If a transaction you did not authorize has gone through, or your Secret Recovery Phrase or private key may have been exposed, treat the affected wallet as compromised. Stop signing transactions, create a new wallet using a clean device or browser profile, and move any remaining assets only if it is safe to do so. Do not add gas to an address that may be watched by a sweeper bot. Revoking an approval can help with a contract-permission scam, but it cannot reverse a completed transfer or protect a wallet whose keys have leaked. MetaMask says it cannot reverse transactions or restore missing funds.
First, identify what may have been compromised
“Hacked” can describe several different events, and the right response depends on which one occurred. Check the affected address and network in the relevant block explorer before assuming a transaction is unauthorized. Compare its time, recipient, token, contract, and network with swaps, bridges, deposits, and gas payments you actually made. MetaMask recommends reviewing transaction details in a block explorer.
A suspicious token approval
A deceptive dapp may have persuaded you to approve a contract to move a particular token. This permission is not the same as handing over your Secret Recovery Phrase, but it can allow future transfers of the approved token. Stop using the dapp, inspect approvals for the affected account and network, and revoke suspicious permissions using a genuine approval checker. If you are unsure what you signed, move remaining assets to a fresh wallet as a precaution.
An exposed Secret Recovery Phrase or private key
If you entered your phrase on a website, sent it to someone, or suspect malware accessed it, assume every account derived from that phrase is compromised. Someone with the phrase or private key can control the associated assets. A new MetaMask password, deleting the extension, or reinstalling MetaMask does not invalidate those credentials. Create a wallet with a new phrase and do not import the exposed phrase into it. MetaMask explains how to protect the Secret Recovery Phrase and private keys.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
A suspicious device or browser
A malicious extension, infostealer, remote-access tool, or clipboard monitor may expose credentials or interfere with transactions. If you suspect active malware, disconnect the device from the internet and do not enter a phrase on it. Use a clean device or fresh browser profile for the rescue wallet, then secure related accounts from a trusted device.
A fake support or recovery contact
People who have just lost funds are frequent targets for impersonators. MetaMask says its support representatives will not ask for your Secret Recovery Phrase or private key. Do not install remote-access software at a stranger’s direction, sign a transaction to “verify” or “unlock” funds, or pay an upfront fee for guaranteed recovery. Use MetaMask’s official support site rather than contact details sent by a direct message, social post, or search advertisement. MetaMask’s guidance explains how to recognize its real support channels.
What to do in the first few minutes
- Stop signing. Close suspicious dapp tabs and do not approve, mint, claim, bridge, “cancel,” or verify anything prompted by the suspected attacker. A website’s description of a prompt is not proof that the transaction is harmless.
- Check the activity. Use the appropriate block explorer to inspect transaction hashes, timestamps, recipients, networks, and tokens. Check other accounts and chains you use with the wallet; a phrase compromise can put multiple derived accounts at risk.
- Do not share credentials. Never disclose your phrase or private key to MetaMask Support, an investigator, a recovery service, or anyone else. Do not type it into the device you suspect is compromised.
- Decide whether a rescue transfer is safe. If the phrase may be exposed, create a fresh wallet on a clean device or browser profile. If incoming funds are being swept out automatically, do not add gas or make repeated transfer attempts.
- Preserve incident details. Record public addresses, transaction hashes, network names, times, destination addresses, and relevant dapp URLs or messages. Keep credentials out of reports.
How to move remaining assets to a new wallet
Use a new Secret Recovery Phrase, not a new password for the old wallet. MetaMask’s emergency guidance recommends creating a new wallet, transferring remaining funds, and discontinuing use of the compromised wallet.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
- Choose a clean setup. Use another device or a fresh browser profile that is not carrying suspicious extensions or saved credentials. For a phone, MetaMask notes that a second device may be needed to create a separate instance if you have not backed up the phrase.
- Install only from an official source. Start from MetaMask’s official website or its official app-store listing, and check the domain before installing. If the original wallet was created through a Google or Apple account that may itself be compromised, do not rely on that account for the new setup.
- Create and protect a new phrase. Write it down offline in the correct order. Do not photograph it, email it, paste it into cloud notes, or save it in an ordinary text file. Anyone who gets the phrase can recreate access to the wallet.
- Verify the destination and network. Select the correct network for the asset and check the new address carefully before sending. When time and the threat situation allow, send a small test transfer first. Tokens and NFTs may require separate transactions, and assets held on different chains may need separate rescue transfers.
- Account for gas—but watch for a sweeper. A transfer may require the network’s native currency for fees. If a bot is monitoring the compromised address, any gas you add may be taken immediately. Do not keep funding it in the hope that another attempt will work.
- Stop using the old wallet. After the rescue attempt, do not reconnect it to dapps, accept deposits to its address, or restore the old phrase in a new installation. If the phrase was exposed, treat every account derived from it as unsafe.
MetaMask’s emergency procedure and warnings about transferring remaining assets are at its hacked, scammed, and unauthorized-transaction guidance.
What to do if a sweeper bot is draining the wallet
A sweeper bot monitors a compromised address and automatically moves incoming assets away. This is more consistent with key or phrase exposure than with a single token approval. If a bot is active, adding ETH or another gas token can simply give it more to take.
- Do not make repeated gas deposits or experiment with “bot-busting” scripts from social media.
- Save transaction hashes and other evidence before attempting complicated interventions.
- If substantial assets remain, consider a reputable incident-response professional. No legitimate professional needs your Secret Recovery Phrase or private key.
MetaMask’s sweeper-bot guidance explains this specific risk. Avoid treating any online script or recovery promise as a safe shortcut.
Rank #3
- All your digital assets in one place. You can manage thousands of crypto including Bitcoin, Ethereum, Solana, Tether and more.
- Defend your identity against hackers: secure your online accounts with passwordless, hardware backed, 2FA logins for all your favorite apps and websites.
- Connectivity: USB-C cable connection only. No Bluetooth.Compatible with the Ledger Wallet crypto app, both desktop (Windows, macOS, Linux) and mobile (Android only). Not compatible with iOS.
- Protect your digital assets with the industry's best security: keep your private keys offline in your private signer, battle-tested by the Donjon's white hat hackers, CC EAL 6+ certified Secure Element, constantly updated Ledger OS.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
Should you revoke token approvals?
Revocation is useful when a dangerous contract permission is the problem and the wallet’s keys are still safe. It reduces the contract’s ability to use an approval in the future; it does not undo a transfer that has already completed, recover stolen assets, or secure an address whose phrase or private key is exposed. An approval checker also may not cover every chain or every kind of signature.
| Situation | Revoke approvals? | Create a new wallet? |
|---|---|---|
| Suspicious token approval; phrase and private key appear safe | Yes. Inspect the affected account and network, then revoke suspicious permissions. | Consider it if you are unsure what you signed or want to reduce uncertainty. |
| Secret Recovery Phrase or private key exposed | Not as the main remedy; revocation cannot make the exposed keys safe. | Yes. Create a wallet with a new phrase and migrate what can be safely moved. |
| Unauthorized transfer already confirmed | It may prevent future transfers enabled by an active approval. | Yes if key compromise is possible; revocation will not reverse the confirmed transfer. |
| Funds are being swept automatically | Revocation alone is inadequate, especially if the keys are exposed. | Use a clean setup, but do not fund the watched address without a safe plan. |
Ethereum.org points users to Revoke.cash and the Etherscan Token Approval Checker for inspecting and revoking approvals. Open the genuine site yourself, confirm the network and wallet address, and review each transaction before signing. MetaMask also identifies broad dapp or contract access as a possible attack vector in its incident guidance.
Can MetaMask recover stolen funds?
MetaMask is self-custodial: it does not control your wallet’s keys and says it cannot reverse transactions or restore missing funds. A confirmed blockchain transfer is generally irreversible. Reporting an incident is still worthwhile, but it does not guarantee recovery.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
If stolen assets appear to have reached a centralized exchange, contact that exchange promptly with the transaction hashes and destination details. The exchange may be able to review or freeze funds associated with an identifiable account, but that outcome is not guaranteed. A report to law enforcement or a platform can preserve information and help connect incidents; it does not give MetaMask the ability to take back the funds.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Preserve evidence and report the incident
Keep copies of the facts needed to explain what happened. Do not include your Secret Recovery Phrase, private key, MetaMask password, or full account credentials.
- Public wallet address, transaction hashes, block-explorer links, dates, times, and network names.
- Attacker destination addresses and token contract addresses, if visible.
- Screenshots or saved copies of phishing pages, messages, emails, fake support accounts, and the relevant dapp URL or browser history.
- Any exchange deposit address that appears to have received the funds.
Report through MetaMask’s scam-reporting guidance or its fund-loss investigation page. If you are in the United States, you can also report fraud to the FTC and cybercrime to the FBI’s Internet Crime Complaint Center. Report impersonation to the social platform where it occurred. For substantial loss or identity theft, consider contacting local law enforcement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Secure the device and accounts involved
Do this from a device you trust. If a computer or phone may be compromised, first avoid entering new credentials on it. MetaMask recommends examining browser history and scanning the computer to remove continuing sources of compromise.
- Email and cloud accounts: Change passwords, sign out other sessions, enable multifactor authentication, check recovery email addresses and phone numbers, review app access and email-forwarding rules, and remove unknown devices.
- Exchange accounts: Change the password, revoke unknown API keys, review withdrawal addresses and address books, and enable app-based or hardware-key MFA where available. Contact the exchange immediately if stolen funds arrived there.
- Browser: Remove unfamiliar extensions, review site permissions, and clear suspicious wallet connections. Reinstall the browser or use a clean profile if you cannot rule out compromise; do not restore a profile that may contain malicious extensions or exposed credentials.
- Computer or phone: Update the operating system and browser, run a reputable malware scan, and look for remote-access tools or clipboard-monitoring malware. Consider a full operating-system reset if the compromise is serious or cannot be confidently identified.
Reduce the risk of another incident
Separate wallets by purpose
Keep long-term holdings in a lower-exposure setup, use an everyday wallet for routine activity, and use a separate burner wallet for unfamiliar dapps, mints, airdrops, or testing. This limits how much is exposed when you interact with a risky service; it does not make any wallet immune to mistakes.
Consider a hardware wallet for future custody
A hardware wallet keeps key storage separate from a browser hot wallet and requires physical approval, but it cannot make phishing or malicious signing impossible. Check the device display and understand what you are approving. A hardware wallet is not an instant rescue for an exposed phrase: create a new wallet with new keys and transfer assets to its address. MetaMask lists hardware-wallet integrations, with compatibility depending on the current platform and device: see its FAQ and security information.
Protect the phrase and review every signature
Treat the Secret Recovery Phrase as the root credential for the wallet, not as a password-reset code. A new MetaMask password does not invalidate a phrase that someone else knows. Review transaction details on the wallet prompt or signing device rather than relying on a dapp’s description, and avoid granting broader approvals than you need.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use bookmarks and ignore unsolicited support
Bookmark official wallet, support, and approval-checker sites instead of following links from messages, ads, or social posts. Ethereum.org warns that phishing pages can imitate legitimate services and that fake recovery experts may demand payment. Its scam guidance covers common warning signs.
MetaMask Support will not ask for your Secret Recovery Phrase or private key. Anyone asking for either is asking for control of your wallet.
Quick Recap
Bestseller No. 3Bestseller No. 4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
