What to do if your wallet is compromised

If someone else may have your mnemonic phrase or private key, create a new wallet on a phone you trust and move your assets to it at once. Anyone with the phrase or key can take your assets at any time, and changing your FxWallet passcode doesn't stop them.

If you never shared your phrase or key, but approved a contract on a scam website, revoke that approval instead. See If you approved a scam contract.

danger

Act now. Blockchain transactions can't be reversed, and FxWallet can't freeze, cancel or return stolen assets.

Your wallet may be compromised if:

• You see transactions or approvals that you didn't make.
• You entered your mnemonic phrase or private key on a website, in another app, or gave it to someone, for example a "support agent" or a "recovery service".
• Your phrase or key was saved where others could see it, such as a screenshot, a cloud note, an email or a chat.
• You installed software that a stranger sent you, for example for a job interview. See Malware and fake job tasks.

Find out how it happened

If crypto left your wallet and you don't know how, look up that transaction in a block explorer for its network. The address that sent it is a clue:

• Your address sent it, and you didn't confirm it: someone has your mnemonic phrase or private key. Follow the steps below to move to a new wallet.
• Another address sent it and moved your tokens: it usually used an approval or a permit that you gave. Revoke your approvals and move what's left of that token, as in If you approved a scam contract and If you signed something suspicious. Someone who has your phrase or key can also do this, so unless you know which approval or permit was used, follow the steps below as well.
• On Solana, or if you can't tell: treat your mnemonic phrase as leaked, and follow the steps below.

If nothing is missing yet

If you used a suspicious site, act on what you actually did there:

• You only connected: connecting moves nothing. Close the site. To end a WalletConnect connection, tap the floating WalletConnect button, then Disconnect.
• You added a network: remove it, and check your balance in a block explorer. See Edit or remove a custom network.
• You approved something: revoke it. See If you approved a scam contract.
• You signed a permit, or a request you couldn't read: move that token to another wallet of yours now, or all your assets if you're not sure what it was. A permit that hasn't been used yet isn't in Approvals, and revoking may not cancel it. See If you signed something suspicious.
• You entered your mnemonic phrase or private key: your wallet is compromised. Follow the steps below.

1. Create a new wallet on a phone you trust

Create the new wallet on a different phone that you trust, with FxWallet downloaded from an official source. See Download FxWallet and check it's genuine. If your phrase leaked through a fake app or malware on your current phone, a new wallet created on that phone could leak the same way.

1. On the trusted phone, install FxWallet and tap Create New Wallet. If it already has a wallet, tap the wallet name at the top of the Wallet tab, tap +, then tap Create Wallet.
2. Back up the new wallet's mnemonic phrase on paper, and keep it somewhere safe. See Back up your mnemonic.

Only create the new wallet on your current phone if you're sure the phone and its FxWallet app weren't the cause, for example because you gave your phrase to a fake support agent or typed it into a scam website.

Don't import the old mnemonic phrase or private key into the new wallet: it's still compromised.

2. Move your assets to the new wallet

1. On the trusted phone, tap Receive on the Wallet tab, choose the coin, and copy the new wallet's address or show its QR code.
2. On the phone with the compromised wallet, tap the token or coin, then tap Send.
3. Paste or scan the new address, and check that it matches the address on the trusted phone, including the first and last characters.
4. Tap All to send the whole balance, then tap Next Step and confirm.

Addresses differ between networks such as Bitcoin, Solana and the EVM networks, so get the new wallet's address for each coin you move. If you created the new wallet on the same phone, you can pick it instead: tap the address book icon in the address field, open My wallet, and choose the new wallet.

Move the most valuable assets first. Send tokens before the network's native coin, such as ETH: you pay each transfer's fee in the native coin. When you send a native coin, All keeps back enough for the fee.

warning

Don't send more coins to the compromised wallet to pay fees. Thieves often run scripts that take anything that arrives at once. If there's no native coin left for fees, you may be able to pay with a Gas Card. See Gas fees and Gas Card.

If you have assets in Earn or in staking, withdraw or unstake them and move them too.

3. Stop using the old wallet

Don't send anything to the old wallet's addresses again: anything sent there can be taken.

If you approved a scam contract

A token approval lets a contract spend your tokens. If you approved a malicious contract, but your phrase and key are safe, revoke the approval:

1. On the Wallet tab, tap More → Approvals.
2. Tap the DApp or contract. A red warning icon marks contracts known to be risky.
3. Tap Revoke next to each token, check the network fee, then tap Confirm.

To revoke several at once, tap Batch Revoke, select them, then tap Revoke Selected. Each revoke is a transaction, so you pay a network fee. Approvals lists token approvals on EVM networks. See Token approvals

If tokens have already been taken, revoke the approval anyway to protect what's left.

Report it, and beware of recovery scams

• Tell FxWallet support what happened: email support@fxwallet.com, or use Me → Feedback. Include your wallet address and the transaction hashes (TXIDs). Support can't reverse transactions.
• If the stolen assets went to an exchange, contact that exchange with the transaction hashes.
• Report the theft to the police if you can.

warning

Anyone who promises to get your crypto back for a fee is a scammer, including people who contact you after you post about a theft, and fake "FxWallet support" accounts. Never share your new mnemonic phrase with anyone.