← All journeys
Respond to a suspected compromised wallet · unpublished Outcome: You contained the incident and moved remaining funds to fresh keys in the right order.
Completion looks like: Any remaining funds live under a new phrase that no suspect device or person has seen.
If something goes wrong: Speed matters more than neatness. You can clean up after the money is safe.
All steps Stop using the suspect wallet You are trying to Prevent further exposure. You should see Nothing new is signed or approved. You do Stop. Do not sign anything more, do not 'test' the wallet with small sends to check it. Before you continue, check You accept that anything the suspect device can see may already be known. What can go wrong The 'send a small test amount' reflex from compromised devices funds the attacker. Reversible? Yes. Prepare fresh keys on a clean device You are trying to Create a new wallet where the compromise cannot see it. You should see A new phrase exists on paper, created on a device you trust. You do Install the wallet on a clean device or profile and create a new wallet. Before you continue, check The new phrase never touches the suspect device in any form: no photo, no note, no cloud. What can go wrong Moving funds to keys the suspect device generated (or its clipboard saw) is not an escape. Reversible? No. Read twice. Move funds to the new wallet You are trying to Transfer remaining value to fresh keys. You should see Sends complete from the old wallet to the new address. You do Send everything worth keeping. Artifacts too: a moved inscription leaves the compromised keys. Before you continue, check Balance shows zero (or the amount you chose to abandon) on the old wallet. What can go wrong Leaving 'just the cheap artifacts' leaves a trail and a hook for follow-up scams. Reversible? No. Read twice. Not available here: If your build authorizes no sending, sweeping from it is impossible by design: use another wallet you control that holds the same keys, or accept the exposure and treat all funds as at risk.
Retire the old phrase You are trying to Make sure the old keys are never funded again. You should see The old phrase is out of circulation. You do Remove the wallet from the suspect device. Mark the paper phrase as burned. Before you continue, check No service, subscription, or payment card still points at the old address. What can go wrong Reusing a leaked phrase 'one more time' is how round-two losses happen. Reversible? Yes. Something wrong on this page? Open a prefilled issue in the documentation repository. What travels: the page path, the release this site describes, and your own words. Nothing about your wallet, transactions, or this browser is included or stored by this site.
Where this page comes from
Applicable release Universe Wallet 1.7.5.8
Lifecycle Experimental 