Crypto Wallet Drained Overnight: Investigation and Evidence Checklist
What to do when a cryptocurrency wallet appears to have been drained, including account security, transaction review and evidence preservation.
# Secure the affected environment
If a wallet or connected account may be compromised, use trusted security procedures to protect remaining assets.
Secure associated email and exchange accounts as appropriate.
Review the transaction history
Identify all transactions that were not authorized.
Record each transaction hash, destination address, asset and amount.
Determine when the activity began
Build a timeline showing the first suspicious activity and later transfers.
Preserve possible attack evidence
Keep phishing messages, suspicious websites, wallet prompts, security alerts and account notifications.
Protect credentials
Never provide your seed phrase or private key to an investigator or recovery service.
Trace the blockchain
Where transactions are publicly visible, investigators can document later movements.
Report the compromise
Use official wallet, exchange, email and relevant reporting channels.
Recovery limitations
A wallet trace may establish where assets moved without guaranteeing that they can be recovered.
Final thoughts
A drained wallet should be treated as an incident requiring both security response and evidence preservation.
Zenith Hackers Intelligence provides authorized digital investigation support.