Wallet compromised: what to do
The instinct to connect to the first 'security check' site you find is exactly how a second drainer gets you. Here's the order of operations: triage, revoke or rotate, then close the door for next time.
Scan your wallet: free Watch 24/7 on Telegram
Public address only. No wallet connection. Nothing to sign.
Don't panic-connect
Searching for a fix and connecting your wallet to the first site that promises to help is a well-known trap in itself. Everything you need to triage a suspected compromise can be checked with only your public address, nothing to sign, no wallet connection required, no risk of making things worse while you figure out what happened.
Triage: an approval, or your seed phrase?
These call for different responses. If the loss traces to a token you approved, an unlimited allowance or a signed Permit, the damage is confined to that approval; the rest of the wallet is fine. If your seed phrase or private key was exposed instead, no approval was even needed: whoever has it can move anything in that wallet at any time, and no revoke changes that.
Revoke, or rotate to a fresh wallet
Approval compromise: scan your address for every remaining live approval and revoke the risky ones on revoke.cash, starting with unlimited allowances to unverified or flagged spenders. Seed compromise: revoking buys no safety here, move every remaining asset to a brand-new wallet with a fresh seed phrase generated on a device you trust, then stop using the old address entirely.
Post-mortem: close the door for next time
Once you're safe, reconstruct what you signed, on which site, and at what moment, that's how 'it looked official' scams get identified and reported. Then replace the one-time check with ongoing monitoring on the new address, so the next risky approval or flagged spender gets caught on the way in, not after.
FAQ
Can someone drain my wallet knowing only my address?
No: a public address is read-only. Draining requires a signature, approval, or your private key/seed from you at some point. That's exactly why checking with just an address is safe.
I already revoked everything, am I safe now?
Only if an approval was the cause. If your seed phrase or private key leaked, revoking approvals doesn't help, anything left in that wallet is still reachable, so move it to a fresh wallet instead.