Move Remaining Crypto and Lock Out an Attacker

Treat any wallet or exchange account they touched as permanently burnt.

What to do

On a clean device, move any remaining funds to a brand-new wallet whose seed has never touched the compromised device
Revoke every token approval on Etherscan / Revoke.cash / Solscan for the affected address
On the exchange: change password, rotate 2FA, delete all API keys, freeze withdrawals
Email the exchange's compliance/fraud team with txids — they may freeze funds still on-platform
Report the txids to chainalysis-style trackers (e.g. via your local cybercrime unit) and to the receiving exchanges

Was this guide helpful?

Know someone who needs this? Send them the guide.

Written by

Founder, CyberSecurityGuides

Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

Reviewed by CSG Security Engineers