What should I do first if I think my wallet is compromised?

Stay calm and work out what was exposed. If your seed phrase itself may have leaked, the whole wallet is compromised and you must act fast: create a new wallet with a fresh seed phrase on a clean, trusted device, then move your coins to the new address quickly. Do not build the new wallet on a machine you suspect is infected. If only a device was lost but the seed phrase stayed private, secure related accounts and move any hot-wallet balance to safety. Afterward, find the root cause and fix it, and ignore any service promising to recover stolen coins for a fee.