Unexpected approvals or transfers
Review token approvals, connected applications and transactions you do not recognize. Small unfamiliar transactions can also be relevant.
Unfamiliar prompts
Treat urgent requests to reveal a recovery phrase, install remote-access software or sign an unclear message as high risk.
Account access changes
Unexpected password resets, new devices or disabled security controls may indicate that an associated account is exposed.
Respond safely
Move carefully from a trusted device, preserve evidence before changing account state and use only verified support channels.
Distinguish wallet and account exposure
A self-custody wallet can be exposed through a recovery phrase, private key, malicious approval or unsafe signature. A hosted account may instead be exposed through email access, password reuse, stolen sessions or social engineering. The response depends on which control failed, so identify the account type and avoid treating every unexpected transaction as the same incident.
Review approvals and connected applications
On compatible networks, token approvals can allow a contract to move assets later. Review approvals using a trusted interface and compare unfamiliar contracts with the applications you intentionally used. Revoking an approval is an on-chain transaction and may require a fee. Do not connect the wallet to an unknown “approval checker” sent through an advertisement or direct message.
Watch for secondary targeting
After reporting a loss, victims may receive messages from people claiming to be investigators, support agents or recovery specialists. Treat unexpected contact as unverified. Confirm identities through independently located official channels and never share secret credentials, remote access or an unclear signature. Document these approaches because they may be part of the incident record.