What to Do If Your NFT Wallet Is Compromised (Step-by-Step Guide)

Realising your NFT wallet may be compromised is stressful — but acting quickly and correctly can limit the damage and stop the same thief coming back. The right response depends on how the wallet was compromised, so this guide starts there.

Dealing with a different problem? The NFT help tool points at the right first steps for the common failure modes.

Last reviewed: September 2026

First: two kinds of compromise, two different responses#

This distinction changes everything that follows:

• Approval compromise (most common). A malicious contract was granted permission to move assets — your keys are still safe. Response: revoke the approvals, disconnect the site, monitor. Your wallet can usually be kept.
• Key compromise (worst case). Your recovery phrase or private key leaked — typed into a fake site, stored where malware could read it, or phished. The attacker is your wallet now. Response: create a brand-new wallet with a new phrase, move what remains, and never use the old wallet again. Revoking approvals is not enough.

If you’re unsure which happened, treat it as key compromise — the safer assumption.

How do you know if your wallet is compromised?#

• NFTs or tokens missing
• Transactions you didn’t approve
• Unexpected approvals granted
• Wallet prompts you don’t recognise
• Assets moving without your action

If something feels wrong, assume compromise and act immediately.

Step 1: Stop all activity immediately#

• Stop interacting with all websites
• Do not sign any new transactions
• Do not try to “fix” things by clicking links
• Disconnect your wallet from all sites in its connected-apps list

Continuing to interact can make things worse.

Step 2: Check and revoke active approvals#

List your approvals on revoke.cash or your chain’s explorer approval checker, and revoke everything you don’t recognise — even if unsure. Revoking can’t recover what’s gone, but it stops a malicious contract taking more.

Step 3: If your keys may be exposed — do NOT send in gas#

This is the classic way beginners lose the rest. Automated sweeper bots watch key-compromised wallets: the moment ETH or tokens arrive for gas, or an NFT transfer is attempted, the bot front-runs it and takes the incoming assets too.

• Do not send gas money to a phrase-compromised wallet to “rescue” NFTs — the bot will likely take it.
• Do not try moving assets out of it expecting to win the race — you’ll usually lose.
• Assume everything left in a phrase-compromised wallet is already lost.

There are white-hat rescue techniques that bundle the rescue in a single private transaction, but they are advanced and not guaranteed — for a beginner the correct move is cutting losses, not attempting a rescue.

Step 4: Create a fresh wallet and move what remains#

• Generate a brand-new wallet — a new recovery phrase, stored offline
• Move remaining assets from the compromised wallet only if the compromise was approval-based (keys still safe)
• Never reuse the compromised wallet or its phrase — treat it as burned

Step 5: Do not chase recovery scams#

After a compromise, scammers appear pretending to help. Never trust recovery DMs, never pay for “asset recovery” services, never share your seed phrase, never install a “fix” tool a stranger links you. Recovery-service solicitations are scams — the only legitimate help is a marketplace’s stolen-item report process (e.g. flagging a stolen NFT so it can’t be resold), and even that rarely returns the asset.

Step 6: Work out how it happened#

Understanding the vector prevents a repeat. Common causes:

• Fake giveaways and airdrops that asked for a signature
• Wallet drainers that harvested an approval
• Fake marketplaces and impersonation scams — see most common NFT scams
• A recovery phrase stored digitally or typed into a fake “wallet verify” page

Can you recover stolen NFTs?#

• Transactions are irreversible — no chargebacks exist on-chain
• Some marketplaces can flag stolen NFTs, which blocks resale there — worth reporting, but recovery is rare

The realistic goal is damage control now, and prevention next time.

What NOT to do#

• Reusing the compromised wallet
• Sending gas to a phrase-compromised wallet (see Step 3)
• Signing “recovery” transactions
• Panicking and rushing decisions
• Ignoring approvals

Prevent it happening again#

• Keep your recovery phrase offline — never typed into any site, chat or form
• Use a separate small-value wallet for new or untrusted sites
• Verify URLs manually; avoid unsolicited links
• Read every wallet prompt before approving
• Review approvals regularly — the NFT security checklist keeps the full routine in one place

So… what should you do right now?#

Stop. Identify whether it was an approval or your keys. Revoke approvals either way. If keys may be exposed, create a fresh wallet and accept that the old one is burned — don’t send it gas, don’t race the sweeper bot. Then learn the pattern and rebuild carefully.

What to read next#

What to read next#

• Lost Access to Your NFT Wallet? Can You Recover Your NFTs?
• NFT Help — What’s Gone Wrong?
• How Fake NFT Giveaways Work (And How to Avoid Them)
• How to Revoke Wallet Permissions Safely (Beginner Guide)
• How to Revoke Smart Contract Approvals (NFT Wallet Guide)
• NFT Security Checklist for Beginners (Protect Your Wallet & NFTs)