Follow us

MetaMask Hacked? What to Do Right Now

MetaMask Hacked? What to Do Right Now
-
August 16, 2026

If your MetaMask wallet has been compromised, these four actions matter most in the first minutes: stop using the compromised wallet immediately, do not enter your Secret Recovery Phrase anywhere, create a fresh MetaMask instance on a clean device or separate browser profile, and move any remaining assets only if you have confirmed no sweeper bot is active. MetaMask is self-custodial, which means no one, including MetaMask itself, can reverse a transaction or restore missing funds. Speed is the only variable you control.

Immediate priority checklist:

  • Stop using the compromised wallet. Every interaction risks exposing more assets or triggering further drains.
  • Do not enter your seed phrase anywhere. Not in a browser, not in a support chat, not on a site claiming to help you recover funds.
  • Do not deposit new ETH or tokens into the compromised wallet. If a sweeper bot is active, new deposits drain automatically within seconds.
  • Open Etherscan (etherscan.io) and look up your wallet address to confirm which transactions are unauthorized.
  • Go to revoke.cash and check for open token approvals that could allow future drains even after you stop using the wallet.
  • Screenshot and copy every transaction ID (TXID) and recipient address you see. Investigators need this data before laundering activity obscures the trail.

MetaMask will never ask for your Secret Recovery Phrase. Anyone who does is running a scam.

Key Takeaways

When a MetaMask wallet is compromised, the single most important action is immediate containment: stop using the wallet, preserve every TXID, and never deposit new funds if a sweeper bot is suspected.

Point Details
Stop and preserve first Copy every TXID and recipient address before doing anything else.
Never deposit into a compromised wallet Sweeper bots drain new deposits automatically, adding to your loss.
Revoke approvals on revoke.cash Active token approvals allow future drains even after you stop using the wallet.
Report to IC3 and local cybercrime A formal report creates a legal record and supports any civil recovery effort.
Recoveraforensics for serious losses The firm provides on-chain tracing, OSINT, and court-admissible reports for wallet theft cases.

This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.

Table of Contents

What to do when your MetaMask wallet is hacked: confirming the compromise

Before you act further, confirm what actually happened. Panic-driven assumptions can lead to mistakes that cost more than the original loss.

Step-by-step diagnosis using a block explorer:

  1. Go to Etherscan (for Ethereum) or the appropriate explorer for your chain (BscScan for BNB Chain, Polygonscan for Polygon).
  2. Paste your wallet address into the search bar.
  3. Review the transaction list. For each suspicious transaction, check: the timestamp, the recipient address, the token or ETH value transferred, and whether it was triggered by a dapp contract interaction.
  4. Click into the TXID to see the full transaction detail. Copy the TXID and the recipient address into a document you keep offline.
  5. Check the “Token Transfers” tab to catch ERC-20 or NFT movements that may not appear in the main ETH transaction list.

Sweeper bot signals to watch for:

  • New ETH deposits disappear within seconds of arriving.
  • Multiple small outgoing transactions in rapid succession, often to the same address.
  • Gas fees paid from a different address than the one sending tokens (a sign of a sponsored drain operation).
  • Transactions you did not initiate appearing at odd hours or in clusters.

MetaMask’s guidance on block explorer checks confirms that reviewing date, time, recipient, and value is the correct first diagnostic step.

Pro Tip: Copy every TXID and recipient address into a plain text file and save it to a USB drive or print it. Forensic investigators build their case from this raw chain data, and laundering can obscure the trail within hours.

Person plugging USB drive into laptop

Containment: setting up a clean wallet and preserving what remains

Once you have confirmed unauthorized activity, your next job is containment, not recovery. Recovery comes later. Right now, you are stopping the bleeding.

  1. Get a clean device or browser profile. If you suspect malware or a keylogger on your current machine, use a different computer entirely. At minimum, create a new browser profile with no extensions installed.
  2. Install MetaMask fresh on that clean environment. Do not import the compromised seed phrase.
  3. Generate a new Secret Recovery Phrase. Write it on paper, store it offline, and do not photograph it or type it into any digital document.
  4. Do not reuse Google or Apple logins tied to the compromised wallet. If your browser sync was on, the compromised extension settings may have propagated.
  5. On mobile: use a second physical device rather than reinstalling on a potentially infected phone. A factory reset is an option, but only after you have preserved all evidence.
  6. Preserve evidence before wiping anything. Take screenshots of your MetaMask transaction history, export browser logs if available, and copy all TXIDs and recipient addresses. MetaMask’s troubleshooting guidance stresses that on-chain evidence must be captured before additional activity obscures it.

MetaMask explicitly states that any new accounts created from a compromised seed phrase are also compromised. The phrase is the root. If the root is exposed, every account derived from it is at risk.

Pro Tip: Before you close or uninstall anything, export your MetaMask state logs (Settings > Advanced > State Logs). This file contains account addresses and network data that can help an investigator reconstruct your wallet history.

Should you try to salvage funds yourself? A decision flow

Attempting a self-rescue is not always the right call. Work through this decision flow before touching anything.

  1. Do you see sweeper bot behavior? If yes, do not deposit ETH for gas. Skip to step 4.
  2. Do you have ETH already in the wallet for gas? If yes, and no sweeper is confirmed, you may attempt to move tokens to your new clean address using a standard transaction. Test with a small amount first.
  3. Are the assets ERC-20 tokens rather than ETH? Tokens require a separate gas transaction. If a sweeper is watching, it will drain any ETH you send before your token transfer executes.
  4. Consider Flashbots-sponsored transactions. Flashbots lets a sponsor address pay gas for your compromised wallet’s transactions, bypassing the public mempool where sweepers monitor. MetaMask’s sweeper bot guide describes this approach and notes it requires technical expertise, a sponsor account, and careful timing.
  5. Assess your technical comfort honestly. If you are not comfortable with JSON-RPC calls, private key management in a command-line environment, or mempool mechanics, the risk of error is high. A mistake can finalize the loss.

Pro Tip: If you decide to attempt a Flashbots rescue, test the entire flow with a burner wallet and a negligible amount first. Timing and latency matter; a single failed bundle can alert the sweeper and accelerate the drain.

Whitehat rescue teams that specialize in sweeper scenarios typically charge a minimum fee plus a percentage of recovered assets. If the value at risk is significant, that cost is usually worth it compared to losing everything.

How to revoke dapp approvals and cut off future access

Stopping the immediate drain is not enough if you have granted token approvals that remain active. Those approvals let a contract move your tokens at any time, even after you stop using the dapp.

  • Understand what you are revoking. A token approval is an on-chain permission you gave a smart contract to spend tokens from your wallet. Signature phishing and Permit2 attacks work differently: they use off-chain signatures that are not recorded on-chain at signing time, making them harder to spot until assets are already gone.
  • Go to revoke.cash. Connect your compromised wallet (read-only mode if available), and review every active approval. Sort by token value to prioritize.
  • Revoke unlimited approvals first. An unlimited approval means a contract can drain your entire token balance at any time.
  • Check for Permit2 approvals separately, as these may not appear in standard approval lists. Revoke.cash covers most of them, but cross-check with the token’s own contract on Etherscan.
  • Disconnect sites in MetaMask. Go to Settings > Connected Sites and remove every connection you do not recognize or no longer use.

Revoking approvals does not recover assets already stolen. It prevents future automatic drains from contracts that still hold permission to move your tokens.

How to report the incident and what recovery options actually exist

Reporting a crypto theft feels futile to many victims. It is not. A well-documented report creates a legal record, supports civil recovery efforts, and in some cases leads to exchange-level freezes when funds reach a KYC’d platform.

Evidence to collect and preserve:

  • Every TXID for unauthorized transactions
  • Recipient wallet addresses (copy the full string, not a screenshot)
  • Timestamps for each transaction
  • Screenshots of your MetaMask activity log
  • Browser history around the time of the compromise
  • Any emails, DMs, or links you clicked before the hack

What MetaMask can and cannot do:

MetaMask cannot reverse transactions or access your private keys. MetaMask’s Fund Loss Investigation page confirms this directly and introduces MetaMask Trace (MMT), an investigative product for qualifying fund loss cases. MMT can help document the incident, but it is not a recovery guarantee.

Law enforcement reporting:

  • File a report with the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. Include every TXID, address, and dollar value.
  • Contact your local cybercrime unit. Many jurisdictions now have dedicated digital asset investigators.
  • Keep a copy of every report number and confirmation email.

Professional forensic options:

A paid forensic investigator provides on-chain tracing, OSINT attribution, address clustering, and a court-admissible technical report. This is the route when the loss is significant, when funds have moved through multiple hops, or when legal action is being considered. Recoveraforensics specializes in exactly this work.

When to hire a blockchain forensics firm

Not every hack warrants a paid investigation. But several conditions make professional help the clearest next step.

Hire a forensic firm when:

  • The loss exceeds a threshold where the investigation cost is proportionate (typically several thousand dollars or more in crypto value).
  • Funds have moved through multiple wallets or been converted across chains.
  • You suspect a coordinated fraud network rather than an opportunistic drain.
  • You are considering civil litigation or need evidence for law enforcement.
  • Third-party custody (a centralized exchange) is involved at any point in the fund flow.

What forensic investigators actually do:

  • Reconstruct a full transaction timeline from the point of compromise to the current location of funds.
  • Cluster recipient addresses to identify whether multiple victims share the same attacker.
  • Run OSINT to connect wallet addresses to known exchange accounts, social profiles, or fraud networks.
  • Preserve TXIDs and chain evidence in a format that meets legal standards.
  • Produce a technical report suitable for court filings, law firm use, or regulatory submissions.

Recoveraforensics operates on a victim-centered model: case intake begins with a review of your evidence, followed by a scoped investigation and a written technical report. The firm handles Forex fraud, online trading scams, and gambling fraud cases in addition to direct wallet theft. Clients should expect to share all TXIDs, wallet addresses, and any communications with the suspected attacker.

Pro Tip: Before contacting any forensic firm, organize your evidence into a single document: wallet address, list of unauthorized TXIDs, estimated dollar value at time of theft, and a brief timeline of events. This speeds intake and reduces the time before active investigation begins.

Actions to avoid after a hack

The hours after a MetaMask compromise are when victims are most vulnerable to secondary scams. Attackers and scammers monitor blockchain activity and social channels for fresh victims.

  • Never share your Secret Recovery Phrase with anyone. MetaMask’s official policy is unambiguous: no legitimate support representative will ever ask for it. Not in a ticket, not in a DM, not on a call.
  • Ignore unsolicited offers of help on Telegram, Discord, Reddit, or Twitter/X. These are almost always follow-on scams targeting people who just posted about being hacked.
  • Do not use “recovery services” that ask for an upfront fee and a seed phrase. Legitimate forensic firms do not need your seed phrase to trace funds on-chain.
  • Do not create new MetaMask accounts using the compromised seed phrase. Every account derived from that phrase is exposed.
  • Do not repeatedly deposit small amounts to “test” whether the sweeper is gone. It is not.

Watch for these specific red flags: promises of guaranteed recovery, requests for payment in gift cards or crypto upfront, pressure to act within hours, and sites that mimic MetaMask’s branding.

A short prevention checklist for your new wallet

Once you are on a clean wallet, these steps reduce the risk of a repeat compromise significantly.

  • Use a hardware wallet (Ledger or Trezor) for any holdings above a few hundred dollars. Private keys never leave the device.
  • Use separate browser profiles for DeFi activity, general browsing, and work. Cross-contamination is a common attack vector.
  • Enable MetaMask security alerts in Settings > Security & Privacy. These flag known phishing sites.
  • Use a reputable RPC provider. Malicious RPC endpoints can manipulate transaction data before you sign.
  • Keep your OS and antivirus software current. Keyloggers and clipboard hijackers are still the most common MetaMask attack vectors.
  • Limit token approvals. Never grant unlimited approvals unless you understand exactly what the contract does. Revoke approvals after each session with a new dapp.
  • Audit your approvals monthly using revoke.cash. Permissions accumulate silently.

Pro Tip: For high-value wallets, consider a multisig setup (Gnosis Safe) that requires multiple signatures to execute a transaction. A single compromised key cannot drain a properly configured multisig.

How quickly to act and what recovery attempts cost

The 0–24 hour window is the most critical period after a MetaMask compromise. Sweeper bots operate in real time; laundering hops begin within minutes of a large theft. Every hour of delay narrows the forensic trail.

Close-up of wristwatch showing urgency

Approach Typical Speed Estimated Cost Best For
DIY token rescue (no sweeper) Minutes to hours Gas fees only Small balances, no sweeper confirmed
Flashbots-sponsored rescue Hours (setup required) Minimum fees plus recovery percentage Sweeper present, technical user
Professional forensic engagement Days to weeks Varies by case complexity Large losses, legal action, multi-hop laundering

Flashbots-sponsored rescues can carry minimums and take a percentage of recovered assets. Forensic engagement costs depend on chain complexity, number of hops, and whether KYC linkage to an exchange is achievable.

The single most expensive mistake victims make is waiting 48–72 hours before acting. By then, funds have often passed through mixers or been converted to stablecoins on centralized exchanges, where the window for a voluntary freeze is closing fast.

What investigators see in the first 24 hours

The cases that reach forensic teams earliest are the ones with the most recoverable evidence. In the first 24 hours, the on-chain trail is still largely intact: recipient addresses are fresh, clustering analysis can connect the attacker to known fraud wallets, and exchange deposit addresses have not yet been flagged or rotated.

What professionals prioritize immediately: the TXID of the first unauthorized transaction, the recipient address cluster, and any mempool data that survived. From those three data points, a skilled investigator can often reconstruct the attacker’s pattern within hours and identify whether funds reached a custodial endpoint where a legal hold is possible.

Victims who preserve their evidence carefully and reach out early give investigators the best possible starting position. If you have been hit, gather what you have and move quickly.

How Recoveraforensics can help you trace stolen crypto

When the loss is real and the trail is still warm, the difference between a documented case and a dead end often comes down to who starts the investigation first. Recoveraforensics provides blockchain forensics and digital fraud investigation for victims of wallet theft, phishing, and investment fraud. The firm produces court-admissible technical reports, performs on-chain tracing across multiple chains, and supports law firms handling crypto fraud litigation.

Unlike generic “recovery” services that ask for your seed phrase and disappear, Recoveraforensics works from public blockchain data and OSINT, meaning your private keys stay private. The process starts with a case intake review of your TXIDs and wallet history, followed by a scoped investigation and a written deliverable your attorney can use.

If you have experienced a MetaMask compromise and the loss is significant, submit your case details to start the intake process. The earlier the engagement begins, the more of the trail remains intact.

Sources

FAQ

What should I do immediately if MetaMask is hacked?

Stop using the compromised wallet, do not deposit any new funds, copy every TXID and recipient address from Etherscan, and create a fresh MetaMask wallet on a clean device with a new Secret Recovery Phrase.

Is MetaMask safe from hackers?

MetaMask itself has not been breached at the protocol level, but individual wallets are compromised through phishing, malware, and malicious token approvals. The wallet’s security depends almost entirely on how the user protects their Secret Recovery Phrase and manages dapp permissions.

Has MetaMask the company ever been hacked?

MetaMask as a company has not suffered a protocol-level breach that exposed user funds. Losses attributed to “MetaMask hacks” are almost always the result of phishing attacks, compromised seed phrases, or malicious smart contract approvals targeting individual users.

Can you recover a hacked MetaMask wallet?

The wallet itself can be recreated from the Secret Recovery Phrase, but stolen funds cannot be reversed by MetaMask. If the phrase is compromised, migrate to a completely new phrase. For significant losses, a professional forensic service like Recoveraforensics can trace funds on-chain and produce evidence for legal proceedings, though recovery of funds depends on whether they reached a traceable custodial endpoint.

Official pages and tools to consult right now

For official policy on what MetaMask can and cannot do, always prefer MetaMask’s own support pages over third-party summaries. For approval revocation and block explorer lookups, revoke.cash and Etherscan are the most widely used and reliable third-party tools available.

Related Posts
Send us a WhatsApp message

We will respond to you immediately

+34 637 46 62 42
popup clock iconTypical response time: Less than 24 hours