](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-revoke-scammed); [Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom)) |
| **One token** (or several tokens approved to one contract) gone on **one network**; a recent approval to an unknown contract on Revoke.cash; the explorer shows `MatchOrders` or `BulkExecute`; you clicked "Claim" or "Security Update" on a site | **Approval, permit or marketplace signature** ([Revoke.cash](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-revoke-scammed)) | Revoke the bad approval now ([how to check and revoke token approvals](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/)). Cancel pending marketplace signatures on Revoke.cash's Signatures page; the window is small. Bookmark the sites you use. | Revoke.cash says yes, once you've revoked. [Our advice: if you're not 100% sure, move anyway.] |
| Your wallet was created with **Google, Apple, Telegram, email or a passkey** (an embedded or social-login wallet) | **The login account may be compromised** ([Kraken](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-kraken); [MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-migrate)) | Secure that account first: change the password and remove unknown devices and sessions ([Google](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-google); [Apple](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-apple)). Then create a new wallet **not linked to the same account**, export keys if needed, and move what's left. | **No.** MetaMask says old wallets stay tied to that account and can't be disconnected. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-migrate)) |
| **Not sure** | Treat it as a seed phrase leak | Follow the first row | No |

## What is a sweeper bot, and how do I beat one?

**What it is:** a script the thief runs with your private key. It watches pending transactions and forwards anything that lands in your wallet, faster than you can react. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper))

**Signs:** every deposit gets forwarded right away. A transfer "never arrives," so you think it's stuck. Small balances may be left alone, so you might not notice the bot at all. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper))

**Why sending gas fails:** the bot can spend all available ETH to win the race. An attacker may even fund the wallet with gas to pull out NFTs or liquidity pool tokens. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper))

> "Depositing more funds to your account will likely result in losing more funds."
> MetaMask Help Center, [What to do if you have a sweeper bot on your wallet](https://support.metamask.io/stay-safe/protect-yourself/fighting-back-against-sweeper-bots/)

**What you can do:**

1. **Stop using every account** under that recovery phrase. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper))
2. **Move to a brand-new recovery phrase.** ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper))
3. **Ask Flashbots if you're on Ethereum and stuck.** If staked tokens, NFTs or tokens you can't move without gas are still in an Ethereum wallet, Flashbots' Whitehat Hotline can try to rescue the *remaining* funds with transaction bundles that bypass the public mempool. Submit only at **whitehat.flashbots.net**. It helps only when more than $1,000 is left in the address. ([Flashbots](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-flashbots); [MetaMask migration guide](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-migrate); [Revoke.cash](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-revoke-scammed)) MetaMask says the team takes a 5–10% cut of recovered assets. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper)) Deal only with Flashbots Discord members who have the "whitehat," "whitehat-associate" or "serv.eth" role. ([Flashbots](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-flashbots)) Flashbots' guidance covers Ethereum; don't expect it to help on Solana, Tron or Bitcoin.
4. **Skip the do-it-yourself bundle method** unless you're a developer. MetaMask says it "will require significant technical know-how." ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-sweeper))

[Our advice: Flashbots is the one real exception, and it's free to ask. Anyone else who DMs you offering to "outrun the bot" for a fee is running a recovery scam.] Read about [the second scam](https://pausebeforesend.com/blog/crypto-recovery-scams/).

## Which block explorer do I use?

Paste your **public address** (never your phrase) to see every transaction in and out.

| Chain (coins you may see) | Explorer | Notes |
| --- | --- | --- |
| Ethereum (ETH, USDC, USDT ERC-20) | [etherscan.io](https://etherscan.io/) | Has a Token Approvals checker (see [our approvals post](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/)); listed by Chainabuse ([Chainabuse](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-chainabuse)) |
| Many EVM chains at once | [blockscan.com](https://blockscan.com/) | MetaMask suggests it to find every chain your address has used ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-migrate)) |
| Base | [basescan.org](https://basescan.org/) | Ethereum layer 2; same layout as Etherscan |
| Arbitrum | [arbiscan.io](https://arbiscan.io/) | Ethereum layer 2; same layout as Etherscan |
| Optimism | [optimistic.etherscan.io](https://optimistic.etherscan.io/) | Ethereum layer 2; run by Etherscan |
| Polygon (POL) | [polygonscan.com](https://polygonscan.com/) | Listed by Chainabuse ([Chainabuse](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-chainabuse)) |
| BNB Chain (BNB) | [bscscan.com](https://bscscan.com/) | Same layout as Etherscan |
| Solana (SOL, SPL tokens) | [solscan.io](https://solscan.io/) | Phantom names Solscan as a trusted source ([Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom)); Chainabuse lists solana.fm |
| Tron (TRX, USDT TRC-20) | [tronscan.org](https://tronscan.org/) | Listed by Chainabuse ([Chainabuse](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-chainabuse)) |
| Bitcoin (BTC) | [mempool.space](https://mempool.space/) or [blockchain.com/explorer](https://www.blockchain.com/explorer) | blockchain.com is listed by Chainabuse ([Chainabuse](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-chainabuse)) |

Type these addresses yourself or use a bookmark. [Our advice: fake explorer and fake revoke sites exist.]

## Can I get my drained crypto back?

- **Usually not.** Wallet makers can't reverse or freeze anything. ([MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-hacked); [Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom); [Trust Wallet](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-tw)) The FTC says crypto payments typically aren't reversible and don't come with the legal protections credit cards have. ([FTC](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-ftc-crypto))
- **Report anyway.** Phantom says reports have sometimes helped law enforcement or exchanges freeze or recover assets, especially in large cases, and that IC3 has worked with exchanges to freeze stolen crypto in past cases. ([Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom); [Phantom](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-phantom-report))
- **Expect a recovery pitch, and ignore it.** Revoke.cash says anyone who promises to recover stolen assets is likely a scammer. ([Revoke.cash](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-revoke-scammed)) That's [the second scam](https://pausebeforesend.com/blog/crypto-recovery-scams/).
- **Check for a vendor incident.** If a known wallet-software incident caused the drain, look for a reimbursement process on the vendor's official blog or support center. Example: Trust Wallet's browser extension v2.68, used and logged into Dec 24–26, 2025. ([Trust Wallet](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-tw-268))

**Moving to a hardware wallet?** Revoke.cash and MetaMask both suggest moving what's left to a hardware wallet, which keeps your keys off a computer that may be compromised. ([Revoke.cash](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-revoke-scammed); [MetaMask](https://pausebeforesend.com/blog/crypto-wallet-drained-first-30-minutes/#src-mm-migrate)) Buy only from the maker's own store or its official reseller list ([Ledger resellers](https://www.ledger.com/reseller) · [Trezor resellers](https://trezor.io/resellers)), never from a marketplace seller you can't verify. Then follow our [hardware wallet setup checklist](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/). If it arrives with a recovery phrase already filled in, don't use it (see [the October 2026 reseller implant case](https://pausebeforesend.com/blog/is-ledger-safe/)). Don't shop in the middle of a drain: any clean new wallet works right now.

## Frequently asked questions

### I think my crypto wallet was hacked. What should I do first?

Stop using it, and don't send any more crypto into it, including gas. Then create a new wallet with a new recovery phrase on a clean device and move whatever is left, tokens first and the gas coin last. MetaMask, Phantom and Kraken all give this order.

### Should I send ETH to my hacked wallet to pay the gas fee?

No. If your seed phrase leaked, a sweeper bot will take the ETH before you can use it. MetaMask says to stop depositing funds, and if more than $1,000 is stuck on Ethereum, ask Flashbots' Whitehat Hotline at whitehat.flashbots.net.

### What is a sweeper bot?

It's a script a thief runs with your stolen private key. It forwards anything that arrives in your wallet almost instantly. MetaMask says a sweeper can only get onto your wallet if your Secret Recovery Phrase was exposed.

### How do I know if my seed phrase was stolen or I just signed a bad approval?

If assets left across several networks, or new gas you deposit vanishes right away, Revoke.cash says your seed phrase is compromised. If one token went to a contract you recently approved, it was likely an approval, which you can revoke.

### Can I keep using my wallet after it was drained?

Only if the cause was a single approval or signature that you've since revoked. If your seed phrase or private key leaked, or you don't know how it happened, abandon the wallet and never send to it again.

### My wallet uses Google or Apple login. What do I do?

Secure that Google or Apple account first by changing the password and removing devices you don't recognize. Then create a new wallet that isn't connected to the same account. MetaMask says wallets tied to a social login can't be disconnected from it.

### Can anyone recover my drained crypto?

Usually not. Self-custody wallet makers can't reverse or freeze transfers, and anyone who promises recovery for a fee is likely a scammer. Report the theft at ic3.gov anyway; Phantom says reports have sometimes helped freeze stolen funds.

### Is the wallet support number I found online real?

Be very careful. Fake "wallet support" phone numbers show up in search results, and MetaMask, Phantom and Trust Wallet all warn that real support will never ask for your recovery phrase. Reach support only through the help center inside the official app or site.

## What to do next

**If your crypto wallet was just drained:** don't send gas to the old wallet. Create a new wallet on a clean device, move what's left, then revoke approvals at revoke.cash. Next: [report it in order](https://pausebeforesend.com/blog/how-to-report-crypto-scam/) (ic3.gov first, with your transaction hashes) using our [evidence template](https://pausebeforesend.com/blog/how-to-report-crypto-scam/#evidence).

**Check your wallet's token approvals now:** paste your public address (never your seed phrase) into revoke.cash and revoke anything you don't recognize. Step-by-step: [how to revoke token approvals](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/).

Get one crypto scam warning a week from Pause Before Send: [join the newsletter](https://pausebeforesend.com/newsletter/).

No affiliate links on this page, by policy. We have no deal with Ledger, Trezor, Flashbots, Revoke.cash or any wallet or explorer named here. They're named because the cited guides describe them.

## Sources

1. FBI IC3, "FBI Guidance for Cryptocurrency Scam Victims" (I-082423-PSA), 2023-08-24. [ic3.gov](https://www.ic3.gov/PSA/2023/PSA230824) (accessed 2026-10-25)
2. FTC, "What To Know About Cryptocurrency and Scams," May 2022. [consumer.ftc.gov](https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-and-scams) (accessed 2026-10-25)
3. MetaMask Help Center, "I've been hacked or scammed (unauthorized transactions on my account)" (undated). [support.metamask.io](https://support.metamask.io/stay-safe/protect-yourself/ive-been-hacked-scammed-unauthorized-transactions-on-my-account/) (accessed 2026-10-25)
4. MetaMask Help Center, "What to do if you have a sweeper bot on your wallet" (undated). [support.metamask.io](https://support.metamask.io/stay-safe/protect-yourself/fighting-back-against-sweeper-bots/) (accessed 2026-10-25)
5. MetaMask Help Center, "How to migrate your assets to a new wallet" (undated). [support.metamask.io](https://support.metamask.io/manage-crypto/move-crypto/transfer/account-migration-guide/) (accessed 2026-10-25)
6. Flashbots Docs, "Whitehat Hotline" (undated); intake form at [whitehat.flashbots.net](https://whitehat.flashbots.net/). [docs.flashbots.net](https://docs.flashbots.net/whitehat) (accessed 2026-10-25)
7. Phantom Help Center, "I was scammed or my wallet was drained. What can I do?" (undated). [help.phantom.com](https://help.phantom.com/articles/5487893286291) (accessed 2026-10-25)
8. Phantom Help Center, "Report a scam" (undated). [help.phantom.com](https://help.phantom.com/hc/en-us/articles/5488511865619-How-to-report-a-scam) (accessed 2026-10-25)
9. Kraken Support, "My Kraken Wallet has been compromised," last updated 2026-09-15. [support.kraken.com](https://support.kraken.com/articles/my-kraken-wallet-has-been-compromised) (accessed 2026-10-25)
10. Trust Wallet, "Security" (living page). [trustwallet.com](https://trustwallet.com/security) (accessed 2026-10-25)
11. Trust Wallet, "Trust Wallet Browser Extension v2.68 Incident: An Update to Our Community," 2025-12-30, updated 2026-07-17. [trustwallet.com](https://trustwallet.com/blog/company/trust-wallet-browser-extension-v268-incident-community-update) (accessed 2026-10-25)
12. Revoke.cash, "You've Been Scammed, Now What?" (undated). [revoke.cash](https://revoke.cash/learn/security/what-to-do-when-scammed) (accessed 2026-10-25)
13. Revoke.cash, "Seed Phrase Compromise - Why It's Game Over" (undated). [revoke.cash](https://revoke.cash/learn/security/seed-phrase-compromise) (accessed 2026-10-25)
14. Chainabuse Safety Support Center, "I may have been hacked" (undated). [safety.chainabuse.com](https://safety.chainabuse.com/article/i-may-have-been-hacked) (accessed 2026-10-25)
15. Google Account Help, "Secure a hacked or compromised Google Account" (living page). [support.google.com](https://support.google.com/accounts/answer/6294825) (accessed 2026-10-25)
16. Apple Support, "If you think your Apple Account has been compromised," 2025-12-05. [support.apple.com](https://support.apple.com/en-us/102560) (accessed 2026-10-25)

## Changelog

- 2026-10-25: First published.