What Should I Do If My Wallet Was Hacked?

• Purpose: Rapid Response and Damage Control
• Step-by-Step: The Emergency Recovery Protocol
• Use Case: Compromised Seed Phrase vs. Malicious dApp
• Best Results: Hardening Your New Digital Vault
• FAQ
• Disclaimer

Purpose

The purpose of this guide is to provide an immediate emergency protocol for users who suspect their Tonkeeper wallet has been compromised. In the decentralized world of 2026, there is no "customer service" to reverse transactions. If a hacker gains access to your 24-word recovery phrase or you accidentally sign a malicious smart contract, speed is your only ally. This tutorial outlines how to salvage remaining assets, identify the breach point, and properly migrate to a clean, secure environment before the attacker drains the entire balance.

Step-by-Step

1. Immediate Asset Triage

If you still have access to the app, immediately send any remaining high-value assets (TON, USDT, or rare NFTs) to a completely new wallet or a trusted exchange address. Do not send them to another account linked to the same recovery phrase.

2. Revoke Connected dApps

Navigate to Settings > Connected dApps (or TON Connect). If the "hack" was actually a malicious permission you signed, revoking the connection may stop the automated draining of your funds. Look for any unfamiliar protocols and tap "Disconnect" immediately.

3. Identify the Breach Source

Determine how the access occurred to prevent repeating the mistake:

• Seed Phrase Leak: Did you take a screenshot, save it in a cloud note, or enter it into a "verification" website? If so, the wallet is permanently compromised.
• Malicious NFT/Token: Did you click a link inside a "Gift" NFT? This likely led to a phishing site.
• Device Malware: Is your phone acting strangely? Your private keys might have been scraped by a keyboard logger.

4. Abandon the Compromised Wallet

Once a seed phrase is known by an attacker, that wallet can never be trusted again. Even if you "clear" the malware, the hacker still has the keys. Create a brand-new wallet in Tonkeeper, generate a fresh 24-word phrase (write it on paper only), and move all operations there.

5. Audit Your Telegram Account

In 2026, many Tonkeeper wallets are linked to Telegram. Go to Telegram Settings > Privacy and Security > Active Sessions. Terminate any sessions you don't recognize to ensure the hacker isn't accessing your wallet through a compromised Telegram account.

Use Case

The Phishing Victim:

A user receives an NFT claiming they won 1,000 TON. They click the link and "connect" their wallet to a fake site. Within minutes, their USDT starts disappearing. By immediately going to Settings and revoking all TON Connect sessions, they break the link to the malicious smart contract and save their remaining Toncoin.

The Stolen Seed Phrase:

An attacker gains access to a user's Google Photos, where a screenshot of the recovery phrase was stored. The user notices an unauthorized transfer. Since the attacker has the master key, the user creates a New Wallet in Tonkeeper and uses the "Transfer All" function to race the attacker for the remaining tokens.

Best Results

For the best results in 2026, transition to a W5 Wallet standard for your new account and enable Two-Factor Authentication (2FA) if your region supports the new TON multi-sig features. Never reuse a password or PIN from a compromised device. If you hold significant value, the most effective protection against a re-occurrence is moving your assets to a Hardware Wallet (like Ledger) and linking it to Tonkeeper. This ensures that even if your phone is hacked, your assets cannot be moved without a physical button press on your hardware device.

FAQ

Can Tonkeeper support reverse the hacker's transaction?

No. Blockchain transactions are immutable. Once a hacker moves your TON to another address, it cannot be pulled back by any centralized authority.

Should I report the hack to the police?

Yes. While recovery is difficult, reporting the theft to your national cybercrime unit helps track the hacker's "off-ramp" to exchanges where they might have linked a real-world identity.

Can I still use the same Tonkeeper app?

Yes, the app itself is safe, but the specific account (phrase) is not. You must delete the compromised wallet from the app and start fresh with a new one.

Disclaimer

This guide provides emergency suggestions but does not guarantee the recovery of stolen funds. Digital asset security is the sole responsibility of the user. In the event of a hack, Tonkeeper cannot be held liable for the loss of assets due to compromised recovery phrases or malicious smart contract interactions. Always practice safe browsing and cold storage for large balances. Guide updated for 2026 security protocols.

Tags: Tonkeeper Hack Recovery, Stolen Crypto Emergency, Revoke TON Connect, Secure Hacked Wallet