Wallet drained? What to do in the first 24 hours

MetaMask's advice is to immediately stop using every account tied to the compromised Secret Recovery Phrase, and not to create new accounts under it, because they will be compromised too. Create a brand-new wallet with a new recovery phrase, ideally in a different browser profile or on a different device, in case malware was the cause.

Attackers often leave a sweeper bot watching a compromised address. It moves anything that arrives, faster than you can, so sending ETH or TRX to pay gas for a rescue usually just hands the attacker more money.

MetaMask suggests sending any remaining funds from the compromised account to the new one. If a sweeper is active this may fail, and bundled rescue transactions (for example through Flashbots) are technical and come with their own fees. Don't let anyone talk you into sharing your keys so they can “rescue” funds for you.

If the drain came from approving a malicious contract, often after connecting to a fake airdrop, mint or support site, the contract may still be able to pull those tokens. Revoking the approval stops that. Use a known tool such as Revoke.cash by typing the address yourself; scammers run lookalike sites.

If your seed phrase itself was exposed, revoking isn't enough: whoever has it controls the wallet. Treat the wallet as permanently lost and move to a new one.

Write down what happened while it's fresh, and keep:

• —every transaction hash (TXID) and the addresses involved;
• —dates and times, with your time zone;
• —which blockchain and token each loss was on;
• —screenshots of conversations, websites, apps and any messages from the scammer;
• —website addresses you visited or connected your wallet to.

Don't delete chats or uninstall apps yet; they may be needed later. You never need to share your seed phrase with anyone investigating.

Report to your local police and the national service: the IC3 and ReportFraud.ftc.gov in the US, or Report Fraud in England, Wales and Northern Ireland. If the funds went to an exchange, report it to that exchange's support with the transaction hashes. Our reporting guide explains what to include so the report can be acted on.

After a public loss, people will offer to get your money back. The IC3 says it will never contact you directly for information or money, and that it does not work with law firms or crypto services to recover funds. Anyone who contacts you first offering recovery is a red flag.

No. MetaMask states that transactions cannot be reversed, and self-custody wallet providers can't step in to rescue an account. What can sometimes happen is that funds are frozen where they land, at an exchange or as a stablecoin like USDT, after law enforcement or a court acts on clear evidence.