A wallet warning of a possible leak, yet your funds are untouched—this situation is tricky because the lack of information makes it hard to tell if it's a false alarm or an actual hidden threat. Let's cut to the chase: Untouched assets do not equal no risk. Whether you need to migrate depends on what kind of "leak" message you received.
Step 1: First, figure out what exactly "leaked" — the source of the warning determines your next move
A wallet's "possible leak" alert usually comes from two completely different situations. Identifying which one you're dealing with is more important than rushing to move your assets.
【What to do】 Determine the source of the warning.
【How to do】 Recall your recent actions and match them to the following cases:
Situation A (seed phrase / private key possibly leaked): Have you ever entered your seed phrase into any website, app, or saved a screenshot on your phone/cloud? Have you copied your private key on an insecure network? Or downloaded unofficial wallet apps? If the answer is yes, migrate immediately. This kind of leak means an attacker may already have control of your wallet, just hasn't acted yet.
Situation B (only authorization risk / phishing signature risk): Did you just connect to an unfamiliar website, or sign a signature that looked like a "login" or "free claim"? This usually doesn't expose your seed phrase directly, but may give a malicious contract permission to move your assets. If the warning comes from this kind of scenario, you don't need to migrate right away, but you must deal with the authorization problem immediately.
Common failure point: After receiving a warning, many people first react by repeatedly checking their balance, changing wallet passwords, or reinstalling the app. But if it's a seed phrase leak, these actions won't stop the risk — the attacker doesn't rely on your password or app state.
Step 2: If you're in Situation B (only authorization risk), clean up the permissions
If you've determined you didn't leak your seed phrase, but may have malicious approvals, you don't need to migrate your address; just go through the authorization cleanup process.
【What to do】 Revoke all suspicious on-chain authorizations and signature permissions.
【How to do】 Follow these steps in order:
Go to a revocation tool: Open Revoke.cash or Etherscan's "Token Approvals" tool and connect your wallet.
Check and revoke: In the approvals list, look for contract addresses you don't recognize or that belong to suspicious sites. Click "Revoke", confirm the transaction in your wallet, and pay the gas fee.
Disconnect your wallet from dApps: In your wallet settings, find the "Connected Sites" or "Connected Apps" list and disconnect all the ones you don't trust.
Risk reminder: Disconnecting is not the same as revoking. The former just hides you from the front end; the latter actually cancels the permission on the contract level. If you recently signed a phishing signature (Permit), you also need to consider cleaning up Permit2-related authorizations.
【Completion standard】 Refresh the page on Revoke.cash and confirm there are no unusual approval records for suspicious tokens.
Step 3: If you're in Situation A (seed phrase / private key leak), perform an emergency migration
If you suspect your seed phrase or private key has been exposed—for example, you entered it in an unsafe environment, or the warning clearly points to seed compromise—then that address is no longer safe. Assets are still there only because the attacker hasn't withdrawn yet; you must proactively move them.
【How to do】 Follow this process:
Create a new wallet immediately: On another clean device (or a confirmed safe device), generate a new wallet address. Write down the new seed phrase by hand and store it securely.
Transfer remaining assets: From the compromised wallet, send all assets to the newly created safe address. Transfer larger amounts first, then small amounts, to ensure everything is safely moved out.
Abandon the old address: After emptying it, never send any assets to that address again. If it was linked to automatic investments or recurring transfers, update those settings immediately.
High risk: The fix for seed phrase leaks is completely different from authorization risks. If you mistakenly try to handle a seed phrase leak by just revoking permissions, it's like leaving an open door for the attacker. If you can't confirm the type of leak, it's better to treat it as Situation A—migrating assets is the most thorough way to stop all follow-up attacks.
Verification: Confirm that the new wallet has been safely generated and all assets transferred successfully. After that, you can keep necessary records on the old address's block explorer, but never use it as a receiving address again.
