Skip to content
Last updated 2026-11-05

Theft Prevention

After this page you will know the first moves when funds are leaving a wallet, how to close the exposure that allowed it, and how to preserve evidence without paying a second attacker.

Who this is for

Anyone watching funds leave a wallet, or who has found an approval or a device they do not recognize. If nothing is moving yet, the steps below still describe what to prepare.

Before you start

  • A second wallet address you control, created on a device you trust.
  • The phrase of the affected wallet, offline. You will not type it into anything new.
  • Time: each block gives a live allowance another chance to be used.

Steps

1. Identify which compromise you have

Two patterns look alike and need different first moves. If tokens are gone but BTG remains, an approval is doing the work: the attacker holds a permission, not your key. If BTG itself is moving, the phrase or the device is compromised.

This distinction decides the rest of the page: revoking fixes the first case and does nothing for the second.

2. Disconnect, then revoke

In the wallet, open Connected sites and disconnect everything you do not recognize. Disconnecting stops new requests from that site, but it does not cancel an approval already on chain, so follow it with a revocation of every unrecognized allowance. How to Check and Cancel Approvals has the steps.

If the drain is running through an allowance, revoking is what stops the next transfer. Do it before you start moving assets.

3. Move what remains to a new wallet

Create a fresh wallet from a fresh install, on a device you trust, with a new phrase. Do not reuse the old phrase or an infected device.

Send the highest-value assets first, and keep enough BTG in the old wallet to pay for the transfers. A sweeper may take any BTG sent to the old address within seconds, leaving you unable to move token balances that need gas; move what you can and record what you could not.

4. Check the device before you trust it again

Run a malware scan, review recently installed apps and browser extensions, and remove anything you do not recognize. Then assume the old device is untrusted.

Do not type the phrase into the compromised device again, and do not stop to clean it while funds are still exposed.

5. Report to the parties that can act

Contact the wallet provider through its official support channel, and the exchange or bridge that received the funds, because a deposit can sometimes be frozen while it is still pending. Report the theft to your local police and keep the report number; some exchanges act on a police report, and none act on a promise.

6. Preserve evidence and refuse the second wave

Save the transaction hashes, the addresses involved, screenshots of the draining transaction, and any chat logs. Do not delete the old wallet app or wipe the device until you have them.

Expect contact from someone offering to recover the funds for a fee. No one can reverse a confirmed transaction, and a "recovery service" that wants an upfront payment or remote access is running the same attack again.

There is no recovery service

A confirmed transaction is final. Bitgold does not offer a fund-recovery service, and no third party can undo a transfer. Any promise to the contrary is the opening line of a scam.

Verify it worked

  • The new wallet holds the assets, and its phrase never touched the old device.
  • Every unrecognized allowance on the old address reads 0.
  • The old wallet shows no connected sites.
  • The transaction hashes are saved, plus any police report number.

Troubleshooting

Problem What to do
I cannot move tokens because I have no gas Send a small amount of BTG to the old address and move the token immediately. A sweeper may take the gas first, so expect to repeat this.
The revoke transaction fails Check the network and the gas limit; the approval may sit on a different chain.
Funds keep disappearing after I stop using the wallet The phrase is compromised, not an approval. Abandon the address and never fund it again.
A "support agent" contacted me first Real support does not open the conversation. Do not share screenshots that show balances.
The token will not transfer at all It may be a honeypot. Record it as evidence and stop trying.

Next steps

Self-check

  • I know whether my loss is an approval or a compromised phrase.
  • My remaining assets are in a wallet with a phrase that was never used before.
  • No unrecognized allowance remains on the old address.
  • I have saved the evidence and paid nobody to recover funds.