Module 2: Wallets, Custody, and Security
When Things Go Wrong
Chapter 14 of 14 · about 8 minutes
14.1 The 2 a.m. message
At 2 a.m., Mint got a notification: an outgoing transaction from the spending wallet. Mint hadn't sent anything. Within seconds, a second transaction followed.
Mint's first instinct was panic. The second was to call Hash, who picked up on the third ring.
"Okay," said Hash. "Breathe. We're going to work out what happened, protect what's left, and then deal with the rest. In that order."
This chapter is the emergency guide. Read it now, while nothing is wrong, so that if something does go wrong, you already know the steps.
14.2 First, work out what kind of problem it is
Different problems need different responses. The first job is diagnosis.
| What you see | Likely cause | Seriousness |
|---|---|---|
| Your balance looks wrong or zero, but no outgoing transactions | Wrong network selected, or display issue (Chapter 9) | Usually not a loss |
| Funds sent to the wrong address or network by you | User mistake | Depends on where they went |
| A specific token was taken, but others remain | A malicious approval or permit signature (Chapters 7 and 8) | Serious, but often contained |
| Multiple assets moving out without your action, or the native coin being taken | Your seed phrase or private key is likely compromised | Critical |
| You can't access your exchange account | Account takeover or a security lock | Serious; contact the exchange through official channels |
Mint and Hash looked at the transactions on a block explorer. The first had moved USDC. The second had moved a different token. Then ETH started leaving too.
"Both tokens and ETH, with no approval involved," said Hash. "That means someone has your key. We treat this as critical."
14.3 If your seed phrase is compromised
If an attacker has your seed phrase or private key, they can sign anything you can. You can't revoke their access, because access is the key. The only solution is to move whatever remains to a new wallet with a new seed phrase, as fast as possible.
- Create a brand new wallet with a new seed phrase, ideally on a device you're confident is clean, or on a hardware wallet. Don't create it on a device you suspect is infected.
- Move remaining assets to the new wallet, starting with the most valuable.
- Remember that every account under the old seed phrase is compromised, not just the one being drained.
- Stop using the old seed phrase permanently. Never send funds to those addresses again.
There's a complication. Attackers often run sweeper bots that watch a compromised wallet and instantly take any ETH that arrives, so you can't pay gas to rescue tokens. In this situation, specialist rescue tools exist that bundle the gas payment and the token transfer together, though you must be very careful, because fake rescue services are also common. If significant assets are stuck behind a sweeper bot, seek help from reputable security professionals, not strangers who contact you.
Mint's spending wallet lost a few hundred dollars that night. The vault, a hardware wallet with a separate seed phrase, was untouched. The structure from Chapter 12 had done its job.
14.4 If a malicious approval or signature was used
If only specific tokens were taken, the cause is usually an approval or permit, not a stolen seed phrase.
- Open a token approval checker immediately and revoke every approval you don't recognise, starting with tokens you still hold (Chapter 8).
- Check every network you've used.
- If you're unsure whether the seed phrase was also exposed, for example if you typed it anywhere, treat it as compromised and follow section 14.3.
- Move remaining valuable assets to a safer wallet while you investigate.
14.5 If you sent funds to the wrong place
Mistaken transfers can't be reversed by anyone on the blockchain, but some are recoverable through people.
| Where the funds went | What to try |
|---|---|
| Your own address, on a different EVM network | Switch networks in your wallet; add gas there and move them (Chapter 9) |
| An exchange, on an unsupported network or without a required memo | Contact the exchange through its official support, with the transaction hash. Recovery depends on their policies |
| A known person's address | Contact them and ask them to return it |
| An unknown or wrong address | Usually unrecoverable |
| A token's own contract address | Usually unrecoverable, unless the project has a recovery mechanism |
14.6 Document everything
Once the immediate danger is over, collect evidence while it's fresh.
- Transaction hashes of every unauthorised or mistaken transaction.
- The attacker's addresses where funds were sent.
- Timeline: what you did, what sites you visited, what you signed, and when.
- Screenshots of any scam messages, websites, or profiles involved.
- Any amounts and asset types lost.
14.7 Report it
Recovering stolen crypto is difficult, but reporting matters. It helps law enforcement build cases, and occasionally, funds are frozen and returned.
Report to the police and your country's cybercrime or fraud reporting service. Many countries have dedicated online portals.
Report to the exchanges where stolen funds are sent, if you can identify them from the block explorer. Exchanges can sometimes freeze funds that arrive in accounts linked to theft, especially when they receive reports quickly.
Report scam websites and accounts to the platforms hosting them, and to the impersonated project, so others are warned.
Inform your exchange if your exchange account was involved.
14.8 Beware the second scam
Within a day of posting about the theft on social media, Mint received five messages offering to recover the funds, for a fee. One claimed to be an investigator. Another said they were a "blockchain hacker." A third claimed to work for a government agency.
"All scams," said Hash. "As Chapter 11 said, anyone promising recovery for an upfront fee is almost certainly trying to take more from you. Real help doesn't arrive in your DMs."
Being targeted twice is painfully common. When you're upset and hoping to get your money back, you're at your most vulnerable. If you post publicly about a loss, expect these messages and ignore them.
14.9 Afterwards
A few days later, Mint was still shaken. "I feel so stupid."
"You made a mistake, and you're learning from it, which is more than most people do," said Hash. "And look at what went right. You noticed quickly. You knew to call. Your vault was separate. You've lost far less than you could have."
Losing money to a scam or mistake is stressful, and the feelings can last. It's worth talking to people you trust about it. Then, when you're ready, work out how it happened. Was it a seed phrase stored digitally? A signature you didn't read? A fake site found through a search? Most losses trace back to a habit that can be changed.
| How it happened | Habit that prevents it next time |
|---|---|
| Seed phrase stored digitally | Offline backups only (Chapter 4) |
| Typed seed phrase into a site | Never enter it anywhere except wallet restoration (Chapter 3) |
| Signed something unread | The five questions (Chapter 7) |
| Fake site from a search or link | Bookmarks only (Chapter 12) |
| Malware from a download | Official sources only, no files from strangers (Chapter 10) |
| Large holdings in a hot wallet | Separate vault, spending, and burner wallets (Chapter 12) |
14.10 Module 2 wrap-up
Mint, Node, and Hash met for coffee at the end of the module.
"When we started," said Mint, "I thought a wallet held my coins."
"And now?" asked Hash.
"Now I know it holds my keys. I know how seed phrases work and how to store them, how to set up a wallet and practise on a testnet, how hardware wallets protect keys, how to read what I sign, how approvals work and how to revoke them, how networks and gas work, how the major scams work, how to keep my devices and accounts clean, what multisig and smart accounts can do, and what to do if it all goes wrong."
Node nodded slowly. "I came into this module thinking self-custody was too risky. I still think it's a responsibility. But I understand it now, and I think I can handle it."
"That's exactly the right attitude," said Hash. "Respect it. Don't fear it."
14.11 Try it yourself
Write your own one-page emergency plan, using this chapter. Include where your backups are, which wallet is your vault, how to create a new wallet quickly, which approval checker you trust (as a bookmark), and where you would report theft in your country. Keep it with your other important documents, not on your computer.
Key takeaways from this chapter
- Diagnose first: wrong network, user mistake, malicious approval, or compromised seed phrase each need a different response.
- If your seed phrase is compromised, create a new wallet with a new seed phrase and move everything that remains.
- If specific tokens were taken through approvals, revoke unknown approvals on every network.
- Mistaken transfers can sometimes be recovered through exchanges or known recipients, but not through the blockchain.
- Document transaction hashes, addresses, and a timeline, and report to police, exchanges, and platforms.
- Recovery offers in your messages are almost always a second scam.
- Every loss traces back to a habit. Find it, fix it, and move forward.
Coming up in Module 3: How Blockchains and Transactions Work. Gas in depth, the mempool, transaction lifecycles, Layer 2 networks, bridges, finality, MEV, and how to read a block explorer like a professional.