What to do if your crypto wallet was drained
If your crypto wallet has been drained unexpectedly, immediately transfer any remaining balances to a completely fresh wallet created on a clean device. Document the outgoing transaction hashes and report the theft to Action Fraud and your bank.
- You can recognise an unauthorised drain when assets leave your personal wallet without your approval, often appearing as sudden outgoing transactions confirmed on the public ledger while you were offline or interacting with a suspicious site.
- Preceding warning signs often include entering a recovery phrase into a web form, installing an unverified browser extension, or signing an unexpected signature request on a site that promised an airdrop or technical support.
- Assume the compromised wallet and its private keys are permanently unsafe, abandon that address completely, and quickly move any remaining unaffected tokens or assets on other networks to a newly generated wallet.
- Export and preserve full transaction histories, note the exact recipient addresses, and capture screenshots of recent browsing history, signed messages, direct messages, or suspicious web addresses you interacted with prior to the theft.
- Report the incident formally to Action Fraud online to obtain a crime reference number, and alert your bank immediately if any fiat currency was transferred to fund the wallet around the same time.
- An onchain trace can map the flow of stolen funds through intermediate addresses and identify deposits into known centralised services, but it cannot reveal the real-world identity of the thief without law enforcement intervention.
Read next
Written by the Wallsec investigations team. General information only, not legal or financial advice.
Need a case reviewed?
Tell us what happened and we will say honestly whether the onchain data supports a trace.