What Should You Do After Signing a Suspicious Crypto Transaction?
If you've signed something suspicious, speed matters. Here's the actual sequence of steps to limit the damage in the minutes right after.
Realizing you may have signed something you shouldn't have is an unsettling moment, but what you do in the minutes afterward can meaningfully limit the damage. Speed and the right actions matter more than panic.
First: Figure Out What You Actually Signed
Check what the transaction or signature actually was — a direct transfer (already final), an approval (ongoing risk, funds not yet moved), or a signature (may or may not have been acted on).
If It Was an Approval, Revoke It Immediately
Revoking — sending a new transaction that sets the approved amount back to zero — closes off future risk from that specific permission.
Move Remaining Funds to a New, Clean Wallet
Moving any remaining valuable assets to a different wallet removes them from reach of whatever permission may have been granted.
Don't Reuse the Same Wallet for the New Transfer's Gas
Sending gas money to the compromised wallet is still fine — the risk sits in what that wallet has approved or signed, not in receiving funds.
Check Whether the Signature Was Already Used
For a signed permit-style message, acting quickly can sometimes mean the signature never gets used at all.
Report and Document, Even If You Can't Recover Anything
Recording the contract address, the transaction hash, and roughly when it happened creates a useful record.
The Broader Lesson for Next Time
Treating a suspicious signature as urgent and acting within minutes meaningfully changes the odds of limiting the damage.
Check your wallet's current approvals right now, even if nothing feels wrong yet — catching an old, forgotten approval before it's exploited is far easier than reacting after the fact.