If you entered your seed phrase into a fake wallet, assume attackers have it and that funds can be moved at any moment. Speed matters — but doing the steps in the right order matters more.

Step 1 — Move funds to a clean wallet

On a different, clean device, create a brand-new wallet with a new seed phrase (from an officially verified download). Transfer any remaining assets there immediately. Do this before anything else.

Step 2 — Revoke token approvals

Drainers often rely on token approvals. Review and revoke approvals granted from the compromised address using your wallet's built-in approval settings — but remember, if the seed is exposed, only moving funds truly protects you.

Step 3 — Remove the fake software

Uninstall the fake extension or app, clear it from your browser, and run a malware scan. The fake may have installed more than just the wallet.

Step 4 — Burn the compromised seed

Never reuse that seed phrase or address. Treat it as permanently public.

What NOT to do: don't “restore” the same seed into a new wallet — it's still compromised. And ignore any “recovery service” that asks for your seed phrase or a fee; those are second-stage scams.

Prevent the next one

Going forward, install only from official sources and verify the checksum. If the comparer fails, see hashes do not match. After you have a clean wallet, revoke token approvals. Warning signs: the top fake wallet scams and seed phrase phishing.

Frequently asked questions

How fast do I need to act?

Immediately. If your seed phrase was exposed, attackers can move funds at any time. Transferring assets to a fresh wallet is the priority.

Can I keep using the same wallet after removing the fake?

No. If the seed phrase was entered into a fake wallet, that phrase and address are permanently compromised. Create a new wallet with a new seed.

Should I pay a recovery service?

No. Services that promise to recover stolen crypto for a fee, or that ask for your seed phrase, are scams.