How crypto wallets actually get hacked and drained.

Crypto wallets get hacked through people, devices and habits, never through the cryptography. Read enough incident reports and the same thing stands out: the interesting technical detail is missing. Nobody broke elliptic curve cryptography. Nobody guessed a private key. What there is instead, in report after report, is a person, a screen, and a decision made in about ninety seconds.

So this is a list of decisions rather than a list of exploits, in the order they actually cost people money. If yours has already been emptied, the section on what to do in the first hour is the one to read first.

Can a crypto wallet be hacked?

Not in the sense the word carries. A wallet is a key, and the key is not guessable: there is no brute force worth running and no known attack against the maths that protects it. When somebody says their wallet was hacked, one of four things happened instead. They gave away the phrase that recreates the key. They approved a signature whose meaning they did not read. They paid an address that was not the one they meant to pay. Or the device holding the key was already compromised, by malware, by a clipboard hijacker, or by a backup sitting in a cloud account with a password from 2019.

Every one of those is a route into a wallet that is working exactly as designed, which is why hardware, software and chain make so little difference to the outcome.

The seed phrase, given away

This is the biggest category by a distance, and the phrasing matters: given away, not stolen. Somebody types twelve words into something.

The scenarios repeat because they work:

• Fake support. You post a question in a public channel about a stuck transaction. Within minutes you have two or three direct messages from people whose display names match the wallet, the exchange, or the project. One of them will ask you to "validate" or "restore" your wallet.
• A form that looks like your wallet. A page, an app, a browser extension update, asking for the phrase to "sync", "verify" or "migrate". Real wallets don't need it, and nothing on the internet has a legitimate reason to receive those words.
• A backup that is not offline. A photo in your camera roll. A note syncing to a cloud account with a password from 2019 and no second factor. Each one turns wallet security into the security of a different account entirely.
• Help from a friend. Somebody trustworthy walks you through a fix over a screen share. The phrase appears on screen for four seconds. That is a recording now, on a machine you don't control.

The rule that covers all of it: the phrase is never typed into anything and never appears on a screen. Not for support, not for verification, not for a migration, not for anybody. Written on paper, or stamped in metal, stored where a burglar and a flood both cannot reach it. That is the whole protocol.

The signature, given away

The second category is subtler because nothing secret leaves your hands. You just approve something whose meaning you didn't read.

Token approvals. Connecting to a site and approving it to spend a token is normal, and the approval usually has no expiry and no limit. A site that turns malicious next year still has it. So revoke token approvals you no longer use: every major explorer has a token approval page for the address you paste in, and the wallets themselves are starting to list them. Doing it twice a year takes ten minutes and closes doors you forgot were open.

Blind signing. A wallet showing you a wall of hex and an approve button is asking you to sign an intention you cannot read. Sometimes that intention is "transfer everything".

Permit signatures. These look harmless because they aren't transactions and cost no fee. Signing one can hand over spending rights just as effectively as a transaction would, and it's the mechanic behind a good share of drainer sites.

If a signing request is not something you understand, the correct action is to reject it and lose nothing.

The address, quietly swapped

Two versions, both exploiting the same habit: reading the first four and last four characters of an address instead of the whole thing.

Address poisoning. An attacker generates an address whose start and end match one you have used, then sends a dust transaction from it so it appears in your history. Later you copy an address from that history and pay them instead.

Email interception. Somebody with access to a mail thread sends a polite follow-up with an updated payment address. This one has taken very large amounts from businesses that did nothing else wrong.

Two habits fix most of it. Compare the middle of an address, not the ends. And with a new counterparty, send a small amount first, confirm it, then send the rest. The full check before a payment leaves is four steps and takes a minute.

Social engineering, described plainly

The patterns above are the exit. Social engineering is the entrance, and its shape is stable even when the story is new. An attack tends to have four of these:

1. Urgency. A window that closes. Your funds are at risk right now.
2. Authority. A name, a logo, a display name matching the wallet or the exchange. Sometimes a real employee's photo.
3. A problem only you can solve, and only now. You're chosen, mistakenly locked out, uniquely affected.
4. An action that cannot be reversed. A signature, a transfer, twelve words.

The useful thing about the list is that it doesn't ask you to identify the scam. It asks you to notice the pressure. Nobody legitimate needs your seed phrase, your screen, or a signature in the next five minutes, and when those appear together the answer is to go slowly. The honest ones will still be there afterwards.

One more, because it keeps working on the careful: the job offer. A recruiter, a real-looking company, a take-home task in a repository, a file to run. It bypasses everything above by never mentioning crypto until the money is gone.

Your crypto wallet was drained. What to do in the first hour

Most of what is written about this is written for people who still have their money. If yours has gone, the order below is the point: doing the second thing first is how people lose the rest.

1. Move what is left, to a new wallet, from a device you trust. Not back into the same wallet after "securing" it. A leaked seed phrase cannot be taken back, and it keeps working on anything that arrives there next week, which is why people who refund the old wallet lose the second amount too. If malware is even possible, set the replacement up on a different machine, or the phrase you type goes the same way.

2. Then revoke token approvals. If a signature was the way in, revoking stops the rest from going. If the phrase leaked, it changes nothing, because the attacker can sign whatever they like. You will usually not know which it was, so do it anyway, after step one.

3. Write down the evidence while it is in front of you. Transaction hashes, times, the addresses that received the money, and what you were doing in the minutes before. That is the whole record, it is what an exchange or a police report will ask for, and it's much harder to reconstruct in a week.

4. Report it, if the money went somewhere with a name. Funds landing on an exchange deposit address are the only ones with a realistic chance of being frozen, and that chance falls away in hours.

And the one thing not to do. Within minutes of mentioning a drained wallet anywhere public you will be contacted by people offering to recover it: recovery experts, forensic teams, sympathetic strangers with a contact. All of them are the same scam arriving a second time, aimed at somebody who is upset. Nobody can reverse a confirmed transaction, and no fee changes that.

Splitting money by how much it would hurt

The single most useful decision here is not a habit, it is an arrangement.

Savings go on a hardware wallet, where the key never touches an internet-connected machine and a transaction is confirmed on a screen you hold. That protection is not available any other way, and for an amount that would genuinely hurt to lose it is not optional.

Working money goes in a hot wallet: the balance you invoice with, pay with and cash out from. Convenient by design, and therefore holding an amount you could survive losing.

Almost every large individual loss comes from having one wallet doing both jobs.

What Orla does, and what it does not

We hold a hot wallet, and we're not going to pretend otherwise. Keys are generated and encrypted in your browser and never leave it; only the public address is stored. Creating a wallet makes you type three of the twelve words back, because a tick box saying you wrote them down proves nothing.

Where we can take the specific attacks above off the table, we do:

• The confirmation screen shows the recipient address in full, never shortened, which is what address poisoning depends on, and says so when you have never sent to that address before.
• An EVM address whose capitalisation doesn't check out is flagged as you type, and on Solana, pasting a token account instead of a wallet address is refused with an explanation, because money sent there cannot be recovered.
• Sends can require a passkey every time, and an AML check on the destination sits on the same screen.
• Whenever the encrypted key is released to a session, the owner gets a notification, at most one a day per wallet, so a release nobody made stands out.
• Airdropped scam tokens are filtered out of holdings and history, so the bait doesn't sit in your books looking like a balance.
• The wallet password has a twelve character minimum and refuses the common ones, because it's the only thing protecting a key that can be attacked offline, where nothing slows an attacker down.

And the limit, stated as plainly as the features: this is not a replacement for a hardware wallet. For savings, buy one. Use Orla for the money that moves, and keep the money that sits somewhere a browser cannot reach. The rest of what protects the account around the wallet, passkeys, two factor, device sessions, the security log, is on the trust page.