Skip to main content
Custody: self vs exchange

Handling Compromised Crypto Wallets

Pomegra Learn

Handling Compromised Crypto Wallets

The moment you suspect your cryptocurrency wallet has been compromised—a transaction you didn't authorize, unexpected balance changes, or malware detection on your device—you enter a high-stakes window where minutes and hours determine whether you recover most of your assets or lose them entirely. Unlike traditional banking, where you can dispute fraudulent transactions within a window of time, cryptocurrency transactions are permanent. Once coins leave your wallet, you have zero recourse from the blockchain itself. Your only option is to move remaining funds to safety before the attacker drains them.

This article walks through recognizing compromise, the immediate response sequence, recovery options, and how to prevent future incidents.

Recognizing Wallet Compromise​

Compromise can be either complete (attacker has your private key) or partial (attacker has temporary access but not the key).

Signs of Complete Compromise​

Your private key is definitely compromised if:

  • Cryptocurrency moves from your wallet without your authorization
  • Recovery phrase shows as invalid when you try to import (attacker changed the password or moved funds to a new wallet)
  • Someone else can access your exchange account and move your funds
  • Malware on your device is confirmed by security software
  • Your hardware wallet requests your PIN but accepts multiple incorrect attempts (indicates firmware tampering)

Complete compromise means: The attacker has your private key or seed phrase. They can empty your wallet at any time.

Signs of Partial Compromise​

Partial compromise (temporary access, not permanent key theft) includes:

  • Suspicious activity on associated email addresses (password reset attempts, account recovery requests)
  • Your phone was stolen or lost and you can't confirm the thief's actions
  • You suspect someone accessed your computer while you were away
  • Your browser extensions are behaving strangely (slow, unusual requests)
  • You've clicked a phishing link but may not have entered sensitive information
  • Sudden changes to your wallet software or hardware wallet firmware

Partial compromise means: The attacker may not have your key yet, but has access to your device or accounts. There's a window of time to secure your assets before they get the key.

Common Compromise Vectors​

Malware and keyloggers: Software malware captures your seed phrase or transaction approvals as you type or interact with wallets.

Phishing and fake websites: Entering your seed phrase or private key on a fake website controlled by attackers.

Hardware wallet tampering: Fake or modified hardware wallets that steal your seed phrase when you generate it.

SIM swap attacks: Attacker gains control of your phone number and uses it to reset passwords and access exchange accounts (see SIM swap attacks).

Clipboard hijacking: Malware replaces a wallet address you copy with an attacker's address, so when you paste it, you send funds to the wrong place.

Browser extension compromise: Malicious or compromised browser extensions (including legitimate ones that were hacked) spy on your wallet interactions.

Physical theft: Someone steals your hardware wallet or notebook with your seed phrase.

Shoulder surfing and social engineering: Someone watches you enter your PIN or passphrase.

Weak passwords or reused passwords: Attackers gain access through password databases and can reset wallet or exchange access.

The Critical First Hour Response​

If you suspect compromise, your immediate actions in the first 60 minutes determine whether you lose 50% of funds or 100% of funds.

Step 1: Confirm Unauthorized Activity (5 minutes)​

Don't panic and don't assume: Verify that the activity is actually unauthorized.

  • Check your transaction history: Is the outgoing transaction in your own transaction records?
  • Verify the amount: Is the balance discrepancy due to a transaction you forgot about?
  • Check exchange records: If using an exchange, verify the transaction in their confirmation emails
  • Cross-check blockchain: Open a block explorer (blockchain.com for Bitcoin, etherscan.io for Ethereum) and enter your public address. Can you see the unconfirmed or recent transaction?

False positives are common:

  • You forgot about a transaction you made days ago
  • Browser shows an old balance (needs refresh)
  • You're looking at a different wallet address
  • Your multisig wallet requires signatures you haven't completed

Confirm this is genuinely unauthorized before proceeding. False alarms cause unnecessary panic and bad decisions.

Step 2: Move Remaining Funds Immediately (10 minutes)​

If you've confirmed unauthorized movement, assume your private key is compromised and move all remaining funds to a new, clean wallet immediately.

For hardware wallet compromise:

  1. Disconnect the compromised wallet
  2. Get a clean hardware wallet (new device) or use a clean software wallet on a clean device
  3. Generate a new seed phrase on the clean wallet
  4. From a web browser or computer you trust, create an outgoing transaction from the compromised wallet to the new wallet address
  5. Sign the transaction (using the compromised hardware wallet if the key isn't stolen, or using an exchange if funds are there)
  6. Broadcast the transaction

For software wallet compromise:

  1. Do not open the software wallet again on the compromised device
  2. If you have a hardware wallet, use it with a new software wallet interface
  3. Move all funds to the hardware wallet or a completely different software wallet on a clean device
  4. Use a public computer (library, coffee shop) if your home computer is infected

For exchange account compromise:

  1. Log in immediately (if you still can) and withdraw all funds to an address you control
  2. If locked out, contact exchange support immediately—many exchanges have 24/7 support for account security issues
  3. They may be able to freeze the account or reverse recent withdrawals (some exchanges can do this within 12–24 hours)

Time is critical: Every minute you delay gives the attacker more time to drain remaining funds. If you have $5,000 in a compromised wallet and $1,000 is left after an unauthorized transaction, moving that $1,000 to safety immediately is more important than understanding exactly what happened.

Step 3: Secure Your Access Points (15 minutes)​

Immediately change passwords and secure accounts that could lead to further compromise:

  • Change email password (use a strong, unique password, enable 2FA if not already enabled)
  • Change exchange account password (if you use an exchange)
  • Change passwords on any service linked to your email (Google, Outlook, iCloud)
  • Enable two-factor authentication on email if not already enabled
  • Check recovery email and phone number on email account—did the attacker add themselves as recovery contact?
  • Disable any recovery options you don't recognize
  • Check connected apps and devices—revoke access for anything suspicious

Step 4: Run Malware Scans (20 minutes)​

If you suspect malware, running scans is important, but it's third priority after confirming compromise and moving funds.

Recommended malware tools:

  • Malwarebytes: Strong malware detection, use in Safe Mode
  • Windows Defender: Built-in, run full scan
  • Kaspersky Rescue Disk: Boot directly from USB, bypasses any resident malware
  • Clean install (nuclear option): If you suspect serious malware, the safest option is to back up important files, wipe the drive, and reinstall the OS

Remember: If malware was already logging your keystrokes, changing passwords from the infected device may not help—the attacker could see the new password. Changing passwords from a clean device or phone is safer.

Step 5: Notify Relevant Services (30 minutes)​

  • Exchange support: If funds were on an exchange, notify them immediately—some can reverse recent withdrawals within hours
  • Hardware wallet manufacturer: If you suspect your hardware wallet was tampered with, notify the manufacturer
  • Bank: If funds eventually left your bank account (in a swap scenario), notify your bank
  • Law enforcement: File a report with the FBI (IC3.gov for cryptocurrency theft) and your local police—required for insurance claims

Recovery and Attribution​

Once immediate danger has passed, investigate what happened.

Tracking Stolen Funds​

Cryptocurrency transactions are permanent on the blockchain, but they're traceable. Many attackers make mistakes:

Following the money:

  1. Use a block explorer to track the outgoing transaction
  2. Follow the attacker's address to see where they sent funds
  3. Many exchanges have KYC requirements—if the attacker deposits to an exchange, law enforcement can potentially recover funds

Common patterns:

  • Mixing/tumbling services (which obscure origins)
  • Immediate conversion to stablecoins or different cryptocurrencies
  • Withdrawal to exchanges (especially international exchanges with less oversight)

Tools for tracking:

  • Blockchain.com or Etherscan: View transaction details
  • Chainalysis or TxnLabs: Commercial tracking tools used by law enforcement
  • CoinJoin or Wasabi Wallet transactions: Indicate the attacker is trying to hide funds

Working with Law Enforcement​

If substantial amounts were stolen (typically $10,000+), consider filing a report with the FBI's Internet Crime Complaint Center (IC3.gov). Law enforcement has limited ability to recover cryptocurrency, but they can:

  • Identify if the attacker is part of a known criminal group
  • Coordinate with exchanges to freeze accounts if the thief tries to cash out
  • Pursue international cooperation if the thief is outside the US

For insurance claims: Many homeowner's and business insurance policies now cover cryptocurrency theft, but they require a police report before paying claims.

Contacting Exchanges​

If the stolen funds are deposited to an exchange:

  • Contact the exchange's abuse team immediately
  • Provide proof you're the original owner (and that the deposit is stolen)
  • Provide the attacker's deposit address
  • Provide the blockchain transaction ID

Some exchanges (Coinbase, Kraken, others) have frozen accounts within 24 hours of being notified of stolen deposits, though success rates vary widely.

Compromise Response Decision Tree​

Recovery Scenarios and Outcomes​

Scenario 1: Partial Compromise, Funds Moved to Safety in Time​

Outcome: Total loss equals the amount stolen before you moved funds (average: 20–40% of holdings if you respond within 30 minutes).

Recovery: Investigate and patch the vulnerability, run malware scans, monitor the attacker's blockchain address for future leads.

Scenario 2: Complete Key Compromise, Funds Moved in Time​

Outcome: Total loss equals amount stolen; remaining funds safe.

Next steps:

  • Revoke the compromised wallet (mark it as no longer in use)
  • Assume all future transactions from that wallet address are not from you
  • Monitor that address to see if the attacker dumps remaining funds later

Scenario 3: Complete Key Compromise, All Funds Drained​

Outcome: Total loss 100% of holdings in that wallet.

Recovery possibilities:

  • Insurance claim: If you have cryptocurrency insurance, file immediately (requires police report)
  • Law enforcement recovery: File IC3 report, hope attacker deposits to regulated exchange
  • Civil suit: If you can identify the attacker, you can sue in civil court (expensive, low success rate)
  • Tax deduction: You can claim theft losses on taxes as casualty losses (see tax treatment)

Realistic expectations: 95% of stolen cryptocurrency is not recovered. The 5% that is recovered usually results from attacker mistakes (depositing to regulated exchange, leaving identifying information) or law enforcement investigation identifying the attacker.

Preventing Future Compromise​

Once you've recovered from compromise, focus on preventing the next incident. Each compromise vector requires different prevention:

Prevention: Malware and Keyloggers​

Reduce risk:

  • Use a dedicated device (old laptop or phone used only for crypto, not for browsing) for wallet interactions
  • Keep OS and software updated with security patches (the #1 prevention for malware)
  • Use a reputable antivirus (Windows Defender is adequate for most users)
  • Avoid downloading software from untrusted sources
  • Use browser security extensions (uBlock Origin, HTTPS Everywhere)
  • Don't use the same browser where you check personal email for crypto transactions (separate browsers = separate attack surface)

Eliminate risk:

  • Air-gap your device (use an offline computer disconnected from internet for signing transactions)
  • Use a hardware wallet that signs transactions in isolation

Prevention: Phishing and Social Engineering​

Reduce risk:

  • Bookmark the correct website and use bookmarks, never type URL from memory
  • Check the URL carefully (blockchain.com vs blockschain.com—slight misspelling)
  • Never click links in emails; always navigate directly to the site
  • Use a password manager (1Password, Bitwarden) so you can't accidentally paste the wrong password
  • Write your seed phrase down; never store digitally where an email could reveal it

Eliminate risk:

  • Treat seed phrase as write-once, offline data—never look at it digitally after backing it up
  • Use hardware wallet—even if you enter the wrong website, you can't phish the hardware device itself

Prevention: Physical Theft​

Reduce risk:

  • Store backups in multiple locations (home safe + bank safe deposit box)
  • Use a steel backup product (The Billfodl, Cryptosteel) rather than paper (resistant to fire, water, theft)
  • Keep hardware wallet in a safe or locked location
  • Don't leave hardware wallet on desk where it could be stolen

Eliminate risk:

  • Use multisig with distributed keys (one key in home safe, one with attorney, one in bank safe deposit)
  • Use a passphrase in addition to seed phrase (two factors for theft)

Prevention: Exchange Account Compromise​

Reduce risk:

  • Use a unique, strong password for each exchange (password manager: Bitwarden, 1Password)
  • Enable 2FA (two-factor authentication) on every exchange account
  • Use authenticator app (Google Authenticator, Authy) instead of SMS 2FA (SMS is vulnerable to SIM swap)
  • Don't keep significant funds on exchanges—use exchange for trading only, move to self-custody regularly

Eliminate risk:

  • Don't use exchanges—convert to self-custody entirely
  • Use multiple exchanges so a breach of one doesn't expose all funds

Prevention: Device Loss or Theft​

Reduce risk:

  • Enable device encryption (Windows BitLocker, macOS FileVault)
  • Enable device lockscreen (password, biometric)
  • Enable remote wipe (Find My Device for Windows, Find My for macOS/iPhone)
  • Don't leave devices unattended in public

Eliminate risk:

  • Air-gap for signing (keep signing device offline, bring online only when signing transactions)
  • Use hardware wallet that requires PIN (ColdCard, Trezor) so thief can't use it without password

Creating an Incident Response Plan​

Write down a plan before you need it:

Compromise Response Plan:

  1. First hour: Verify compromise, move remaining funds to new wallet, change passwords
  2. Second hour: Run malware scans, contact exchange support if applicable
  3. Within 24 hours: File police report (required for insurance), notify insurance company
  4. Within 48 hours: Contact FBI IC3.gov if loss exceeds $10,000
  5. Ongoing: Monitor attacker's address on blockchain, investigate root cause

Prevention: [List your specific vulnerabilities and how you've mitigated them]

Recovery procedures: [Documented steps for how to access cold storage or multisig wallets in an emergency]

Contact list:

  • Exchange support email
  • Insurance company contact
  • FBI IC3: ic3.gov
  • Hardware wallet support: [email/phone]
  • Trusted family member: [contact]

Psychological Response and Next Steps​

Most people who experience cryptocurrency theft go through stages:

  1. Shock: "This can't be happening"
  2. Panic: Desperate attempts to recover funds
  3. Anger: At the attacker, at themselves, at security practices
  4. Acceptance: Recognition that funds are likely lost
  5. Resolution: Decision to either rebuild or quit crypto

This is normal. The best approach is to:

  • Accept the loss quickly (don't waste emotional energy on what can't be recovered)
  • Focus on prevention for the future
  • Share your experience to help others avoid the same mistake
  • If you rebuild, do so with stronger security practices

Key Takeaways​

  • The first hour is critical: Moving remaining funds to safety is more important than investigating what happened
  • Most stolen cryptocurrency is not recovered: Budget for 100% loss, hope for recovery (don't count on it)
  • Prevention is more valuable than recovery: Spending $500 on a hardware wallet and multisig prevents loss better than any recovery attempt
  • Compromise vectors are specific: Different attack types require different prevention approaches
  • Insurance helps: Cryptocurrency insurance costs 0.5–1% annually and covers theft; consider it if holdings exceed $50,000
  • Documentation saves lives: An incident response plan written before compromise occurs leads to better decisions during panic

The best time to prepare for compromise is before you're compromised—write your response plan, set up insurance if appropriate, and implement multi-layered security (hardware wallet, 2FA, backups in multiple locations) so that when attack comes, you're ready.