Should You Move Remaining Assets After a Wallet Compromise?

After an unauthorized transfer, two reactions are especially risky: doing nothing while waiting for a supposed support agent, or repeatedly signing revocations and transfers on the same possibly compromised device. The correct containment sequence depends on how control was lost.

Preserve a reviewable incident state

Record the affected address, transaction hash, asset, amount, time and explorer URL. Preserve wallet version, connected sites, recently installed apps or extensions, suspicious domains, communications and device anomalies. Never submit a seed phrase, private key, password or security code. Screenshots help communication; original exports and copyable hashes and addresses support verification.

Different mechanisms require different responses

• Seed or private-key compromise: create a new wallet on a clean device and move remaining high-value assets. Do not reuse the old wallet for deposits.
• Malicious approval or permit: preserve the approval record, revoke the allowance and inspect the same wallet on every chain used. Disconnecting a website is not the same as revoking an on-chain allowance.
• Compromised device, extension or wallet: stop signing on that device, isolate it and preserve installation sources, files and timestamps. Handle remaining assets from a trusted environment.
• Induced or mistaken transfer: wallet control may remain intact. Stop additional payments, verify the loss transaction and trace the recipient instead of paying an alleged release fee.

What chain analysis can establish

A transaction signed directly by the wallet, a third-party transferFrom call, approval events and their timing can help distinguish key compromise from allowance use. Chain records alone do not establish who controlled the device and do not replace device forensics.

Action sequence

1. Stop interacting with the suspected entry point.
2. Preserve original evidence and wallet state.
3. Move assets or revoke allowances according to the mechanism.
4. Verify the loss transaction and build the fund path.
5. Secure related exchange accounts and credentials.
6. Organize evidence for the reporting process that applies in your jurisdiction.

Sources: ethereum.org scam support; MetaMask approval revocation guide. Reviewed 2026-08-03.