Is My Wallet Compromised? 12 Warning Signs and the 10-Minute Test
How to tell whether your crypto wallet has been compromised: the 12 warning signs, the free 10-minute self-audit, what drainers and approval exploits look like on-chain, and the exact order to act in if the answer is yes.
Zero Balance. No Sent Transaction. That Is Not a Glitch.
The one on-chain pattern that means your wallet was drained by a signature, not a transfer.
What this guide says in 5 lines
- A drained wallet usually shows a *token approval* misuse, not an outgoing transfer from you.
- An address with funds leaving that you never signed means the key material is compromised.
- A partial drain of one token only is more often an approval exploit than a stolen seed phrase.
- Check token approvals on every chain you have used — a sign you forgot from a year ago still works.
- If the answer is yes, the order is: new wallet, move remaining assets, revoke approvals, abandon the old address.
Most people answer this question with a feeling. That is not good enough, because the difference between "my wallet was drained" and "someone has a copy of my seed phrase and is waiting" changes what you must do in the next ten minutes. This guide replaces the feeling with a checklist: twelve observable signals, a self-audit that takes about ten minutes and costs nothing, and the three on-chain patterns that identify which of the two situations you are actually in.
The three ways a wallet actually gets compromised
The mechanisms are few, which is good news — once you know which one applies to you, the correct response is unambiguous. They are regularly confused with each other, and the confusion is expensive.
The important distinction is between a one-time compromise and an ongoing one. A seed phrase in someone else’s hands is ongoing: they can return for anything you add. An approval exploit is usually one-time, unless you leave the approval in place.
| Mechanism | On-chain signature | Ongoing risk? | Correct response |
|---|---|---|---|
| Seed phrase exposed (phishing, photo, chat) | Funds leave as normal transfers your wallet has no record of sending | Yes — they can return indefinitely | New wallet, move everything now, abandon the old address permanently |
| Malicious token approval signed by you | A contract pulls token balances; no transfer initiated by you | Only while the approval exists | Revoke the approval, then verify nothing else is approved |
| Malware or clipboard hijacker on your device | Destination addresses differ from what you intended to send | As long as the device is infected | Move funds from a clean device first, then clean the machine |
| A "support agent" with remote access | Anything at all — they are inside your session | Until access is cut | Disconnect remotely, cut access, then treat as seed exposure |
| Drainer site you signed a message on | A single unusual contract interaction, often a zero-value one | No, once revoked | Revoke the approval and check every chain used |
The 12 warning signs, ranked by how conclusive they are
These are ordered from near-certain proof down to weak signals. A weak signal alone is not a reason to panic; two of them together is a reason to audit immediately.
The first three are effectively conclusions. If you see any of them, skip the rest of the list and go straight to the action sequence below.
| # | Sign | What it means | Strength |
|---|---|---|---|
| 1 | A transaction you never signed moved funds out | Someone else holds your key material | Conclusive |
| 2 | Tokens gone with no outgoing transfer in your wallet history | An approved contract pulled them | Conclusive |
| 3 | A token you never bought appears, then your real tokens drain | Classic dust-then-drain pattern | Conclusive |
| 4 | An approval you do not remember signing, on any chain | Dormant exploit waiting to be used | Very strong |
| 5 | Small unexplained outgoing transfers first, then large ones | Thief testing an active key before clearing the account | Very strong |
| 6 | NFTs from your wallet listed for sale by someone else | Third-party marketplace approval also abused | Very strong |
| 7 | A wallet extension asking to "reconnect" for the third time | Possible wallet-drainer clone installed | Strong |
| 8 | Your seed phrase exists as a photo, cloud note or email | Exposure risk regardless of current balance | Strong |
| 9 | You entered the phrase on a website, app or chat, ever | Exposure happened — treat as compromised | Strong |
| 10 | A stranger sent you an unsolicited token or NFT | Address poisoning or dust attack in progress | Moderate |
| 11 | Your balance flickers or the wallet shows stale data | Usually an RPC or indexer issue, not theft | Weak |
| 12 | You were offered "help" in a DM after posting about a loss | You are on a repeat-victim list | Weak as evidence, urgent as a warning |
Where drainers actually take the money
Drainer kits do not need your seed phrase. They ask you to sign one thing — an approval, a permit, sometimes a message that looks entirely harmless — and that signature is enough to let a contract move a specific asset whenever it chooses.
This is why "I never sent anything" and "my wallet is empty" are both true at the same time. It also explains why the balance disappears in a specific order, which is the pattern worth recognising.
The order a drainer empties an account, by value attractiveness
Relative likelihood each asset class is taken first when a drainer fires
Reading: Native coin first, then stablecoins, then everything else. If your balance emptied in that order, an automated drainer was involved — which points at an approval or a signed message rather than a stolen phrase.
The 10-minute self-audit
Run this on the chain you use most, then repeat for any other chain holding value. It costs nothing and requires no software installation.
- 01Open a block explorer and load your own address. Read the *outgoing* list, not the balance. Anything you do not recognise is the finding.
- 02Check the internal-transactions view as well as the normal one — contract pulls often appear only there.
- 03Open a token-approval checker for the same address and list every active approval. Look for unlimited allowances to contracts you cannot identify.
- 04Confirm whether your seed phrase exists anywhere digital: photos, notes, password managers, email drafts, chat messages to yourself.
- 05Check for a wallet extension that you did not install, or a second copy of one you did.
- 06Ask one question honestly: did anyone, at any point, walk me through "restoring", "validating" or "syncing" a wallet?
If the audit is clean on all six points, you are not compromised — you were most likely targeted by an attempt that failed. Revoke anything unnecessary anyway; a dormant approval you do not need is pure downside.
If the answer is yes: the order to act in
Speed matters, but so does order. Moving assets with a device that is compromised simply hands the new wallet to the same attacker. Work from a clean machine.
Do these in sequence, and do not tidy anything first.
- 01Create a brand-new wallet on a clean device, from a brand-new seed phrase generated offline. Never reuse the old phrase, even "just for now".
- 02Move remaining assets to the new address immediately — native coin first, because fees are paid in it, then tokens.
- 03Revoke every approval on the old address so nothing dormant can fire later.
- 04Abandon the old address permanently. Do not send anything to it again, and do not treat a zero balance as safety.
- 05Record the outgoing transaction hashes from the theft and keep them. Those hashes are the beginning of every report and every freeze request you will make.
If someone has your seed phrase, assume they will return within hours. Any asset you add to that address before you migrate is a donation.
Common questions
Check the address against the public ledger
The tracer reads the chain for you: outgoing transfers, approval exposure and hop destinations, in one dated record you can keep.
Primary sources and further reading
- FTC — What To Know About Cryptocurrency and Scams consumer.ftc.gov
- IC3 — Crypto Investment Fraud Advisory www.ic3.gov
- CISA — Cryptocurrency and Digital Asset Guidance www.cisa.gov
External links open in a new tab and are provided so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.
Keep reading
Someone you know may be in this situation right now.
Disclaimer: this guide is general information, not legal, financial or recovery advice, and it is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.