If someone stole my crypto from Trust Wallet, what should I do? Short answer: act quickly, document everything, and stop using the compromised device. You will need a clear transaction trail (hashes and timestamps), proof of ownership, and an immediate plan to secure any remaining funds. I’ve seen this happen to users who clicked a malicious dApp link or approved an unlimited token allowance. And yes, that panic is normal.
Quick checklist — immediate actions
- Stop using the compromised device or app.
- Open the wallet on a different, secure device only if you know the seed phrase is safe.
- Copy transaction hashes and destination addresses (take screenshots).
- Check token approvals and revoke dangerous allowances (revoke approvals guide).
- Create a new wallet on a clean device (prefer hardware for large balances).
- Report the theft (wallet support, exchanges where funds may land, and local law enforcement).
Step-by-step: What to do right now (How to act fast)
Step 1: Freeze activity and document everything
Do not make any more transactions from the compromised wallet. Take screenshots of the wallet home screen, balances, and the outgoing transaction(s). Write down the exact time. These screenshots are the basic evidence you’ll need when you report the incident.
Step 2: Find the transaction on a block explorer
Open the proper block explorer for the chain where the funds left your account (for EVM-compatible chains there are specific explorers; Solana and Bitcoin have their own). Paste your wallet address and look for outgoing transactions. Copy the transaction hash (txid), destination address, and token contract address.
A transaction record shows where the tokens went, and whether a contract was called (for example a router contract or an approval-reliant drain). In my experience a quick look at the first outgoing transaction tells you if this was a direct transfer or a smart-contract drain (transferFrom pattern). (Yes, you should grab that txid now.)
Step 3: Check token approvals and revoke if possible
A common vector is an unlimited token allowance given to a malicious contract. That lets the contract call transferFrom and drain tokens later. Use an approvals checker or follow the steps in our revoke approvals guide to see approved contracts and revoke access. But don't revoke from a compromised device — use a safe browser or a new phone.
Step 4: Decide whether to move remaining funds
If the seed phrase was not exposed and only the app or device is compromised, restore the wallet on a clean device and move funds to a new seed stored offline. If the seed phrase was exposed, do not restore it anywhere — create a brand-new wallet (ideally a hardware wallet) and move funds if you can do so faster than the attacker (this can be risky). Hardware wallets can prevent a remote attacker from signing transactions; that trade-off is one reason I use one for substantial amounts. But don't rush without a clean device.
Step 5: Report and gather evidence
Gather: wallet address, txid(s), timestamps, token names and amounts, destination addresses, screenshots, and any phishing link or dApp you interacted with. Report the theft to the wallet’s official support channel (beware of imposters) and to exchanges where the thief might try to cash out — exchanges can freeze funds if they’re alerted quickly and given the txid and KYC evidence. File a report with local law enforcement and consider the FBI Internet Crime Complaint Center if you’re in the U.S.
Why thefts happen (common attack paths)
- Phishing dApps or fake in-app browsers that request approvals.
- Malicious WalletConnect sessions (an injected provider can ask to sign dangerous transactions).
- Compromised device (malware on mobile/desktop capturing seed phrases).
- Social engineering and SIM swaps used to access accounts tied to exchanges.
I once approved a token contract without checking the code, then watched the router call pull my tokens. That mistake taught me to always review the contract address and approval scope.
Tools and services to trace stolen funds
- Block explorers (paste the txid and follow the destination chain of transactions).
- Address tagging services (some explorers and analytics tools show if an address belongs to a known exchange).
- For urgent tracking, supply txids to exchange compliance teams (they may request a police report and KYC documentation).
Be cautious with paid tracing services; they can help but won’t always recover funds. And remember that privacy coins and complex mixer chains make recovery far less likely.
Form factor comparison: mobile app vs extension vs hardware
| Wallet form |
When to use |
Pros |
Cons |
If compromised — immediate action |
| Mobile software wallet (app) |
Daily spending, dApps on phone |
Very convenient; mobile dApp browser |
Higher exposure to mobile malware and phishing |
Stop using phone; use a clean device to check txs; restore only if seed phrase safe |
| Browser extension |
Quick desktop interactions, DeFi |
Good UX for DeFi; easy WalletConnect pairing |
Browser exploits, malicious sites can prompt approvals |
Disconnect extension; check txs from another device; revoke approvals if possible |
| Hardware wallet |
Long-term storage, large holdings |
Private keys never leave device; safer signing |
Less convenient for frequent swaps |
Use hardware to move funds; no seed entry on internet-connected devices |
This table helps clarify trade-offs. If you had a hot wallet and lost funds, consider whether the convenience you picked matches the risk you took.
Step-by-step guides and related resources
These pages walk through secure restores, backups, and how to harden your setup.
FAQ — real questions people search for
Q: Is it safe to keep crypto in a hot wallet?
A: Hot wallets are convenient for day-to-day use but carry higher risk than hardware wallets. For small amounts and active DeFi use they’re fine; for life-changing sums, consider a hardware wallet. (In my experience you pay for convenience with slightly lower security.)
Q: How do I revoke token approvals?
A: Use an approvals checker or the revoke section in a block explorer. See our step-by-step: revoke approvals guide.
Q: Can stolen crypto be recovered?
A: Sometimes — if funds hit a centralized exchange and you report quickly, they may freeze the assets. But if funds move through mixers or to non-cooperative wallets, recovery is unlikely.
Q: I sent crypto to wrong address Trust Wallet — what now?
A: If you sent tokens to the wrong address on-chain the transfer is usually irreversible. If the address belongs to an exchange, contact their support with the txid. For cross-chain mistakes, recovery may be possible if the receiving platform supports manual recovery (rare).
Conclusion & next steps
If you searched for "someone stole my crypto from Trust Wallet" or "trust wallet lost crypto," treat this as a pattern: document, stop, trace, revoke, and report. But don't act recklessly with your seed phrase; a compromised seed means you must move funds using a secure device and preferably a hardware wallet. For step-by-step walk-throughs, start with backup & recovery, check revoke approvals, and follow the lost-device checklist at lost-phone-recovery. But don't rely on one article — follow the links above and take action now.
If you want, I can walk you through the exact commands to check a transaction hash or the fields to include in an exchange or police report — just tell me which chain (Ethereum, BNB Smart Chain, Solana, etc.) you're tracking and I’ll outline the next steps.
