Check the chain before resetting anything
Use the previously recorded public address on the correct explorer. Record outgoing transactions, their times and destinations. An empty app can mean a disabled network, a different account or a different passphrase, as Trezor's balance troubleshooting guide explains. Do not erase your only device before verifying its backup.
| What happened? | Main concern | First response |
|---|---|---|
| Device missing; no unusual transfer found | Someone may possess the hardware | Locate the trusted backup and prepare safe recovery and migration |
| Recovery words photographed or submitted to a fake site | Keys may have been copied | Prepare entirely new keys; stop receiving at old addresses |
| Suspicious approval followed by token losses | A contract may retain spending permission | Inspect transactions and permissions, without assuming the seed is safe |
| New gas deposits disappear immediately | Possible automated sweeper | Stop repeated top-ups and seek verified specialist assistance |
If only the hardware is missing
Crypto is not stored inside the case, but physical protection is not a permanent guarantee against an attacker. Arrange a trusted replacement that supports your backup format. Recovery may also need the original passphrase or enough backup shares. Do not rush into a “recovery wallet” found in an advertisement.
Restoring the same backup on another device does not remotely disable the missing one. Both can hold the same keys. If theft cannot be ruled out, plan to move remaining assets to independently generated keys after safe restoration. A purchase receipt cannot replace a missing backup, and support cannot reset blockchain private keys.
If the backup may be exposed
Trezor's migration guidance treats suspected backup compromise as a reason to move funds. The destination needs a fresh backup from a separate, trusted device, not another import of the exposed words.
- Create and check the new wallet in a clean environment. Do not erase your only remaining means of controlling the old funds first.
- Inventory networks, accounts, tokens, NFTs and assets still staking or awaiting unlock. One new account does not address other accounts derived from the exposed backup.
- If the old signing environment remains trustworthy and there is no sweeper indication, verify complete destinations and migrate controllable assets. Account for fees needed by subsequent transfers; consult MetaMask's asset-migration checklist.
- Replace saved withdrawal addresses and payment instructions. Stop receiving under the exposed backup and check for residual assets on other networks.
If the hardware itself is suspect, do not generate new secrets or enter a passphrase on it. Follow our supply-chain response checklist and contact the manufacturer through a verified channel. Changing a PIN, reinstalling software, updating firmware or revoking approvals does not invalidate copied private keys.
If the evidence points to a malicious approval
Check the affected token, spender and transaction before taking action. A relevant approval may need revocation through a trusted interface. MetaMask explains that disconnecting a dapp does not remove on-chain token permissions. Different signature and permission types can require different handling.
Use our approval-revocation guide as a starting point, not a promise that one button cleans every exposure. Loss of only one token does not prove the recovery phrase was never copied. Avoid further risky interactions while the cause remains unresolved.
If gas keeps disappearing
Repeatedly adding ETH, TRX or another fee asset can increase losses if an automated sweeper controls the account. MetaMask's incident guidance warns against adding gas when a sweeper is suspected. Recovery options depend on the chain, contracts and remaining assets; a stranger's paid “unfreeze package” is not a solution.
Keep evidence, not promises
Preserve public addresses, transaction hashes, network names, timestamps with time zones, suspect domains, order records and relevant messages. Never include recovery words in evidence screenshots. If personal safety is at risk, prioritize that before technical troubleshooting.
Submit evidence through independently verified manufacturer, exchange and local reporting channels. An exchange's ability to restrict downstream funds depends on the case; it is not guaranteed. Avoid anyone demanding a deposit, tax or validation payment for “100% recovery.” Rebuild with our setup and backup-check tutorial, and use the wallet scam self-check to review exposure.
Reviewed October 18, 2026. General incident education, not a substitute for investigation of the specific device and blockchain transactions.