Secure what is left, in the right order
Assume the wallet is compromised until you know how the funds left. Do not keep using it, and do not type your recovery phrase into any website to 'check' it — a compromised wallet can be compromised by anything you interact with.
- Create a fresh wallet using a new recovery phrase, generated offline where possible.
- Revoke outstanding token approvals from the old wallet, then move remaining assets to the new one — approvals first, or the drainer can take what you move.
- Do not send new funds to the old wallet to pay for anything, including 'gas to move funds out'.
- If you also used the same phrase on other wallets, treat those as compromised too.
Work out how it happened
Most wallet thefts happen in one of a few ways: a malicious token approval, a site or app that asked you to enter your phrase, a fake wallet update or browser extension, or a phrase that was stored somewhere it could be found. Knowing which applies tells you whether anything else — email, exchange accounts, identity documents — is also exposed.
Preserve the evidence
- Every outgoing transaction hash from the wallet, with dates and amounts.
- Screenshots of the wallet interface, any dApp you connected to, and the site that prompted the approval.
- The address your funds went to, and any address they moved on to.
- Any messages, emails or offers that led you to interact with the malicious site or contract.
Report it
Report to Action Fraud online or on 0300 123 2040 (Police Scotland in Scotland), and to your bank if the funds originally left a UK bank account to buy the cryptocurrency. If the stolen funds have already moved toward a known exchange, an exchange report quoting the transaction hashes can matter more than anything else — speed here is the difference between a possible freeze and a closed case.
Can a wallet theft be traced?
Yes. Theft from a wallet leaves the same public record as any other transfer, so the funds can be followed to where they went. A trace can show whether they reached an exchange, a bridge or a dormant address, and produces evidence a bank or police report can act on. It cannot reverse the transfer or guarantee an outcome.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- The funds are still in the thief's wallet. Can anything be done?
- A self-custody wallet cannot be frozen, and no one can move funds out of it. What matters is where the funds go next: if they reach an exchange, the exchange can act on a well-evidenced report. Document the position now so it can be acted on later.
- My recovery phrase was stored in a password manager or a photo. Is that safe?
- Digital storage keeps a copy where malware or a synced service can reach it. If the phrase was ever stored digitally and your wallet was drained, treat the phrase as compromised and create a new wallet.
- Should I pay someone who says they can recover it?
- No legitimate investigator needs your recovery phrase or asks for payment in cryptocurrency to 'unlock' funds. Written scope, a fixed price and plain limits are the markers of genuine work.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.
Key terms in this guide
Plain-English definitions from the Wallsec glossary.