What to do after connecting a wallet to a suspicious site
After you connect to a suspicious site, disconnect it, sign nothing, and revoke its approvals. If you typed your seed phrase, move funds to a new wallet.
Vahe HakobyanEditor-in-chief
Updated Oct 5, 20263 min readFact-checked
On this page
- Disconnecting does not cancel approvals you signed.
- Anyone who reads your recovery phrase can move the wallet's funds.
- Crypto transfers cannot be reversed, so recovery is rare.
Connecting a wallet to a site is a login with your public address, and the connection alone cannot move funds. Moving tokens takes a transaction or an approval you sign.
What should I do immediately?
A wallet connection is a login, not a transfer. Disconnecting ends the session, but an approval you signed earlier can stay active.
Was my recovery phrase exposed?
A seed phrase is the list of words your wallet gave you, and it is the only way to recover the wallet. If you typed it into the page, set up a new wallet and move your funds to it.
How do I check for unauthorized transfers?
Open your wallet's activity list and the block explorer page for your address. Look for transfers you did not make and approvals you do not recognize, and check each network you use.
How do I report stolen funds?
Report the theft to the Federal Trade Commission and to the Internet Crime Complaint Center, known as IC3, which the FBI runs. Include the addresses and transaction hashes. Recovery is rare, because a transfer cannot be reversed.
Frequently asked questions
No, not by itself. A connection is a login with your public address, and a site needs a transaction or an approval you sign before it can move tokens.
Usually not, because a site can move only the tokens an approval covers. A malicious prompt can still hide an approval in a routine signature.
A plain message signature usually proves control of an address and moves nothing. Some messages authorize spending, so revoke any approval you do not recognize.
Usually yes. A revocation is a transaction on the blockchain, so it needs a confirmation and the network's fee.
