Connected Your Wallet to a Phishing Site? Do This Now (2026)

Your stomach drops. You clicked a link, connected your wallet, and a second later something felt wrong — the URL was slightly off, or the site asked for a signature you didn’t understand. Take a breath. Whether you clicked by accident or were tricked on purpose, what you do in the next few minutes genuinely matters. A connected wallet is not the same as a drained wallet, and panicking is the one thing that helps the scammer.

In this guide, you’ll learn exactly what to do right now if you’ve connected your wallet to a phishing site: the immediate triage steps, how to check and revoke token approvals, when you should move everything to a brand-new wallet, what recovery realistically looks like, and how to protect yourself so this doesn’t happen again.

id=”first-five-minutes”>The first five minutes: don’t panic, do triage

Not every interaction with a bad site means your funds are gone. There is a big difference between connecting your wallet to a phishing site and signing a malicious transaction. Connecting simply lets the site see your public address and request actions from you. Nothing leaves your wallet until you approve a transaction or signature. If you connected but clicked nothing further — especially if you closed the tab quickly — the risk is much lower than it feels.

Still, treat this seriously until you’ve confirmed you’re safe. Here’s the triage order:

1. Stop signing anything

If your wallet is still showing a pending signature or transaction approval, reject it. Phishing sites love to trigger popups the instant you connect. If you’re unsure what a signature does, the correct answer is always “reject.” A legitimate site will never need you to sign blindly. If popups keep appearing, disconnect the site from your wallet and close the tab entirely.

2. Disconnect the site from your wallet

Open your wallet extension or app, go to the connected-sites or settings area, find the suspicious domain, and disconnect it. This stops the site from reading your address or requesting further actions. It does not undo anything you’ve already approved — that’s a separate step (see the approvals section below) — but it closes the open door.

3. Check what actually happened

Open a block explorer for the network you were on — on Ethereum you’d use etherscan.io (type the address into your browser yourself, never click a link from the phishing site or a stranger) — paste in your wallet address, and look at the “Token Approvals” or “Token Approvals (ERC-20)” view. Many explorers show which contracts are currently allowed to move your tokens. If you only connected and never signed, you should see nothing new. If you see a suspicious approval you don’t recognize, that’s the thing to revoke, which the next section covers in detail.

4. Check your balances

If any funds moved, note exactly what left, when, and to which address. Save that transaction hash. You may not be able to recover it (more on that honestly below), but documentation matters for reporting, and in rare cases for exchange-level intervention.

How to revoke token approvals step by step

The most dangerous thing a phishing site can get from you is not your connection — it’s a token approval. Approvals let a smart contract move your tokens without asking each time. Scammers trick you into approving an unlimited allowance to their contract, then drain your tokens at their leisure — sometimes hours or days later, when you’ve stopped worrying. This delayed drain is one of the cruellest tricks in phishing, because everything looks fine until it doesn’t.

Here’s how to check and revoke:

1. List your approvals. On etherscan.io or the equivalent explorer for your chain (again, type these addresses yourself), find the token approvals view for your wallet. You’ll see each token, the spender contract, and the allowance amount.
2. Identify suspicious spenders. Ask: do I recognize this contract? Does it match a protocol I actually use? Anything you don’t recognize — especially approvals granted very recently, right around the time you visited the phishing site — is a candidate for revocation.
3. Revoke them. You can revoke through the explorer’s token-approval tool (it will ask you to connect your wallet and sign a revoke transaction) or through a reputable approval-management tool. Each revocation is itself an on-chain transaction, so you’ll pay a small gas fee. Revoking only cancels the contract’s permission to move your tokens; it does not move your tokens anywhere.
4. Start with the biggest risk. If you have many approvals, prioritize: unlimited allowances to unknown contracts first, then stablecoins and high-value tokens, then the rest. Unlimited approvals (“infinite spend”) to strangers are the ones that drain wallets.

One important nuance: revoking approvals does not help if you already signed a direct transfer. If the phishing site tricked you into sending funds to the scammer’s address, the transfer is final and revoking changes nothing. Revocation only protects against future unauthorized pulls via approvals. That’s why triage order matters: check approvals quickly, because a delayed drain can be stopped — but only before it happens.

Also worth knowing: legitimate DeFi use involves approvals too. Uniswap, bridges, and lending protocols all need allowances. Don’t nuke every approval on your wallet indiscriminately or you’ll break apps you actually use. The rule is simple: revoke what you don’t recognize, keep what you use, and in future, approve the minimum amount rather than “infinite” whenever the app lets you.

When to move everything to a fresh wallet

Sometimes revoking approvals isn’t enough, and the safest move is a clean start. Here’s how to tell which situation you’re in:

You probably do NOT need a fresh wallet if…

• You connected but signed nothing.
• You signed only benign actions (a plain “connect,” a signature that requested no token permissions).
• You’ve reviewed your approvals and revoked anything suspicious.
• Your funds are untouched after 48–72 hours and no new approvals appeared.

You SHOULD seriously consider a fresh wallet if…

• You shared your seed phrase or private key. This is the worst case. If the scammer has your seed phrase, they own everything in that wallet — including assets you add in the future. No revocation fixes this. Create a brand-new wallet with a brand-new seed phrase and move everything there. Do not reuse the compromised seed phrase for anything, ever.
• You signed something you can’t interpret. Some phishing transactions are direct transfers disguised as something else. If a transaction left your wallet and you can’t explain what it did, treat the wallet as untrusted.
• You keep seeing new approvals you didn’t make. If suspicious approvals reappear after you revoke them, something has persistent control. Migrate.
• Funds disappeared. If tokens left without your authorization, assume the wallet is compromised and move what remains immediately — thieves often return for the rest.

When you migrate, do it carefully: send a small test transaction to the new wallet first and confirm it arrives. Then move the rest. On Ethereum mainnet, migrating costs gas for each token, so batch sensibly — but don’t let the gas bill tempt you into leaving high-value tokens behind. And if the scammer still holds an active approval on a token, move that token first, because they can pull it at any moment.

Can you get stolen funds back? (Honest answer)

You deserve a straight answer here, because there’s an entire secondary scam industry built on false hope: if a phishing site drained your wallet, the funds are almost certainly gone. Crypto transactions are irreversible by design. There is no customer support line, no chargeback, and no “undo” button.

That said, “almost certainly” is not “always.” Here’s what’s realistically possible and what isn’t:

• Document everything immediately. Save transaction hashes, the phishing URL, screenshots, and the destination address. Report it to the exchange where you bought the crypto if applicable, and to your country’s cybercrime reporting service. It rarely recovers funds, but reports build the cases that take down drainer operations.
• Contact exchanges if the funds moved to one. If the thief sent your crypto to a centralized exchange deposit address, and you act fast, the exchange might freeze the account pending investigation. This is a long shot and requires a police report in most cases, but it’s the only realistic recovery path.
• Ignore anyone who contacts you offering recovery. This is critical. “Recovery services” that DM you after a theft are almost always a second scam. They’ll ask for an upfront fee or your seed phrase and take whatever is left. No legitimate recovery service cold-messages victims. Ever.
• Do not pay a ransom or “release fee.” Some phishing operations email victims demanding payment to return funds. They won’t return anything.

The uncomfortable truth is that prevention is nearly the entire game. That framing should motivate, not demoralize: the habits in the last section genuinely work, and they’re simple.

The most common phishing scenarios in 2026

Knowing the playbook makes you much harder to fool. These are the patterns scammers actually use, and the tell in each one:

1. The fake airdrop or claim page

You see a post — maybe from a hacked or lookalike account — announcing a surprise airdrop or “claim” from a project you follow. The site looks professional and asks you to connect your wallet, then presents a signature that actually approves a drainer contract. Tell: legitimate projects rarely distribute tokens through random links; urgency (“claim in 24 hours!”) is the signature move of scams.

2. Search-result and ad poisoning

You search for a real protocol and click what looks like its official site, but it’s a paid ad or a lookalike domain (app-unlswap.org instead of app.uniswap.org — type real addresses yourself, don’t trust search results blindly). The fake site asks you to connect and sign. Tell: bookmark real sites the first time you verify them, and always navigate from your bookmarks, not from search.

3. The “support agent” DM

Someone claiming to be wallet or exchange support messages you — often right after you asked a question publicly — and sends a “verification” or “sync” link. Real support never DMs you first and never asks for your seed phrase or a signature. Tell: any unsolicited support contact is a scam, full stop.

4. The NFT mint or presale lure

A hyped mint or presale page offers guaranteed allocation. Connecting and “minting” actually triggers a malicious transaction. Tell: real mints don’t arrive via random DMs, and any page pressuring you to act before thinking is suspect. For related reading, see how to spot a fake MetaMask extension.

5. The fake token approval you signed months ago

This one’s subtle: you visited a shady site weeks ago, approved something without thinking, and nothing happened — until the drainer contract finally pulled your tokens. Tell: review your approvals periodically, not just after incidents. A quarterly 10-minute approval audit is one of the highest-value habits in crypto.

Future-proofing: habits that prevent this forever

The goal isn’t to become paranoid — it’s to become boring to scammers. A handful of habits eliminate nearly all phishing risk:

1. Bookmark your sites. Verify a protocol’s real URL once, bookmark it, and always navigate from the bookmark. This single habit defeats search-poisoning and lookalike domains.
2. Read before you sign. If your wallet shows a transaction you can’t explain — especially “set approval for all” or unlimited allowances — reject it. Legitimate apps explain what they’re asking for.
3. Use a separate “hot wallet” for experiments. Keep your main holdings in a wallet you rarely connect to random sites. Do airdrop hunting, testnet farming, and new-app trials from a small, expendable wallet. This compartmentalization is what security professionals call reducing your blast radius.
4. Consider a hardware wallet for anything significant. A hardware device keeps your keys offline and forces physical confirmation of transactions. It doesn’t make you immune to signing bad transactions, but it stops silent key theft dead.
5. Audit approvals quarterly. Ten minutes every few months on a block explorer, revoking stale approvals from apps you no longer use. Set a calendar reminder.
6. Never, ever share your seed phrase. Not with support, not on a “sync” page, not anywhere. The seed phrase is the wallet. Anyone who has it is you, from the blockchain’s perspective. If you want a deeper dive into wallet security fundamentals, see how to evaluate bridge trust models before bridging — the verification mindset transfers directly.

FAQs

The Bottom Line

Connecting to a phishing site is scary, but it’s a recoverable situation in most cases: disconnect, reject pending signatures, check and revoke your approvals, and migrate to a fresh wallet only if the worst happened. What you can’t do is undo a completed theft — so let this be the incident that builds your habits: bookmark real sites, read every signature, keep experiments in a separate wallet, and audit approvals regularly.

This guide is for education only — not financial advice.