Is my wallet hacked: signs and first steps

Signs of a hack

• USDT left but you signed nothing. The debit shows in history as a normal transfer or as transferFrom from a third-party address.
• A transfer fails with a signature or permission error even though you have TRX for the fee.
• TRX disappear right after you top up. This is the scammer’s bot: it waits for you to add TRX for fees and takes it.
• You recently entered your seed phrase on a site, to “support” or in an unfamiliar app, see fake wallets.

What exactly happened

Check the address in GuardPay /check and the approvals in /revoke:

• There is an approval to someone else’s address and the debits went through transferFrom — you signed an approve. The key is probably intact. Revoke the approval, see unlimited approvals.
• A foreign address appeared in the account permissions — the wallet was captured via multisig. You can no longer sign a transfer without the scammer, see the multisig trap.
• No approvals, permissions unchanged, yet transfers leave your address — the scammer has your seed phrase or key.

First steps

1. Create a new wallet with a new seed phrase on a clean device.
2. If the key is still yours, move everything left there in one series of transfers.
3. Revoke unnecessary approvals.
4. Save the transfer hashes and the recipient address: they are the basis for a police report and a letter to an exchange.

If the money is already gone

Start a trace in GuardPay /stolen: it shows the path of the funds and the exchanges they reached. Step by step — what to do if you were scammed. Beware of “recovery agents” who write to you first, see recovery scams.