How to Protect Your Wallet From Post-Hack Phishing Scams

Frequently Asked Questions

01.What should I do if my exchange calls me after a breach?

Hang up and contact the exchange only through its app or the support address on its official website. Legitimate support will not ask you to move funds to a new wallet, read out a recovery phrase, install remote-access software or sign a message to verify your account. Chainalysis describes fake Coinbase support agents who used that script to persuade users to move funds to wallets the scammers controlled (Chainalysis, January 2026).

02.How do I revoke token approvals?

Open your wallet's permissions view or a token-approval checker, connect the address you want to review, and revoke approvals you no longer use, starting with unlimited allowances and collection-wide NFT approvals. Each revocation is an on-chain transaction that costs gas. Revoking stops future transfers under that approval; it does not reverse a transfer that already happened. If your wallet supports account delegation, also confirm that no unexpected delegate is set.

03.What is address poisoning?

Address poisoning is a lure in which an attacker sends a tiny or zero-value transfer from an address that shares the first and last characters of one you use, so it appears in your transaction history. If you later copy an address from that history, you may paste the attacker's. Use an address book or allowlist and check the full address before every send.

04.Do I have to notify customers after a crypto data breach?

Under GDPR, a controller notifies its supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to people, and tells affected individuals without undue delay, in clear and plain language, when the risk to them is high (EUR-Lex, April 2016). SEC registrants also file an Item 1.05 Form 8-K, generally within four business days of determining that an incident is material (SEC, July 2023). Confirm your obligations with counsel.

05.Does a hardware wallet stop drainer signatures?

A hardware wallet keeps keys off an internet-connected device, but it signs whatever you approve. Its protection depends on the screen showing what a signature does; where the device can only display an unreadable hash, you are blind signing. Prefer devices and contracts that support clear signing, and reject any request you cannot read.