Suspecting a compromise is frightening, and fear leads to mistakes. The remedy is a plan you can follow even with your heart racing. This guide is purely about protecting yourself and recovering safely. Work through the steps in order and do not skip ahead.

Step 1: Decide what was likely exposed

Pause and reason calmly about what happened. Did you type your seed phrase somewhere? Install unverified software? Lose a device? The right response differs depending on whether your seed phrase itself is at risk or only a single device. Naming the threat keeps your next moves focused.

Step 2: If the seed phrase is exposed, move funds immediately

A leaked seed phrase means the whole wallet is compromised and changing a password will not help. Create a brand-new wallet with a fresh seed phrase on a clean, trusted device, then send your coins to a new address under that new wallet as fast as you safely can. Speed matters because whoever has the phrase can act too.

Step 3: Generate the new wallet on a clean device

Do not create the replacement wallet on the same machine you suspect is infected. Use a device you trust, verify the wallet download, and only then generate the new seed phrase. Moving coins to a wallet created on a still-compromised device simply repeats the problem.

Step 4: If only a device was lost, secure accounts first

If a phone or computer was lost or stolen but your seed phrase remains private, change related passwords, sign out remote sessions, and watch your addresses. If that device held a hot wallet, treat its balance as at risk and move it to a safe wallet promptly.

Step 5: Clean or retire the affected hardware

Do not return to using a machine you believe was infected until it has been fully wiped and rebuilt, or set aside. Malware can persist quietly, so a half-measure leaves the door open. A clean rebuild from trusted media is the safe path.

Step 6: Review how it happened and close the gap

Once your coins are safe, work out the entry point: a fake site, an unverified download, a leaked phrase. Fixing that root cause is what stops a repeat. Treat the incident as a lesson rather than only a loss.

Step 7: Do not chase recovery scams

After a loss, fake recovery services often appear promising to retrieve stolen coins for a fee. These prey on desperation and will only take more from you. No service can reverse a blockchain transaction, so ignore them entirely.

A compromise is serious, but a holder with a plan moves their coins to safety, rebuilds cleanly, and learns the lesson - all without compounding the damage through panic.