Recommended Free Tools
Act as if the wallet is unsafe until you know exactly what was exposed. Stop sending money, preserve transaction evidence, contact the exchange or wallet provider through an official channel, and report the incident. If a seed phrase or private key was exposed, create a new wallet on a clean device and move every remaining asset immediately; the old wallet should not be trusted again. Then revoke suspicious token approvals, secure the phone or computer and linked accounts, and ignore anyone promising guaranteed recovery.
What to do in the first 15 minutes
Speed matters for containment, but rushing can destroy evidence or send more funds to a scammer. Work through these actions in order.
As an Amazon Associate I earn from qualifying purchases.
1. Stop every further payment
Do not send an additional “verification,” “tax,” “unlock,” “liquidity,” or “recovery” payment. Fraudsters often claim that one more transfer will release a withdrawal or reverse an earlier loss. The FBI’s Operation Level Up guidance tells victims to stop sending money immediately. A person who contacts you unsolicited and promises guaranteed recovery may be running a second scam.
2. Preserve evidence before closing accounts
Capture the facts while you can still access them. Save screenshots and export records rather than deleting chats or uninstalling applications. The FBI identifies the following transaction details as especially important:
#1 Best Overall
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
- Every wallet address involved, including the address that received the funds.
- The blockchain network used, such as the particular network shown in your wallet.
- Asset type and amount, including the token symbol and denomination.
- Date and time, with your time zone.
- Transaction ID or hash for each transfer.
- Exchange usernames, email addresses, phone numbers, and payment references used by the suspect.
- Suspicious website addresses, dApp names, QR codes, social-media profiles, emails, and messages.
Do not edit screenshots in a way that removes timestamps or URLs. Keep a read-only copy on external storage and another secure backup. Evidence is useful even when a transfer cannot be reversed because investigators, an exchange, or a blockchain-analytics team may be able to identify related activity.
3. Contact the provider through an official channel
Use the support address, in-app help path, or telephone number published on the exchange, wallet maker, or crypto-ATM operator’s official website. Do not use a number supplied by the person who contacted you, a search-ad result you cannot verify, or a social-media “support” account. Ask the provider to flag the account and transactions, preserve records, and explain any available security hold or withdrawal controls. Never disclose a seed phrase, private key, password, one-time code, or remote-access session to support.
4. Report promptly
File a report with the FBI’s Internet Crime Complaint Center at IC3.gov and with your local law-enforcement agency. The FBI says prompt reporting supplies investigative intelligence and may support recovery efforts. Where the conduct is consumer fraud, also report it to the Federal Trade Commission. Include the transaction hashes and the complete timeline rather than only the amount lost.
Identify what was actually compromised
“My wallet was hacked” can describe several different events. Your next move depends on whether an attacker obtained signing authority, access to an account, or only personal information.
| What happened | Risk | Priority response |
|---|---|---|
| Seed phrase or private key was shown, typed into a site, photographed, stored in a cloud note, or sent to another person | Anyone with it can recreate the wallet and sign transactions | Create a new wallet on a clean device and transfer remaining assets immediately; never reuse the exposed phrase |
| A malicious dApp received token approval | The approved smart contract may spend the specified token allowance | Review and revoke suspicious approvals, then investigate whether the signing key itself was exposed |
| Phone or computer was accessed, or malware was installed | Passwords, wallet sessions, clipboard contents, and new signing activity may be exposed | Disconnect the device, update legitimate security software, scan for malware, change passwords from a clean device, and enable MFA |
| An exchange, email, or password-manager account was taken over | An attacker may reset security settings or initiate withdrawals | Use the provider’s account-recovery process, revoke sessions, change the password, and add stronger MFA |
| You only connected a wallet to a suspicious site and did not sign or approve anything | Connection alone does not grant token-spending authority, but the site may still be unsafe | Disconnect it, review approvals and account activity, and avoid returning to the site |
When more than one category applies, follow the seed-phrase/private-key procedure first. Approval revocation cannot repair a compromised signing key.
If your seed phrase or private key leaked
Treat the original wallet as permanently compromised. The Singapore Police Force states: “If your wallet’s seed phrase has been compromised, transfer all remaining assets to a new, uncompromised wallet immediately.” A hardware wallet can reduce future online exposure, but it cannot make an exposed recovery phrase safe again.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of cards, no known remote hacks.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Create the replacement wallet safely
- Use a clean, updated phone or computer. If you suspect malware, do not create the replacement on that device until it has been scanned or replaced.
- Install wallet software or initialize a hardware wallet only from the manufacturer’s official distribution channel or an authorized seller.
- Generate a completely new recovery phrase. Do not select “restore,” import, or recover using the old phrase.
- Write the new phrase on an offline medium and store it where unauthorized people, cameras, cloud-sync folders, and water or fire damage are unlikely to reach it.
- Confirm that you can restore the new wallet using its documented recovery process before moving a large balance. Do not photograph the phrase or paste it into a browser, password field, chat, or support ticket.
Move assets before an attacker moves them
From the clean device, send the remaining assets to addresses controlled by the new wallet. Verify the recipient address and network on the wallet’s own confirmation screen. If the balance is large, send a small test amount first when the network and asset support that approach; confirm receipt before sending the remainder. Keep enough of the network’s native asset to pay transaction fees, but do not leave funds in the exposed wallet longer than necessary.
Some tokens, networks, or collectibles require a specific receiving address format or a separate fee asset. Check the replacement wallet’s documented support before transferring. A transfer to an incompatible network or address can become inaccessible, so do not guess when the wallet displays a network warning.
Never reuse the old phrase
Do not enter the exposed phrase into a “recovery checker,” website, browser extension, form, or message to support. Do not import it into the replacement wallet, even temporarily. Anyone asking for it is asking for control of the wallet, not proof of ownership.
If a malicious dApp or token approval was involved
A token approval is delegated permission for a smart contract to spend a token on your behalf. A deceptive dApp may request an allowance that is much larger than the transaction you intended. The Singapore Police Force advises users to “review and revoke any suspicious token approvals using your wallet interface or a blockchain explorer.” The European Banking Authority also recommends revoking suspicious smart-contract permissions.
Review approvals
- Open the wallet’s security or connected-applications area, or use a reputable blockchain explorer that provides an approvals view for the relevant network.
- Check the contract address, token, allowance amount, and last-used information against what you remember authorizing.
- Disconnect sites you do not recognize. Treat an unfamiliar contract, unlimited allowance, or approval created at the time of the scam as suspicious.
- Revoke the allowance or set it to zero, then wait for the revocation transaction to confirm on the network.
Revoking an approval requires a blockchain transaction and therefore may require a network fee. It prevents that delegated contract from spending under the revoked allowance; it does not undo transfers that already occurred. It also does not protect a wallet whose seed phrase or private key has leaked. In that case, migrate to the new wallet first and review approvals on both the old and new addresses.
Secure the phone, computer, and linked accounts
If a scammer controlled your device or remote-support session, assume that passwords, browser sessions, clipboard contents, and authentication codes may have been observed. Perform account changes from a clean device whenever possible.
Rank #3
- Quality materials: these steel crypto wallets are made of 304 stainless steel with a melting point of over 2500 Fahrenheit degrees, designed and tested to be preservative, fireproof, waterproof, and impact-resistant, and can serve you for a long time
- Products quantity: you will receive a 2-in-1 set of steel bitcoin wallets with matching lock screws, and 1 piece of metal plate marking pen, which is a matching set to help you protect your codes, passwords, and further importantly, your cryptocurrency
- Functions: with these steel crypto wallets you can record information such as fieldworks passphrase in tandem with the BIP39 word list, and they are also compatible with 12 or 24-word seed in most languages, suitable to store your private cryptocurrency information or for many instances where you may need a private cold storage system
- Suitable size: the cold wallet backups are compatible with BIP39 wallets, can work with most hardware wallets, supports up to 24 mnemonics seed phrases, convenient for you to use in coordination with other crypto seed storage devices and wallets
- Multiple ways of locking: you can use the matching screws to lock up the steel bitcoin wallets; You can also lock them up and hide them in other places if you still feel unsafe; The hole on the bitcoin wallet measures 6 mm/ 0.24 inch in diameter, suitable for hanging
Clean up the device
- Disconnect suspected remote-access software and remove applications you did not install intentionally.
- Install pending operating-system and browser updates.
- Update legitimate security software and run a full malware scan. Follow the software’s removal or quarantine instructions for anything detected.
- If you cannot establish that the device is clean, back up personal files without copying suspicious programs and perform a documented factory reset or seek qualified technical help.
- Encrypt the computer, phone, removable drives, and sensitive files. Keep a secure external or vetted cloud backup that is not continuously mounted to the device.
Reset accounts in the right order
- Change the email account password first, because email controls password resets for many other services.
- Change the exchange, wallet-service, password-manager, and cloud-storage passwords from the clean device. Use a unique password for every service.
- Sign out of other sessions and remove unfamiliar devices, API keys, withdrawal addresses, and connected applications.
- Enable multifactor authentication. An authenticator app or hardware security key is preferable to relying only on text messages when the service supports it. The Federal Trade Commission lists hardware tokens as an MFA method.
- Replace recovery codes that may have been viewed and store the new codes offline.
Do not save the new wallet recovery phrase in the same password manager, email account, or cloud folder that an attacker may have accessed. A password manager can protect account passwords, but it is not a substitute for offline control of a wallet seed phrase.
Move funds without creating a second loss
Emergency transfers create opportunities for address mistakes and impersonation. Use a deliberate checklist for every transaction.
- Confirm the asset and network match on both the sending and receiving wallets.
- Copy the receiving address only from the new wallet, then compare the first and last characters on the device’s confirmation screen. Malware can replace copied addresses.
- Ignore any message instructing you to move funds to a “safe” or “official” wallet. You choose the destination; no legitimate investigator needs you to transfer money for protection.
- Keep the transaction hash for each migration transfer with the incident timeline.
- After confirmation, check the new wallet through its own interface or a reputable explorer rather than through a link sent by a stranger.
If an attacker is actively draining the old wallet, prioritize assets that can be moved with the available fee balance. Do not borrow or send additional money to a person who claims a special “unlock” transaction is required.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose a safer storage setup for the future
The Singapore Police Force advises storing cryptocurrency in hardware wallets where possible because they are less vulnerable to online attacks. A hardware wallet is not automatically safe: a stolen recovery phrase, malicious initialization, fraudulent firmware, or a deceptive transaction prompt can still compromise funds.
| Decision factor | Questions to ask | Why it matters |
|---|---|---|
| Supported networks and assets | Does the device support every chain, token, and collectible you actually use, without unofficial workarounds? | An unsupported asset may force you back to a riskier software wallet or an unverified tool. |
| Transaction-screening clarity | Can the device clearly display the destination, network, amount, and contract action before you approve? | Readable on-device details help catch a deceptive dApp request or address substitution. |
| Recovery and backup design | What is the documented restore process, and can you keep the recovery phrase entirely offline? | You need a tested way to recover without exposing the phrase to a website or support agent. |
| Update process | How are firmware and app updates authenticated, delivered, and documented? | Predictable, verifiable updates reduce the chance of installing a counterfeit or tampered package. |
| Independent security documentation | Does the manufacturer publish clear technical documentation and vulnerability-response practices? | Transparent documentation lets you evaluate limitations instead of relying on marketing claims. |
| Physical supply-chain trust | Can you buy from the manufacturer or an authorized seller, inspect packaging, and initialize the device yourself? | A second-hand or pre-initialized device may come with a recovery phrase known to someone else. |
| Compatibility with your workflow | Will it work with the exchanges and dApps you use through documented integrations? | Compatibility reduces pressure to approve unknown browser extensions or copy keys into another service. |
Initialize and back up correctly
Buy from the manufacturer or an authorized seller. Initialize the device yourself, verify that it generates a new phrase, and reject any device or package that arrives with a printed or preselected phrase. Keep the phrase offline and private. Test recovery with the vendor’s documented procedure before committing a large balance, and keep a second physical backup only if you can secure it against unauthorized access and environmental damage.
What recovery is realistically possible?
Cryptocurrency payments generally do not have the same legal protections as credit- and debit-card payments. The Federal Trade Commission warns that “Cryptocurrency payments don’t have the same legal protections as credit and debit cards, so it can be hard to get your money back.” A provider may be able to freeze an account or identify related activity, but no government agency guarantees reimbursement for a compromised wallet.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Reporting is still worthwhile. Include complete addresses, hashes, timestamps, asset details, screenshots, and the communications that led to the transfer. Do not alter the original files. Investigators and providers need precise identifiers to distinguish your transaction from other activity.
Be especially cautious after filing a report. The FBI’s IC3 guidance dated August 24, 2023, says: “Be wary of anyone claiming they can recover your funds as this may be another scam.” A real investigator or provider will not require your seed phrase, ask you to transfer funds to a “safe” wallet, or demand an advance fee for guaranteed recovery.
Recognize and block follow-on scams
Victims are often targeted again because the first scam disclosed the amount lost, the wallet address, or the victim’s willingness to seek help. Treat every unsolicited contact as untrusted, even if the sender knows your transaction hash.
- Ignore direct messages claiming to be wallet support, law enforcement, a blockchain investigator, or a recovery specialist.
- Never share a seed phrase, private key, password, one-time code, recovery code, or screen-control session.
- Do not install a browser extension or remote-access program at someone else’s instruction.
- Do not pay a percentage, tax, retainer, gas deposit, or “authentication” fee to unlock or recover funds.
- Verify support through the provider’s official website or in-app help center, not through a link in a message.
- Block and report impersonator accounts, preserving their messages and payment instructions as evidence.
Long-term wallet security checklist
Once the emergency is contained, use this checklist before returning to normal activity:
- The replacement wallet has a newly generated phrase that has never been typed into an internet-connected device.
- All remaining assets have left the exposed wallet, and migration hashes are recorded.
- Suspicious approvals and connected applications have been reviewed on every affected network.
- The phone or computer is updated, scanned, and free of unauthorized remote-access tools.
- Email, exchange, cloud-storage, and password-manager passwords are unique and have been changed from a clean device.
- MFA is enabled, recovery codes are replaced, and unfamiliar sessions or API keys are removed.
- Backups are encrypted and stored securely, with at least one copy unavailable to a continuously connected device.
- Future transactions will be checked on the wallet’s own screen, including network, recipient, amount, and contract action.
- You know the official support route for each service you use and will not rely on unsolicited accounts.
The core rule is simple: a leaked recovery phrase ends the life of that wallet. Move what remains to a newly created wallet, remove delegated permissions, harden every device and account that could expose the replacement, and report the theft with complete evidence. Never compound the loss by paying a stranger who promises certainty.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
