Wallet Drained? The First 24 Hours: What to Do, In Order
Your wallet just drained, or you suspect it’s about to. The next five minutes matter more than the next five days: emergency-response data shows that moving remaining funds fast saves the large majority of what survives, and every hour of delay narrows what’s recoverable. This is the sequence, in strict order, with the mistakes that cost people their recovery windows.
Minutes 0–5: stop the bleeding
1. Do NOT sign anything. Any popup, any “verify your wallet,” any support DM offering help. The attack that drained you may still have live sessions; a second signature is a second drain.
2. Disconnect all dApps. In MetaMask: Settings → Connected sites → disconnect everything. In WalletConnect-based apps: check the wallet’s active sessions list and kill all of them. This severs whatever session the attacker may still be riding.
3. Assess what’s left — read-only. Open a block explorer, paste your address, and list: native token balance, tokens, approvals you remember. No connecting, no interacting.
Minutes 5–30: move what survives
4. Create a fresh wallet on a different device if possible (or at minimum a fresh seed) — this becomes your safe harbor.
5. Transfer remaining assets to the fresh wallet. Native token first (if the drained wallet still has gas), then tokens, in order of value. Critical exceptions:
- If the attack was a key compromise (you entered your seed somewhere, or signed a 7702 delegation), a sweeper bot may sweep anything you deposit back. Send only what you can afford to lose as a test, watch it for two minutes, then proceed — or abandon the address entirely.
- If the attack was approvals-based, transferring is safe: your key is fine, only token allowances are compromised (revoke those next).
Hour 1–2: revoke approvals
6. Revoke token allowances on the compromised wallet — via revoke tools or your wallet’s built-in approvals screen. Revoke everything unfamiliar and every unlimited allowance. Each revocation is an on-chain transaction costing gas — budget gas on the safe wallet if the drained one is empty.
7. Check delegation state. If your address shows a delegated address you don’t recognize, handle it by the 7702 procedure: fund with gas only, revoke via type-0x04, verify Null, then move.
Hours 2–24: re-secure and document
8. Rotate everything connected to the old wallet’s ecosystem: exchange deposit addresses (generate new ones — the old ones are poisoned in your history), any API keys or session keys derived from the wallet, email passwords if the wallet was email-based.
9. Document for reporting. Save: the draining transaction hashes, the attacker’s address(es), your tx history export, screenshots of approvals pre-revocation. This feeds exchange reports (if funds route to a KYC’d exchange, freezes happen) and any law-enforcement filing.
10. Report where it counts. If funds landed on a major exchange, its fraud desk can sometimes freeze tagged deposits — this is the single highest-probability recovery path, and it decays fast: report within hours, not days.
What NOT to do (the recovery-window killers)
| Mistake | Why it costs you |
|---|---|
| Signing a “recovery” transaction from a DM | Second drain — support impersonators hunt drained addresses |
| Googling “recover stolen crypto” and calling the top result | Fake recovery services specifically target fresh victims — see the second-scam economy |
| Depositing fresh funds to test “if it’s safe” | Sweeper bots take it in minutes if keys are compromised |
| Waiting to “see if it resolves” | Sessions don’t resolve; approvals don’t expire; delay only compounds |
| Posting your address publicly asking for help | You flag yourself as a target for follow-up scams |
The 5/1/24 summary
| Window | Actions |
|---|---|
| 5 minutes | Sign nothing; disconnect all sessions; read-only assessment |
| 1 hour | Fresh wallet; move survivors (test-then-move if key compromised); revoke approvals; check delegation |
| 24 hours | Rotate deposit addresses and derived keys; document tx hashes; file exchange/LE reports |
FAQ
Can a drained wallet be recovered? Funds already swept are usually gone. What “recovery” really means is saving the remainder — which the 5-minute actions do, and delay destroys.
Should I contact support of the platform I was drained on? Yes if funds route through them (exchange freeze is the best real path) — but contact them directly through their official site, never through anyone who messaged you first.
My seed phrase was phished — is revoking enough? No. The attacker holds the key: they can re-approve after your revokes and sweep deposits forever. Full migration to a new seed is mandatory — revocation only buys time during the move.
The drainer left a tiny amount — why? Sweeper bots take everything above gas-reserve, or the drain was approvals-scoped. Either way, treat the address as hostile regardless of remaining balance.
How do I prevent this next time? Hardware wallet for storage, clear-signing habits, approval hygiene (monthly revoke audits), and the ten-step security baseline.
Educational content, not financial advice. Last updated October 2026.
