← Back to Fix archive
Approvals & Security
How to Check if a Crypto Wallet Is Compromised
A practical checklist for suspicious approvals, unknown transactions, wallet drainers, and exposed recovery information.
Quick answer
What this usually means
A wallet may be compromised if there are unknown transactions, suspicious approvals, exposed seed phrases, or repeated unauthorized transfers.
Common causes
Why it happens
- The seed phrase or private key was exposed.
- A malicious approval was signed.
- A fake wallet or browser extension was installed.
- A malicious signature was used to authorize movement.
- The device or browser environment is compromised.
Fix path
What to check first
- Check recent transactions on all networks used by the wallet.
- Review token approvals.
- Look for unknown transfers or contract interactions.
- Move remaining funds to a clean wallet if the seed phrase is exposed.
- Stop using the wallet for new deposits until risk is understood.
Safety note
Do not make the problem worse
- If the seed phrase is exposed, the wallet should be considered unsafe.
- Do not test with large amounts.
- Do not install recovery tools sent by strangers.