Crypto Wallet Drained? What to Do in 24 Hours

Move remaining assets to a completely new wallet on a clean device. Revoke suspicious approvals, then secure exposed backup material. You open your wallet app and the balance is wrong. Or gone. The next 24 hours matter more than anything you do after them.

This guide gives you a calm, ordered path through the immediate decisions: what to secure first, how to understand what likely happened, and what controls actually reduce the risk going forward. It does not promise recovery. On-chain transactions are final. But acting clearly in the first hours can protect whatever is left.

Understand the Threat Model

• Self-custody means you control the private keys. Transactions are signed locally and broadcast to the blockchain. No bank can freeze them. No exchange can reverse them. That control is the point, but it also means there is no support ticket to file. A crypto wallet can be compromised through several distinct paths, and they require different responses. Mixing them up wastes time.

   

• Phishing is the most common path. Fake websites, spoofed wallet apps, and fraudulent support accounts trick users into entering a seed phrase or approving a malicious transaction. These are surprisingly effective because they look legitimate.

   

• Malware on the device can intercept clipboard data, monitor for private-key files, or redirect transactions before they are signed.

   

• Malicious approvals are a subtler mechanism. A user connects a wallet to a decentralized application and signs an approval transaction that grants a contract permission to move tokens. The drain happens later, sometimes days after the original interaction.

   

• Seed-phrase exposure is the most severe path. A seed phrase is typically a 12- or 24-word backup that can regenerate wallet keys on any compatible wallet. Anyone who has it controls the funds. A 2025 CHI Conference study found that only 43.4% of surveyed crypto users could correctly identify what a seed phrase is, which means most people don't fully understand what they're protecting.

   

• Physical access and supply-chain risks round out the picture. A device that has been tampered with before purchase, or a backup written on paper stored somewhere accessible, can expose keys without any online interaction at all.

The vault estimates that 2.3 to 3.7 million Bitcoin were permanently inaccessible as of early 2025, much of it because of forgotten passwords and lost seed phrases. The risk of losing access to your own wallet is real alongside the risk of someone else taking it.

How the Attack Path Works

Understanding the mechanics helps you identify which path applies to your situation.

A hardware wallet generates and stores private keys offline. When you sign a transaction, the signing happens inside the device. The private key never touches the internet-connected companion device. Only the signed transaction is returned and broadcast. That architecture is strong against malware and remote key theft.

But it does not protect against everything.

• Malicious approvals bypass key theft entirely. An ERC-20 approval gives a contract permission to transfer tokens from your wallet up to a specified amount, including unlimited allowances. If you signed such an approval on a fake NFT mint site, a compromised Discord announcement, a phishing post on X, a fake airdrop claim, or a typosquatted dApp URL, the attacker does not need your private key. They already have permission to move your tokens. The drain executes through a function you already authorized.

   

• Permit2 is one mechanism that makes this worse. It is an off-chain approval mechanism that can be abused when a user signs a deceptive request without realizing what they are authorizing.

   

• Seed-phrase compromise works differently. An attacker who has obtained your seed phrase can import the wallet on any compatible device and control every address derived from that seed. There is no transaction to revoke. Every asset across every address is accessible.

Here's how to distinguish the two in practice: if you see an unfamiliar approve() or setApprovalForAll() transaction in your history, the likely path is a malicious approval. If funds moved from multiple addresses simultaneously or from addresses you had not recently used, seed-phrase compromise is more likely.

If the wallet is held at an exchange rather than in self-custody, the risk profile is different again. An exchange account compromise involves the exchange's systems, not a blockchain private key. Contact the exchange immediately. An exchange may be able to freeze its own accounts. An on-chain transfer cannot be reversed.

Controls That Reduce Exposure

Act in this order. Speed matters for protecting remaining assets. Investigation comes second.

First: move remaining assets. If you believe a wallet is compromised, transfer any remaining funds to a completely new wallet on a clean device. Do not reuse the same seed phrase. Do not transfer to a different address derived from the same seed. A new wallet means a new key generated from scratch.

Second: revoke active approvals. Tools like Revoke.cash show which contracts have permission to spend which tokens from a given address, and for how much. Prioritize unlimited approvals first, then large fixed allowances, then old approvals for protocols you no longer use. Revoking an approval on a compromised address does not recover what was already taken, but it stops further transfers authorized by that approval.

Third: assess the device. If malware or remote access is suspected, change passwords for linked accounts from a different, unaffected device. Do not create a new wallet on a device you believe is compromised. Use a clean device or perform a full reset before generating new keys.

Fourth: secure your backup. If your seed phrase is stored digitally, in a photo, in a notes app, in email, or in cloud storage, that storage is now part of your threat surface. Cold-storage best practice is to keep backups in at least two physically separate locations on durable media, and to test recovery before storing large amounts.

Fifth: separate funds by purpose going forward. Keep a small spending balance in a hot wallet for active use. Keep long-term holdings in cold storage. A hot-wallet compromise should not reach your savings.

These steps do not remove all risk. They reduce the exposure surface and stop an active drain from continuing.

Limits and Trade-offs

Self-custody removes exchange counterparty risk but shifts full responsibility to the user. Loss of the private key or seed phrase has no recovery process. That asymmetry is permanent.

A hardware wallet keeps private keys off internet-connected devices. That is a meaningful protection against remote key theft and malware. It is not protection against a malicious approval you signed yourself, even if you signed it using the hardware wallet. The approval is valid because you authorized it. The contract does not need the key.

Seed phrases offer interoperability: you can import a seed-phrase-based wallet into any compatible wallet application. The trade-off is that the phrase itself becomes a target. Write it down and it can be found. Store it digitally and it can be stolen. A seedless multi-card model removes the phrase as an attack surface but introduces a different dependency: recovery depends on retaining at least one physical card in that ecosystem.

One more thing. In the first 24 hours after a suspected drain, unsolicited recovery services may appear. In comments, in DMs, in emails. They are scams targeting victims. No legitimate service can reverse a confirmed on-chain transaction. Never share a seed phrase or private key with anyone offering recovery or support. Possession of that material controls the wallet.

When assets may be actively at risk or a device appears compromised, seek help from trusted, independently verified sources. Not from anyone who contacts you first.

How Tangem's Design Reduces Specific Attack Vectors

Tangem Cold Wallet addresses several of the paths above through specific design choices, not blanket guarantees.

The card has no screen, USB port, battery, or Bluetooth connection. Its secure element and NFC antenna are sealed into the card. It connects to the Tangem mobile app via NFC only, with a stated operating range of 0 to 5 cm. Physical possession and proximity are required for every transaction. Remote signing is not possible.

The private key is generated inside the Samsung S3D350A secure element, which carries Common Criteria EAL6+ certification. Tangem states that the private key never leaves the secure element and that cryptographic signing occurs on-chip. The NFC channel uses AES-256 encryption. Firmware is factory-installed and cannot be updated by users, which removes the remote firmware-update exploit path.

The default setup is seedless: backup cards receive encrypted private-key material, so no recovery phrase is written down or stored. This removes the seed phrase as an attack surface entirely. Users may instead import a 12- or 24-word phrase if they prefer interoperability with other wallets.

The app performs a cryptographic authenticity check before operations to verify the card and its firmware. Tangem lists Kudelski Security (2018), Riscure (2023), and Cure53 (2026) as independent auditors.

Here's what these choices do not prevent: phishing, malicious approvals, user error, and physical loss. A malicious approval signed through a Tangem card is still a valid approval. Starting with app version 5.27, Tangem WalletConnect includes Blockaid-powered transaction simulation that presents a human-readable preview and detects hidden operations before signing. That helps with the approval problem, but it does not eliminate it.

If every backup card is lost and no seed phrase was created, the funds are permanently inaccessible. Tangem cannot recover them. That is the trade-off for removing the seed phrase as an attack surface. No hardware wallet is unhackable. Tangem's design reduces specific, well-defined attack vectors. Understanding which ones matters more than any blanket claim.