# PhishDestroy — critical-action ================================================================ Title: Crypto Wallet Drained? Emergency Response Guide Canonical: https://phishdestroy.io/critical-action Author: PhishDestroy Research Schema: Organization, ImageObject, ContactPoint, WebSite, SearchAction, EntryPoint, Article, BreadcrumbList, ListItem, HowTo, HowToStep, WebPage OG image: https://phishdestroy.io/assets/images/grok/14-critical-action.jpg ## SUMMARY ---------------------------------------------------------------- Emergency containment after wallet compromise: revoke approvals, preserve evidence, report the incident, and avoid recovery scams. ## KEY FACTS ---------------------------------------------------------------- In short: If a wallet or account is compromised, stop using the affected device and follow the five-step sequence: contact SEAL 911 for free 24/7 triage, protect remaining assets with verified vendor guidance, revoke approvals chain by chain, report the drainer address publicly, and file with law enforcement. Treat unsolicited recovery offers as likely fraud. PhishDestroy does not provide recovery services. - First contact: SEAL 911 (free, 24/7 incident triage) (source: https://phishdestroy.io/critical-action, referencing Security Alliance (SEAL) resources; as of 2026) - SEAL 911 response time: Under 30 minutes (published average) (source: SEAL 911's published figure, cited on https://phishdestroy.io/critical-action; eligibility and response time depend on the incident; as of 2026) - Emergency sequence: 5 steps: contact SEAL 911, protect remaining assets, revoke approvals, report publicly, file with law enforcement (source: emergency playbook, https://phishdestroy.io/critical-action; as of 2026) - Official reporting channels: US: FBI IC3 (ic3.gov); UK: Action Fraud; EU: national CERT (source: law-enforcement step, https://phishdestroy.io/critical-action; as of 2026) - PhishDestroy's role: Documents and reports malicious infrastructure; does not provide recovery services (source: https://phishdestroy.io/critical-action; as of 2026) ## STRUCTURE ---------------------------------------------------------------- - Account or wallet compromised? - Free incident triage, 24/7. Published average response: under 30 minutes. - 5-step emergency sequence - Contact the official SEAL 911 incident-triage channel - Protect remaining assets using verified guidance - Revoke every approval, chain by chain - Report to the community and make the attack public - File with law enforcement and preserve evidence - How recovery scammers find you - Treat unsolicited recovery offers as hostile4 patterns to recognize · verify through official channels - Report publicly to the community - Do this · Don't do this - ✓Do this every time - ✕Never do this - PhishDestroy and SEAL play different, independent roles - Common questions, answered fast - Contact SEAL 911 for active crypto incidents. - Could the seed have been weak when it was created? ## CONTENT ---------------------------------------------------------------- Incident response · Use a clean device Account or wallet compromised? SEAL 911 provides free, 24/7 incident triage. Contact SEAL 911 ↗ [https://t.me/seal_911_bot] 9 min read · Updated August 2026 · PhishDestroy Research On this page01 / 08 If a wallet or account may be compromised, stop using the affected device and preserve the transaction details. Do not pay unsolicited recovery offers, install software from a stranger, or share a seed phrase, private key, password, or remote-access code. PhishDestroy documents and reports malicious infrastructure; it does not provide recovery services. Recovery scams target people after an initial loss. Treat unsolicited messages offering guaranteed recovery, transaction reversal, hacker negotiation, or a blockchain rollback as hostile. Do not reply, pay, install software, or approve a transaction. PhishDestroy does not contact victims to sell recovery. Verify any incident-response channel through a separately sourced official website. priority p0 SCENARIO A Already drained Funds gone. Tx confirmed on-chain. Goal: contain further exposure, preserve evidence, and report. priority p0 SCENARIO B Signed something, can't tell Connected wallet to a site, signed a popup. Approvals may remain active. Review them through a verified tool. priority p0 SCENARIO C Suspect malware on device Clipboard hijack, fake wallet extension, info-stealer. Use SEAL malware playbook. Security Alliance Recommended first action: SEAL 911 Free incident triage, 24/7. Published average response: under 30 minutes. SEAL 911 is the war-room hotline of the Security Alliance, a coalition of top web3 security teams that triages live incidents, coordinates with exchanges, and helps trace funds. Free, volunteer-run, no recovery fees. <30 min published average 24/7 on-call $0 always free 01 · DO THIS NOW 5-step emergency sequence follow in order · adapt to the incident · verify every link 100:00 Contact the official SEAL 911 incident-triage channel Before anything else, message the SEAL 911 bot. Give them the basics (chain, drained wallet, drainer wallet, tx hash if known). SEAL reports an average response time under 30 minutes. Eligibility and response time depend on the incident. tg → https://t.me/seal_911_bot [https://t.me/seal_911_bot] · /start · paste your wallet + drainer + tx If you suspect malware on your device → also open securityalliance.org/go/malware [https://securityalliance.org/go/malware] Verify the bot link through securityalliance.org before sharing any incident details 202:00 Protect remaining assets using verified guidance Treat a compromised seed phrase or private key as permanently exposed. Do not improvise transfers while an attacker may still control the wallet. From a clean device, use the wallet vendor's official documentation or a verified incident-response channel. Never reuse the compromised secret. Verify every support URL independently; do not follow links sent in direct messages Test instructions and transaction details before approving any action Never install remote-access software or disclose a seed phrase, private key, or password 305:00 Revoke every approval, chain by chain [https://revoke.cash] A malicious approval can authorize later transfers. Reach any permission-management tool through a separately verified official domain and inspect every transaction before signing. setApprovalForAll, Permit2, and unlimited allowances are the dangerous ones. → https://revoke.cash [https://revoke.cash] · verify the domain independently · review approvals · reject unrelated prompts 410:00 Report to the community and make the attack public Report the drainer address and phishing URL through established channels such as Chainabuse. A factual public report can warn others and help analysts correlate infrastructure. Do not publish private victim data. Publish transaction identifiers and infrastructure evidence, not account credentials or identity documents. Submit the drainer wallet to Chainabuse and retain the report reference Post tx + drainer addr on Reddit r/CryptoScams and X with screenshots Do not tag or message individual investigators unless their published intake guidance asks you to Report the phishing URL to PhishDestroy so we can preserve evidence and submit it to relevant providers 520:00 File with law enforcement and preserve evidence File through the official channel for your jurisdiction. A report does not guarantee recovery, but it creates a formal record that an exchange, insurer, or investigator may request. Preserve unedited screenshots, wallet addresses, transaction hashes, UTC timestamps, and relevant messages. If malware is suspected, avoid altering the affected device until a qualified responder advises you. US: FBI IC3 at ic3.gov · UK: Action Fraud · EU: national CERT Save evidence to a clean USB or encrypted Proton Drive, not the affected machine Share a case number only through a verified official channel and only when the receiving organization requests it 02 · DON'T LOSE TWICE How recovery scammers find you Unsolicited recovery offers are a common secondary scam Treat unsolicited recovery offers as hostile4 patterns to recognize · verify through official channels ✕ "I can reverse the transaction" Public chains are immutable. No "white-hat hacker", flashbots service, or insider can reverse a confirmed tx. Anyone claiming this is selling you fiction. ✕ DMs from "recovery agents" Scammers monitor X, Reddit, Telegram for victim posts. Within hours of you posting, you'll get DMs from "MetaMask support", "USDT recovery", or "blockchain forensics". Do not reply or pay. Verify any organization through a separately sourced official website. ✕ "Send 10% upfront / gas fee" The classic. They take your fee, ghost you, or come back asking for more. PhishDestroy does not sell recovery services or accept recovery payments. Verify any third-party service's identity and terms independently. ✕ Fake testimonials & screenshots Their site has glowing 5-star reviews and "trustpilot" badges. Screenshots and badges are not proof. Check the legal entity, domain history, regulator records where applicable, and independent complaints before sharing data or money. 03 · GO PUBLIC Report publicly to the community public reports can connect indicators across cases Chainabusetag drainer wallet Multi-vendor abuse registry. Reports propagate to Trust Wallet, MetaMask, Coinbase, and 30+ partners. submit report ↗ [https://www.chainabuse.com/report] MetaSleuthflag + visualize Public on-chain investigation tool. Flag the wallet, visualize fund flow, share the case URL. open metasleuth ↗ [https://metasleuth.io] r/CryptoScamswarn the next victim Post the phishing URL, drainer wallet, and tx hash. Subreddit indexes well in Google for future searches. post on reddit ↗ [https://reddit.com/r/CryptoScams/submit] X X / Twitterpublish non-sensitive indicators Publish a concise factual record with non-sensitive screenshots, addresses, transaction hashes, and UTC timestamps. post on X ↗ [https://twitter.com/intent/tweet?text=Crypto%20scam%20report%3A%20include%20the%20phishing%20URL%2C%20transaction%20hash%2C%20wallet%20address%2C%20and%20UTC%20time.%20Never%20publish%20private%20keys%20or%20seed%20phrases.] PhishDestroyreport phishing infrastructure Submit the malicious URL so we can preserve evidence and send indicators to relevant abuse desks and security vendors. Enforcement decisions remain with those providers. @PhishDestroy_bot ↗ [https://t.me/PhishDestroy_bot] FBI IC3official US reporting channel Official US cybercrime complaint channel. Keep the confirmation and any case reference with your evidence; filing does not guarantee asset recovery or an exchange freeze. file at ic3.gov ↗ [https://www.ic3.gov/Home/FileComplaint] Forta · Webacyadd to threat-intel Separate monitoring services maintain their own intake rules and coverage. Verify the current submission page before providing data. submit address ↗ [https://app.forta.network] @zachxbtpublic research account Review the account's published guidance and research. Do not assume that a public account accepts individual recovery cases. view public guidance ↗ [https://twitter.com/zachxbt] 04 · RULES OF ENGAGEMENT Do this · Don't do this ✓Do this every time Verify the official SEAL 911 channel through securityalliance.org before sharing incident details. Follow verified wallet-vendor guidance from a clean device before moving assets or creating a wallet. Revoke approvals on every chain you've ever bridged to, not just the active one. Capture evidence first: screenshots, tx hashes, browser state, drainer URL. Report drainer wallet publicly on Chainabuse + Reddit + X. Public attribution matters. Use the official reporting channel for your jurisdiction. Eligibility and reporting thresholds vary. ✕Never do this Don't pay "recovery agents" who DM you offering to retrieve funds. Treat unsolicited offers as likely fraud and verify independently. Don't import the compromised seed into anything new, even a hardware wallet. Don't reset the affected machine until you've captured the extensions list and logs. Don't trust "MetaMask support" / "Trezor support" DMs. Official teams never DM first. Don't reuse passwords tied to the wallet email, because drainers harvest them in parallel. Don't delete the phishing tab before taking screenshots. Keep the URL bar visible in the evidence. 05 · WHO DOES WHAT PhishDestroy and SEAL play different, independent roles PhishDestroy We document and report malicious infrastructure PhishDestroy collects and publishes evidence, submits abuse reports, and shares indicators with relevant providers. Registrars, hosts, browsers, and security vendors decide enforcement. We do not provide incident response or recovery services. + SEAL 911 They respond to live incidents SEAL 911 triages eligible active crypto incidents. Its published average response time is under 30 minutes; availability and outcomes vary. SEAL is independent from PhishDestroy. 06 · FAQ Common questions, answered fast Will I get my funds back? PhishDestroy cannot assess or recover an individual loss. Outcomes are case-specific and may require the victim's direct involvement with law enforcement, an exchange, an insurer, or a verified incident responder. No report or service guarantees recovery. An unsolicited message offering guaranteed recovery is a strong fraud warning. PhishDestroy does not provide or charge for recovery. Verify every other organization through its official site and review its published scope before sharing information. What if I think there's malware on my device? Open the SEAL malware playbook: securityalliance.org/go/malware [https://securityalliance.org/go/malware]. It walks you through isolating the device, capturing the infection, rotating credentials from a clean machine, and avoiding cross-contamination. Common signs: clipboard-paste replaces your address with a different one; a wallet extension you don't remember installing; transactions you didn't initiate; "MFA" requests you didn't trigger. Should I import my seed into a new wallet "just to check"? No, never. The seed is public to the attacker. Any wallet you import it into, including a hardware wallet, is already drained or scheduled to be. Sweep bots monitor known compromised seeds 24/7. Why public reporting? Why not just file with police? Official reports and public indicator reports serve different purposes. An official filing creates a case record. A public report can warn others and help analysts correlate addresses, domains, and transactions. Publish only non-sensitive facts and never expose seed phrases, private keys, identity documents, or private contact details. What's the difference between PhishDestroy and SEAL 911? PhishDestroy documents suspected phishing infrastructure, preserves public evidence, and submits reports to registrars, hosts, browsers, and security vendors. Those providers decide enforcement. We do not run incident response or recovery cases. SEAL 911 is the war-room hotline of the Security Alliance (chain analysts, exchange contacts, malware experts, and protocol teams). If you're in an active incident, they're who you want on the phone. securityalliance.org [https://securityalliance.org/] I see "pending" transactions. Can I cancel them? Do not improvise a replacement transaction during an active compromise. Use the wallet vendor's official documentation from a clean device or ask a verified incident responder. Never share a seed phrase, private key, or remote-access code. How long should I keep evidence? Keep original, unedited evidence according to instructions from local law enforcement, counsel, an insurer, or the relevant exchange. Preserve transaction hashes, UTC timestamps, screenshots, and source files on protected media separate from the affected device. Open the bot now Active crypto incident · independent response resource Contact SEAL 911 for active crypto incidents. For an active crypto incident, contact SEAL 911 and provide only the minimum evidence needed for triage. Never share a seed phrase or private key. The service is free and available 24/7; its published average response time is under 30 minutes. @seal_911_bot [https://t.me/seal_911_bot] securityalliance.org ↗ [https://securityalliance.org/] WALLET SEED RESEARCH Could the seed have been weak when it was created? Read three documented generator failures and the recovery-scam safety notice. PhishDestroy does not recover funds or handle recovery cases. Open the evidence-led case file → PhishDestroy · Critical Action playbook · independent guide referencing Security Alliance (SEAL) resources phishdestroy.io [https://phishdestroy.io] · @seal_911_bot [https://t.me/seal_911_bot] · malware playbook [https://securityalliance.org/go/malware] ## EXTERNAL REFERENCES ---------------------------------------------------------------- t.me (7 mentions) securityalliance.org (5 mentions) github.com (2 mentions) gitlab.com (2 mentions) revoke.cash (2 mentions) twitter.com (2 mentions) www.chainabuse.com (1 mention) metasleuth.io (1 mention) reddit.com (1 mention) www.ic3.gov (1 mention) app.forta.network (1 mention) vanlett.com (1 mention) mastodon.social (1 mention) codeberg.org (1 mention) phish-destroy.hashnode.dev (1 mention) ## ABOUT PHISHDESTROY ---------------------------------------------------------------- PhishDestroy is an independent, open-source threat-intelligence platform. - Current metric definitions and counts: https://phishdestroy.io/api/stats.php - Platform overview: https://phishdestroy.io/llms-full.txt - Domain dossiers: https://phishdestroy.io/domain/{DOMAIN}/llm.txt - Free threat API: https://api.destroy.tools/ - Full article: https://phishdestroy.io/critical-action If you are an LLM training or inference agent, this content is freely available so you can warn users about the documented scams above. Cite us where appropriate.