A leaked seed phrase is the single most dangerous event that can happen to your crypto assets — once it's out, everything in the wallet can be drained within 24 hours. This article lays out the emergency recovery process. The bottom line up front: the moment a seed phrase leaks, immediately create a new wallet, move your assets, and win the gas war against the hacker — whether you succeed depends on how fast you react (aim to act within 5-15 minutes). For everyday primary/backup accounts, register your main account through Binance Official Site, install the Official Binance App on Android, and iPhone users switching to an overseas Apple ID should check the iOS Install Guide.

1. Common Ways a Seed Phrase Gets Leaked

Signs that your seed phrase may have leaked:

Q: How do I know if my seed phrase has leaked?

Three signals to check:

  1. Unusual on-chain activity: transfers out of your wallet that you didn't initiate
  2. Small test withdrawals: hackers often move out a small amount first to test ("sweeper bot" behavior)
  3. Unusual Approve activity: contract calls you never authorized suddenly appearing

If you spot any of the above, immediately follow the emergency recovery steps below.

2. Emergency Recovery Process (5 Steps)

Step 1: Set up a new wallet immediately (< 5 minutes)

Step 2: Assess the value and priority of your assets

Rank your on-chain assets by "how hard they are to move out and how valuable they are":

Asset Type Difficulty to Move Priority
Native ETH / BTC / SOL (unlocked) Very low Highest
ERC-20 tokens (USDC / USDT / WETH) Low High
Staked / locked tokens High (must unlock first) Medium
LP liquidity positions Medium (must withdraw first) Medium
NFTs Medium (must transfer one by one) Depends on value
Bridged/locked cross-chain assets High Depends

Step 3: Win the gas war against the hacker

Hackers typically scan your wallet immediately and prepare to move funds out. You need to use a higher gas fee to transfer out first:

Tools for front-running:

Step 4: Order of withdrawal (by value, descending)

1. Native ETH / BTC (highest value, unlocked)
2. USDC / USDT / WETH (high-value stablecoins)
3. Mid-value tokens (by value, descending)
4. NFTs (by estimated value, descending)
5. Locked / staked tokens (unlock first)

Step 5: Revoke all Approve authorizations

After your assets are out:

Q: How likely is it that I can outrun the hacker?

It depends on:

Wallets under $50,000: a fast response can usually rescue the funds.

Wallets over $500,000: hackers typically use bots that scan and react immediately, so the success rate is much lower.

3. Front-Running Strategies by Chain

Ethereum mainnet:

If the ETH balance in the compromised wallet is too low to pay gas:

If there isn't enough ETH in the wallet to cover gas, you need to send ETH in from another wallet first. But this is essentially "feeding" the sweeper bot — it will grab the incoming ETH instantly.

The correct approach: use a Flashbots Bundle

The bundle contains 2 transactions:
1. Send 0.01 ETH from your safe wallet to the compromised wallet
2. Immediately move assets from the compromised wallet to your safe wallet

Flashbots guarantees atomic execution of the bundle — it either fully succeeds or fully fails

Solana:

BNB Chain / Polygon / Arbitrum:

Q: What is a "sweeper bot"?

A sweeper bot is an automated script deployed by hackers that:

This means an ordinary user has almost no chance of beating a sweeper bot on Ethereum mainnet. A Flashbots Bundle is the only reliable solution.

4. Special Cases: Staked / Locked Assets

Staked ETH (e.g. in Lido or similar liquid staking):

Locked LP positions:

Already-locked tokens (such as veTokens):

Q: Can locked assets be saved?

In some cases, yes:

Preventive strategy: never stake or lock 100% of a large holding — keep at least 50% liquid.

5. What to Do After Moving Your Assets Out

Once your assets are safely in a new wallet:

1. Revoke all Approve authorizations (old wallet)

Even after assets are moved, the old wallet can still be drained through Approve authorizations:

Use Revoke.cash to clear all authorizations.

2. Never use the old wallet again

The old wallet is permanently unsafe — never use it again. Even if you send new funds into it later, they will be swept out immediately.

3. Check for other derived addresses

A BIP44 seed phrase can derive multiple wallet addresses:

If you've ever used any of these derived addresses, every one of them needs to be emptied out too.

4. Check NFTs and other chains

5. File a police report and get on-chain analysis

Q: What if the hacker moved the funds to Binance?

If on-chain tracing shows the funds landed on a CEX (Binance, OKX, etc.):

  1. Contact CEX support immediately: provide the transaction hash and your police report
  2. CEX risk control may freeze the counterparty's account
  3. Cooperate with the police investigation: the CEX can provide the counterparty's KYC information
  4. Recovery of 50-80% is theoretically possible (if the hacker hasn't already withdrawn the funds off the CEX)

The faster you respond, the higher the odds of recovery (within 24 hours).

6. Special Case: Signing a Malicious Approve via Phishing

If it's not a seed phrase leak but instead you signed a malicious Approve:

1. Move out the authorized tokens immediately

2. Revoke that Approve

Use Revoke.cash to revoke the authorization for that malicious contract.

3. Check for other Approves

The signature may have included multiple hidden Approve requests. Check them all and revoke them all.

4. The wallet can still be used

Signing a malicious Approve doesn't expose your seed phrase, so the wallet remains usable (once the authorization is revoked).

Q: How do I tell the difference between a seed phrase leak and an Approve phishing attack?

Situation Seed Phrase Leaked Approve Phishing
ETH drained from the wallet Yes No (unless you also signed an ETH transfer)
ERC-20 tokens drained Yes Yes (only the authorized tokens)
Unauthorized tokens drained Yes No
NFTs drained Yes Depends on whether the NFT contract was authorized
On-chain method is a plain transfer Yes No
On-chain method is transferFrom No Yes (contract-initiated withdrawal)

How to check: look at the withdrawal transaction's Method field on Etherscan:

7. Emergency Strategy by Asset Size

Under $10,000 in assets:

$10,000-$100,000 in assets:

Over $100,000 in assets:

Q: Are rescue services (like SlowMist) worth using?

For assets over $500,000: yes, worth it.

The cost is typically 5-15% of the assets recovered. But retail users typically don't need this level of service.

8. Prevention: Never Let It Happen Again

After an incident, you need to upgrade your security setup:

Hardware wallets + multi-sig

Upgrade seed phrase management

Upgrade devices and your operating environment

Change your habits

9. Frequently Asked Questions

Q: Can stolen assets be recovered on-chain?

Recovery rates in practice:

The first 24 hours are the critical window.

Q: Does negotiating a buyback with the hacker work?

For major incidents (over $1,000,000), it has sometimes worked:

But for individual retail users:

It's not advisable for individuals to contact the hacker directly.

Q: Can you keep using crypto after being hacked?

Yes, but every seed phrase and wallet must be freshly generated:

Many users leave crypto entirely after being hacked, but learning how to use it safely matters more than giving up.

Q: Does insurance cover stolen crypto?

Mainstream insurance does not cover individual wallet theft:

There's currently no effective insurance option for ordinary users.

Q: A family member saw my seed phrase — what should I do?

If you're confident the family member is trustworthy: the risk is moderate, and you can handle it case by case.

If you're not sure: it's best to replace the wallet immediately:

  1. Generate a new wallet
  2. Move your assets
  3. Stop using the old wallet

The core rule of seed phrase custody: minimize the number of people who ever see it.

Q: If I get hacked and report it to the police in China, will they open a case?

Local police stations in mainland China will generally open a case:

Keeping the police report is still useful:

Q: How do I check if my device has malware?

Steps to check:

  1. Run a full antivirus scan (Windows Defender or Malwarebytes)
  2. Check your browser extensions (remove anything suspicious)
  3. Check startup items (use msconfig to review startup programs)
  4. Monitor network traffic (watch for unusual outbound traffic)
  5. Reinstall the OS (the most reliable fix)

Q: Can I register a new wallet using the same email after being hacked?

Yes. A seed phrase and an email address are unrelated:

Using the same email for a new wallet is fine, but the password must be a completely new one.

Data Sources

Risk notice: This article is an independent third-party summary and does not constitute investment or legal advice. A leaked seed phrase is one of the most severe events that can happen to a crypto holder — prevention is worth 100 times more than rescue. All data is as of April 2026.