When keys are exposed.
WHAT TO DO IMMEDIATELY
Move remaining assets to a new wallet, created on a clean device.
WHY IMMEDIATELY
Attackers frequently automate, draining accounts within seconds of exposure.
WHAT NOT TO DO
Continue using the compromised wallet Attempt to recover funds already taken
WHY THE SECOND
Transactions are irreversible, and recovery services are almost always fraudulent.
WHAT RECOVERY SCAMS PROMISE
Retrieving stolen assets, for an upfront fee.
WHAT THEY ARE
A second theft, targeting people already harmed.
WHAT TO DO INSTEAD
Report to the relevant authorities, and accept the loss.
WHAT TO ESTABLISH
How the compromise occurred.
WHAT THE COMMON CAUSES ARE
A recovery phrase entered into a fraudulent site Malware on the device A phrase stored digitally A fraudulent wallet application An approval granted to a malicious application
WHAT TO CHECK IF THE PHRASE WAS NOT EXPOSED
Whether an approval is the cause.
WHAT TO DO ABOUT THAT
Revoke it, and move assets.
WHAT TO REBUILD ON
A device known to be clean.
WHAT TO NEVER REUSE
The compromised phrase, for anything.
