Signs Your Crypto Wallet Has Been Compromised

Signs your crypto wallet has been compromised include unexpected outgoing transactions you didn't initiate, unfamiliar token approvals granting spending permission to unknown contracts, a sudden drop in balance with no corresponding transaction you recognize, or your wallet connecting to sites and signing requests without your explicit action. Catching these signs early and acting immediately — moving remaining funds to a new, secure wallet — is often the only way to limit further loss, since blockchain transactions cannot be reversed once confirmed.

Direct signs of compromise

Unrecognized outgoing transactions. The clearest sign: funds leaving your wallet to an address you didn't send to and don't recognize. Check your wallet's transaction history and cross-reference against a block explorer for the exact addresses and amounts involved.

Unexpected token approvals. Many DeFi interactions require granting a smart contract permission to spend specific tokens on your behalf. If you see approvals to contracts you never intentionally interacted with, or approvals set to unlimited amounts you didn't authorize, this can indicate either a malicious site tricked you into signing an approval, or your wallet's signing capability has been compromised more broadly. Approval-checking tools can reveal permissions you don't remember granting.

Balance discrepancies with no matching transaction. If your recorded balance doesn't match what you actually see on-chain via a block explorer, or funds appear to have moved without a corresponding transaction visible in your wallet's own interface, this may indicate a compromised or malicious wallet application misrepresenting your actual on-chain state.

Wallet behaving unexpectedly. Unprompted connection requests, transaction signing prompts you didn't initiate, or the wallet app/extension behaving differently than usual (unfamiliar UI elements, unexpected permission requests) can indicate the wallet software itself has been tampered with or replaced by a malicious lookalike.

Indirect signs worth investigating

Sign	What it might indicate
Unfamiliar device login notifications from a linked exchange account	Broader credential compromise beyond just the wallet
Sudden influx of unsolicited "dust" transactions	Possible reconnaissance ahead of a targeted attack, see dusting attacks
Unexpected password reset emails you didn't request	Attacker attempting to gain access to linked accounts
Device running unusually slow or hot	Possible malware presence, see cryptojacking
Clipboard pasting a different address than what you copied	Clipboard hijacking malware actively running

Immediate steps if you suspect compromise

1. Move remaining funds immediately to a new wallet generated on a clean, trusted device, using a freshly created seed phrase — don't wait to investigate further first, since delay only benefits an attacker who may still have access.
2. Revoke suspicious token approvals using a reputable approval-checking tool before or immediately after moving funds, since an open approval can allow continued draining even after you think you've secured the wallet, if any residual funds or future deposits arrive at the same address.
3. Disconnect the wallet from all connected sites and revoke all active sessions where your wallet interface allows it.
4. Scan the device for malware using updated, reputable security software, since the compromise may originate from the device itself rather than the wallet software alone.
5. Change passwords and 2FA for any linked accounts (exchanges, email) that might share any exposure with the compromised wallet.
6. Document everything — transaction hashes, addresses involved, timestamps — both for your own records and in case reporting to relevant platforms or authorities is useful.

Why speed matters more than diagnosis

When facing a suspected compromise, the instinct to fully understand what happened before acting is usually the wrong priority. Because blockchain transactions are irreversible and an attacker with any residual access can act as fast as you can, the single highest-value action is almost always moving remaining funds to safety first, and investigating the root cause afterward with the pressure removed.

Preventing compromise in the first place

Most wallet compromises trace back to one of a small number of root causes: a leaked seed phrase or private key, a malicious approval signed on a phishing site, malware on the device used to access the wallet, or a compromised browser extension. Our comprehensive guide on DeFi wallet security covers the full set of practices — from cold storage to careful approval management — that prevent these root causes from occurring in the first place, which is always preferable to detecting and responding after the fact.

Bottom line

Watch for unrecognized transactions, unexpected token approvals, balance mismatches against the actual on-chain state, and unusual wallet or device behavior as the clearest signs of a compromised wallet. If you spot any of these, move remaining funds to a new, clean wallet immediately before investigating further, since speed matters far more than full diagnosis when an attacker may still have active access.