← All guides

Guide

Wallet Drained? First 60 Minutes Checklist

What to do immediately after a crypto wallet drain: secure the wallet, document transactions, avoid recovery scams, and prepare evidence for exchanges.

1. Stop the bleeding

Assume the wallet is still compromised until you understand how access was lost.

  • Revoke token approvals at revoke.cash on EVM chains (Ethereum, Base, Arbitrum, BNB).
  • On Solana, review SPL token-account delegates in your wallet or Solscan — not Revoke.cash.
  • Move any remaining assets to a new wallet created on a clean device.
  • Do not reuse seed phrases or store new keys in the same cloud backup.

2. Document before you chase

Exchanges and investigators need hashes, times, and addresses — not screenshots alone.

  • Copy your wallet address and every suspicious transaction hash.
  • Note the approximate time of loss in UTC.
  • List tokens or NFTs that left without your intent.

3. Avoid the second scam

Recovery services that DM you first, ask for a seed phrase, or guarantee refunds are a common follow-on scam targeting victims.

  • Never pay crypto upfront for “recovery.”
  • Never share a seed phrase with anyone claiming to be support.
  • Use only tracefunds.app — not look-alike domains.

4. Build a defensible case file

A structured fund-flow report helps abuse desks review your ticket faster than raw explorer tables.

Tracefunds indexes public chain data into a verification checklist, victim-safe brief, and exchange abuse pack — not recovery promises.

Next step

Ready to index your own wallet or transaction on-chain?

Run an incident report