DeFi Market
If your wallet was drained, whether to revoke or move depends on how the thief got in. If your seed phrase or private key was exposed, move everything left to a brand-new wallet now; revoking won't help, because the thief holds the key itself. If one token went through an approval or signature you clicked, revoke it, but move your most valuable coins first. If gas money vanishes the moment it lands, a sweeper bot is on the wallet: stop sending gas. Then check every chain you've used, and only open revoke tools from your own bookmark.
Wallet drained: revoke or move? The decision tree
Two kinds of break-in empty wallets, and they need opposite fixes. In one, the thief has your keys: the seed phrase or a private key. In the other, you handed a contract permission to spend a token, usually by clicking "Approve" or signing a message on a fake site. Revoking cancels a permission. It does nothing about stolen keys.
Answer these in order. Stop at the first yes.
This happens to a lot of ordinary holders. Chainalysis reported well over 100,000 personal wallet compromises in 2025 and put Solana, not Ethereum, at the top for incidents. The FBI's 2025 Internet Crime Report logged 181,565 complaints involving crypto last year, with $11.4 billion in reported losses across every kind of crypto crime.
Revoke or move: the quick table
| What happened | Revoke? | Move to a new wallet? | Do first |
|---|---|---|---|
| You typed your seed phrase into a site, app or chat | Pointless | Yes, everything, now | Move the most valuable asset first |
| Your main coin (ETH, SOL, BNB) is gone | Won't stop it | Yes | Treat the key as stolen, even if you don't know how |
| Gas disappears seconds after it arrives | Won't stop it | Yes, whatever you can | Stop sending gas |
| One token taken after you clicked "Approve" | Yes, that approval and any you don't recognize | Yes for high-value tokens, first | Move valuables, then revoke |
| You signed a "Permit" or a message you didn't understand | Yes, but it may not cancel the signature | Yes for that token | Move the token named in the signature |
| An NFT collection taken after "approval for all" | Yes, for that collection | Yes for other valuable NFTs | Revoke the operator |
| Nothing gone yet, but you connected to a fake site | Yes, anything granted that day | Only if you signed or typed anything | Check every chain |
When to move: the seed phrase or key is out
Your seed phrase is the master copy of every address in the wallet. Anyone holding it can rebuild your wallet on their own phone and sign anything as you. An approval checker shows permissions you gave to contracts. It can't show, or cancel, a copy of your key.
The tell is the native coin. Token approvals cover tokens and NFTs; they can't pull out the chain's own coin. So if your ETH, SOL or BNB left too, someone probably signed as you. The exception is a transaction you remember confirming that sent the coin out yourself. Otherwise assume the key is gone, even if you can't think how it leaked.
Moving means a new wallet with a new seed phrase, made on a device you trust. Tapping "add account" in the same app doesn't count: that makes another address from the same stolen seed. Our seed phrase compromised guide covers the first hour step by step, and how phrases leak in the first place.
When to revoke: a bad approval or signature
If one token disappeared and your main coin is still there, you probably granted a permission. The FBI described the pattern in a July 2022 alert on a fake "liquidity mining" scheme: a pop-up made to look like the wallet listed permissions, and by accepting them, victims "unknowingly authorize scammers to pull an unlimited amount of funds out of their cryptocurrency wallets." That one scheme had taken more than $70 million since 2019. The FBI's advice in the same alert: periodically use a token allowance checker to see what you've allowed.
Revoking sets that allowance back to zero. It's one small transaction per approval, per chain. Our guide to checking and revoking token approvals walks through the tools and the costs.
So why move valuables first? Three reasons.
- Revoking is slow, and drainers are fast. You might have a dozen approvals across several chains, each needing its own transaction. Moving one valuable token is a single send.
- A signed Permit can outlive your revoke. A Permit is a signed message, not a transaction. Under the EIP-2612 standard, it carries a nonce and a deadline, and it can be submitted any time before that deadline, which can be set so far ahead it never expires. If the drainer hasn't used your signature yet, revoking today doesn't stop them submitting it tomorrow. A token that's no longer in the wallet can't be taken.
- You may not know what you signed. Drainer pop-ups are written to look routine. If you can't say for sure what a signature did, treat the wallet as compromised for that token.
⚠ Red flag
Fake revoke sites are a real thing. When we checked the search results for "wallet drained, revoke or move" on 19 October, one of the top pages offering "wallet safety" help sat on a throwaway trycloudflare.com address. A real revoke only sets an allowance to zero. It never asks for your seed phrase, never asks you to send tokens, and never needs a "verification" signature. Open the tool from a bookmark you saved before any of this happened.
When to stop: the sweeper bot
If your tokens are still in the wallet but every bit of gas you send disappears within seconds, a sweeper bot holds your key. It watches the address nonstop and empties anything that arrives. Each top-up you send is a gift to the thief. Stop.
On Ethereum this got easier for thieves after the May 2025 Pectra upgrade, which lets an address delegate to contract code. Researchers at the trading firm Wintermute found most of those early delegations pointed to the same copy-pasted sweeper code, attached to wallets whose keys had already leaked, CoinDesk reported in June 2025. The fix is the same as for any leaked key: abandon the wallet.
Getting stuck assets past a bot takes one private transaction that pays the gas and moves the asset together. That's a job for an experienced person you already know. It's never a job for a stranger who replied to your post.
Prefer to watch? How fake wallet support drains wallets, in under a minute.
Read the video transcript
Crypto wallet support scams find you in minutes. Researchers posted fake wallet-help messages and drew in more than nine thousand scammers, who usually replied within fifteen minutes. Here's how the fake help desk works. One: you post that your wallet has a problem, or you search for a support number. Two: support replies, slides into your DMs, or shows up as a sponsored ad. Three: they move you to Telegram, email, or a phone call. Four: they send a form to validate or sync your wallet. Five: the form wants your twelve recovery words. Type them, and your wallet is theirs. Real wallet support never asks for your recovery phrase. Ever. So ask them one question. Will this need my recovery phrase? Then close the chat and open a ticket from inside the app yourself. What did your fake support message say? Comment below, and hit like and subscribe.
Check every chain, not just the one that got hit
Approvals live on one chain each. An allowance you granted on Base doesn't show up when your checker is set to Ethereum, and the same address can hold approvals on a dozen networks. Switch networks and look again on every one you've touched, including the layer-2s you used once for a cheap swap.
A stolen seed phrase is worse: it opens every chain at once, plus every other coin the same phrase controls. That's why the move branch means moving everything, on every network, and not only the chain where you noticed the theft. Solana and other non-Ethereum chains handle permissions differently, so check those with a tool built for that chain.
The order that loses the least
- Decide which branch you're on. Use the tree above. If in doubt, move.
- Make the new wallet somewhere clean. A fresh install from the maker's own site, or a new hardware wallet bought from the maker. Write the new phrase on paper.
- Move the most valuable asset first. If a thief or a pending signature is waiting, you may get only one or two transactions in.
- Move the rest, chain by chain. Then stop using the old address. Update anything that pays into it.
- Revoke on the old wallet if you're on the approval branch. Every chain, from a bookmarked tool.
- Save the evidence. Your old address, the addresses the funds went to, transaction IDs, dates, and screenshots of the site or message that started it.
- Report it. File at ic3.gov, typed in by hand. If the funds reached an exchange, tell that exchange too. Our guide on how to report a crypto scam lists what to include, and the first 24 hours plan covers the rest of the day.
Then expect the follow-up. In a July 2026 alert, the FBI warned that impersonators posing as FBI staff are contacting victims and offering to recover funds. It says IC3 doesn't maintain a social media presence and doesn't recover funds through Facebook, Telegram or similar platforms. Read how crypto recovery scams work before you answer anyone. Not sure whether the site that got you was a scam? Our is this a scam? quiz takes a minute, and the Scams hub has every guide in one place.
Rob's take
I've held Bitcoin since 2011, and the mistake I see after a drain is people spending their first hour revoking. Revoking feels like doing something, because there's a list and a button. But if the key is out, that list is beside the point, and the thief isn't waiting for you to finish. Move first. Tidy up later. And keep the savings in a wallet that never signs anything, so the next bad click can only reach your spending money.
Want the token checks on one page? Get our free Check a Token in 10 Minutes checklist when you join the Sunday Briefing.
Wallet drained FAQ
Should I revoke approvals or move to a new wallet?
It depends on how the wallet was drained. If your seed phrase or private key was exposed, or your main coin was taken, move everything to a new wallet with a new seed; revoking won't help. If one token went through an approval you clicked, revoke it, and move your most valuable assets first.
Does revoking approvals stop a hacker?
Only if the hacker is using an approval. Revoking cancels permissions you gave to contracts. It can't stop someone who has your seed phrase or private key, because they can sign transactions as you.
How do I know if my seed phrase was compromised?
The strongest sign is that your main coin, such as ETH or SOL, was taken, because token approvals can't move it. Gas that vanishes seconds after you send it is another. If you ever typed the phrase into a site, app or chat, assume it's compromised.
Why does my gas disappear when I send it to my wallet?
A sweeper bot holds your key and sends out anything that arrives, usually within seconds. Stop sending gas, because every top-up goes to the thief. Move anything you still can and abandon the wallet.
Can a signature I already gave still be used after I revoke?
Yes, in some cases. A Permit signature can be submitted any time before its deadline, so a drainer holding an unused one can set the allowance again after you revoke. Moving the token out of the wallet is the only sure fix.
Can I trust a revoke site after my wallet was drained?
Only the real one, opened from your own bookmark. Fake revoke and "wallet rescue" sites exist, and they turn up in search results. A real revoke only sets an allowance to zero and never asks for your seed phrase or for you to send tokens.
Want to stop the next drain before it starts? Our free course Scam-Proof in 7 Days walks you through the checks one short lesson at a time.