What Was the Highest-Authority Action the Wallet Actually Completed?

Connecting a wallet to a suspicious site does not automatically transfer funds, but the incident should be classified immediately. The required response depends on the highest-authority action completed: connection only, message signature, token approval, transaction, or recovery-secret or device exposure. Disconnecting is enough only for the lowest state. It does not erase approvals or undo signed blockchain actions.

Use the Five-Exposure Incident Triage

Find the highest state that definitely occurred.

• State 1 — connection only
• State 2 — message or permit signature
• State 3 — token, NFT or account approval
• State 4 — transaction or contract call
• State 5 — seed phrase, private key, device or wallet software compromise

First stop all new interaction

Close the page, reject every remaining wallet prompt and do not follow support links from the same source. Preserve the domain, screenshots, wallet account, network, timestamp and transaction or signature records before browser history or popups disappear.

State 1 — connection only

A normal dapp connection exposes the selected public address and allows the site to request later actions. MetaMask’s current guidance says connection alone does not let the dapp move tokens without a separate approval or signed transaction.

Disconnect from both sides

Remove the site from the wallet’s Connected Apps or Dapp Connections list and close the session on the site if possible. Phantom and MetaMask both distinguish disconnection from revoking on-chain permissions.

Check whether connection really was the highest state

Review wallet activity, browser prompts and explorer history for signatures, approvals, contract calls and transfers at the incident time. Users often remember clicking Connect but overlook a second confirmation.

State 2 — readable login signature

A plain authentication signature can be limited to proving address control, but inspect the exact message, domain, nonce, expiry and chain. Log out or invalidate the site session where possible and monitor for unexpected account actions.

State 2 — permit or opaque signature

A typed-data signature can authorize token spending, orders or other actions without an ordinary approve transaction. Identify the verifying contract, spender, token, amount, nonce and deadline. Revoke the related permission or move exposed assets when the signature grants actionable authority.

State 3 — token or NFT approval

An approval remains on-chain after disconnection. Use the wallet’s approval manager or a trusted network-specific checker to identify token, spender and allowance. Revoke suspicious or unnecessary authority, paying the normal network fee.

Prioritize assets the spender can actually move

An ERC-20 approval affects the specified token and network, not every asset automatically. An NFT operator approval can cover a collection. Move or protect the directly exposed assets first rather than generating unnecessary transactions for unrelated balances.

State 4 — signed transaction

Open the transaction on the correct explorer and decode what changed: transfer, swap, approval, delegation, ownership change or contract interaction. A confirmed blockchain transaction cannot be cancelled by disconnecting the site.

If assets were transferred to the attacker

Blockchains generally cannot reverse the payment. Preserve the recipient, transaction hash, token and time for exchange, wallet-provider and fraud reporting. Do not pay a recovery agent who promises a guaranteed reversal.

If the wallet drains whenever gas arrives

Stop adding gas repeatedly. A sweeper, compromised key or active permission can take the native asset before the user can rescue tokens. Plan migration from a clean environment and use network-specific expert assistance without sharing the recovery phrase.

State 5 — seed phrase or private key exposure

Treat every account derived from that secret as permanently compromised. Phantom’s current incident guidance says a revealed recovery phrase gives an attacker continuing control over funds sent later. Create a fresh wallet with a new secret on a clean device.

Device or extension compromise changes the migration

A new seed entered on an infected device can be stolen again. Remove suspicious extensions and software, update or reinstall the operating environment, secure email and cloud accounts, and create the replacement wallet only after the device path is trusted.

Use the Containment Order

Act in an order that matches the confirmed risk.

• Stop prompts and preserve evidence
• Disconnect suspicious sessions
• Review signatures and on-chain history
• Revoke active approvals where safe
• Move unaffected valuable assets to a fresh wallet when key or broad authority risk exists
• Report the domain and transaction evidence
• Retire the compromised wallet when the recovery secret or device cannot be trusted

Do not interact with random tokens during cleanup

Suspicious tokens and NFTs can contain phishing links or lead to malicious swap and approval requests. Hiding or reporting them is safer than visiting their website or trying to sell them.

Worked connection-only case

The user connected MetaMask, rejected every later prompt and sees no signatures or transactions. The site is disconnected, the account is monitored and no approval revocation is needed because no on-chain authority exists.

Worked approval case

The user connected and approved unlimited USDT spending to an unknown EVM contract. Disconnecting ends the session but the allowance remains. The user revokes it, verifies the allowance is zero and moves valuable USDT if drain activity is already visible.

Worked seed-exposure case

The site asked the user to synchronize the wallet by entering twelve recovery words. No assets have moved yet. The user creates a new wallet from a clean device, transfers safe assets and never reuses the compromised address for future deposits.

The minimum sufficient response

Connection only requires disconnection and verification. Signatures require decoding and session invalidation. Approvals require revocation. Transactions require on-chain analysis. Key or device compromise requires migration. Always respond to the highest confirmed exposure.

Incident-response sources checked on July 30, 2026

Current wallet-provider guidance supports the distinction between connection, approval and permanent recovery-secret compromise.

• MetaMask connection authority boundary: https://support.metamask.io/start/why-am-i-being-asked-to-connect-to-a-dapp
• MetaMask approval revocation: https://support.metamask.io/more-web3/learn/how-to-revoke-smart-contract-allowances-token-approvals
• Coinbase dapp connections and token approvals: https://help.coinbase.com/en/wallet/security/dapp-permissions-token-approvals
• Phantom disconnect versus approval removal: https://help.phantom.com/hc/en-us/articles/19888567849107-Disconnect-Phantom-from-an-app
• Phantom compromised-wallet response: https://help.phantom.com/hc/en-us/articles/5487893286291-I-was-scammed-or-my-wallet-was-drained-What-can-I-do
• Phantom approval revocation: https://help.phantom.com/hc/en-us/articles/19142125651731-Revoke-token-approvals

FAQ