If your wallet was drained or you think you were scammed, act quickly to protect any remaining assets. Follow the steps in this article before spending time figuring out exactly what happened.

Phantom is a self-custodial wallet: you control your private keys. Phantom cannot reverse transactions, freeze assets, or recover stolen funds. You can still secure remaining assets, report the scam, and reduce the risk of further loss.

Secure your remaining assets #

1. Disconnect suspicious apps #

Disconnect any app you do not recognize or no longer trust:

1. Select your profile avatar in the upper left.
2. Go to Settings > Connected Apps.
3. Disconnect unfamiliar apps, or select Disconnect All.

Disconnecting an app does not revoke spending permissions you may have granted it. Complete the next step to review and remove those permissions.

2. Revoke token approvals #

Some scams trick you into granting ongoing permission to move tokens. These permissions can remain active after you disconnect the app.

Use the tool for the network involved:

• Solana: Connect your Phantom wallet to Famous Fox's Revoker, then select Revoke all.
• Ethereum and EVM networks: Connect your Phantom wallet to Revoke.cash, review active permissions, and revoke anything you do not recognize.

3. Move trusted assets to a new wallet if needed #

If your recovery phrase, private key, or device may be compromised, stop using the old wallet. Create a new wallet and move any trusted remaining assets to it.

Do not transfer suspicious or unknown tokens. Interacting with scam tokens, including trying to send or swap them, can put your funds at risk.

Follow Move funds to a new Phantom wallet when you need to start over for detailed instructions.

Understand what may have happened #

Once you have secured your remaining assets, review the scenarios below. Identifying what happened can help you avoid another scam and provide details for a report.

You connected to a malicious site #

Scam sites can look like legitimate apps. They may ask you to approve transactions that give a scammer permission to move your tokens.

Common ways people reach these sites include the following:

• Phishing links in emails, DMs, Discord, Telegram, or X.
• Fake NFT mints or airdrop claim pages.
• Ads or search results that lead to cloned project websites.
• Links in token names or NFT metadata.

You exposed your recovery phrase or private key #

If you shared your recovery phrase or private key with someone, or entered it into a malicious website or app, treat the wallet as permanently compromised. Anyone with that information can control the wallet and steal assets sent to it later.

Create a new wallet and move any trusted remaining assets immediately. Do not continue using the compromised wallet.

Phantom Support will never ask for your recovery phrase.

You interacted with a scam token #

Scam tokens use several tactics:

• Fake airdrops: Tokens appear in your wallet with instructions to visit a malicious site to claim rewards.
• Pump-and-dump schemes: Scammers promote a token, wait for its price to rise, then sell their holdings and crash the price.
• Honeypots: You can buy the token but cannot sell it.
• Rug pulls: Creators attract buyers, then remove liquidity or abandon the project.
• Impersonation tokens: Tokens copy a legitimate project’s name, logo, or branding.

Receiving a scam token does not harm your wallet by itself. The risk comes from interacting with it: following links, trying to swap or sell it, or approving transactions.

You do not know how it happened #

Scammers often hide how they gained access. If you cannot identify the cause, treat the wallet as compromised and follow the steps above.

Possible causes include the following:

• Malware, such as keyloggers, clipboard hijackers, or malicious browser extensions.
• Phishing sites that impersonate Phantom.
• Fake Phantom apps downloaded from unofficial sources.
• Someone accessing a recovery phrase stored in cloud storage, a screenshot, or a notes app.

Report the scam #

Reporting does not guarantee recovery. It creates a record that may help investigators, exchanges, and other users. In some cases, particularly those involving large losses, reports have helped law enforcement or exchanges freeze or recover assets.

Gather any details you have:

• Transaction hashes.
• Scammer wallet addresses.
• Related website URLs, social profiles, and messages.
• Screenshots, dates, and estimated amounts lost.

Submit a Chainabuse report #

Report the scam on Chainabuse, a public blockchain threat reporting platform used by investigators, exchanges, and security researchers.

Your report links a public record to the scammer’s wallet address so others can find it and contribute information.

Contact law enforcement #

• Local police: File a report with your local law enforcement agency and ask for a case number. You may need it for an insurance claim or further action.
• FBI (US only): Submit a report to the Internet Crime Complaint Center at ic3.gov. IC3 has worked with exchanges and financial institutions to freeze stolen crypto in past cases.

Watch for recovery scams. Be cautious of anyone who promises to recover your crypto for a fee or asks for access to your wallet. Recovery scammers often target people who have already lost funds.

Can stolen funds be recovered? #

Phantom cannot reverse blockchain transactions or access, freeze, or recover your funds. As a self-custodial wallet provider, Phantom does not have access to your private keys.

Law enforcement may be able to help in some cases, including by working with exchanges to freeze scammer accounts. Recovery is not guaranteed. Even when funds cannot be recovered, a report may help future victims and investigations.

Reduce the risk of another scam #

Protect your recovery phrase #

Your recovery phrase controls access to your wallet.

• Write it down and keep it in a secure offline location.
• Never store it in photos, notes apps, email, or cloud storage.
• Never enter it into a website. You do not need it to connect to a dApp.
• If you created your wallet with a Google or Apple account, protect your account password and four-digit PIN.

Check apps, websites, and tokens #

• Connect only to apps you trust. Search for apps to connect in Phantom.
• Verify project URLs through official sources, such as the project’s website, X account, or Discord. Do not trust links from DMs, ads, or comments.
• Before swapping, check the token’s contract or mint address using trusted sources such as CoinGecko, Solscan, or Etherscan.

Use Phantom’s security tools #

• Transaction previews: Phantom simulates transactions and flags suspicious activity. If you see a warning, stop.
• Spam detection: Phantom automatically identifies and hides suspicious NFTs and tokens.
• Auto-lock: Go to Settings > Security & Privacy > Use Face ID Authentication (mobile app) or Auto-Lock (browser extension) to set Phantom to lock when it is not in use.

Leave unknown tokens and NFTs alone #

• Do not follow links in token names or NFT descriptions.
• Do not try to swap, sell, or send unknown tokens.
• Hide and report suspicious NFTs.

Use a separate wallet for new apps #

Create a separate wallet for activities such as testing an app or minting an NFT. Fund it with only what you need. Afterward, revoke approvals and move any remaining funds before deleting the wallet.

Consider a hardware wallet #

Devices such as Ledger provide additional protection by keeping your private keys on the hardware device.

Learn how to use Ledger with Phantom on desktop or mobile.

Review permissions regularly #

Check and revoke permissions for apps you no longer use. This reduces exposure from past activity and the risk of future unauthorized transfers.