Start with the observable event
Revoke.cash's incident guide separates possible key exposure, malicious approvals or signatures, and direct transfers. The pattern of losses can suggest a direction for investigation, but it is not a conclusive diagnosis. Start with the network, transaction identifier, asset, amount and addresses involved.
Match the response to the cause
A direct transfer you signed is different from a spender using an existing allowance. A stolen recovery phrase creates a wider problem than an isolated allowance. Inspect the transaction and relevant permissions before assuming a single revocation will secure the account. Stop interacting with the suspected site while you collect the facts.
Build a useful incident note
Write down what you clicked, signed, installed or disclosed, with approximate times. Keep screenshots of requests and messages, but exclude secrets from any public report. Use verified support or reporting channels, and distrust recovery offers that demand another transfer or your backup words. A confirmed revocation can limit a particular allowance; it does not reverse a completed transfer or erase a leaked key. This checklist organizes evidence for the next decision and does not promise to identify an attacker or recover assets.
Source and review date
Revoke.cash — original source. Original publication date not verified in this review. Source checked: 2026-10-23.
This is an original Wallet Beep editorial summary. Consult the linked source for its full context and any later updates.