If I'm not sure I've actually been hacked, and just feel like something's off, should I still follow this checklist?
Yes. Every action on this checklist (revoking a suspicious approval, confirming your two-factor authentication method, checking your account login history) carries almost no downside to your normal usage even if it turns out to be a false alarm — revoking an approval you weren't planning to use again anyway costs you nothing, and confirming your two-factor settings are correct is a good habit worth doing anytime regardless. Compared to the potential cost of "confirming something's really wrong before acting" (if it genuinely is an attack, every minute of delay expands the scope of the loss), the cost of "something feels off, so I'll just run through the checklist" is far lower — which is exactly why this checklist is designed around the principle of "better a false alarm than a delay."
The checklist says to prioritize revoking all approvals on an unauthorized transaction, not just the one that was exploited — why do that, isn't that overreacting?
This isn't overreacting — it's based on a common attacker behavior pattern: if an attacker obtained one of your approvals through a phishing site or a malicious contract, they often trick you into signing more than one approval within that same social engineering operation (for instance, disguised as a step requiring "additional verification" or "extra confirmation"), and you may not have realized at the time that you signed more than one. Only checking and revoking the one that's already been exploited risks missing another approval that hasn't been triggered yet but is equally valid and malicious — letting the attacker come back for a second round later. Comprehensively checking and revoking every approval takes a few extra minutes, but that time cost is worth it compared to the risk of a second loss from missing a risk point.
If I suspect a SIM Swap Attack, but I can't get through to my carrier's customer service or the wait is very long, what should I do during that wait?
Don't pin all your hope on "getting through to carrier support" as the one thing that matters — while waiting, work through the other actions you can execute immediately at the same time: log into and secure your email account through another channel (this actually takes priority over contacting the carrier, since email is the recovery hub for other accounts), check your exchange accounts one by one, and switch over whatever two-factor authentication methods you can change right away. Beyond phone support, most carriers usually also offer online chat support, physical retail locations, or an official social media account you can try reaching out through — if one channel isn't getting through, try several channels at once rather than burning your entire time budget waiting in a single queue.
After finishing this checklist, what else needs to be done, and when can I actually feel at ease?
Once the first hour's bleeding has been stopped, the focus shifts to claims and follow-up protection — if the asset loss is substantial, consider consulting a lawyer or institution experienced in crypto asset fraud cases to understand whether there's any chance of recovering part of the loss through legal channels; file a report through your region's official cybercrime reporting channel (such as the IC3 in the U.S., or Taiwan's 165 anti-fraud hotline) — even if the odds of recovery are low, a formal police report itself can be useful for a subsequent claim or insurance payout. At the same time, start planning a long-term security upgrade, such as switching entirely to a Hardware Wallet paired with Cold Storage, or reviewing whether multisig should be adopted.
As for "when can I actually feel at ease" — the honest answer is that once assets have actually been moved out, the odds of recovery are generally low, which is exactly why this checklist repeatedly emphasizes how much the first hour's reaction speed matters. Rather than fixating on "can I get it back afterward," a more practical expectation is to treat this incident as an opportunity to re-examine your overall asset security habits, making sure the same opening never gets exploited a second time.
This article assumes a scenario: you've just noticed something wrong — maybe a transaction appeared in your wallet that you never initiated, maybe your phone suddenly has zero signal, or maybe you've just realized you signed an approval on a site that looked completely normal, and the more you think about it now, the more uneasy you feel. Another article on this site discussed the importance of an Incident Response Plan; this article condenses the core of that plan into an ordered checklist you can follow directly even in a state of extreme stress. If you're reading this article while actually in that state right now, take a breath first — from this point on, speed matters more than perfection.
Different scenarios call for different priorities, so spend 30 seconds figuring out which one you're in: (1) an unauthorized transaction appeared in your wallet, but your phone, email, and other accounts currently look normal; (2) your phone has completely lost signal, receiving no calls or texts at all, and you suspect a SIM Swap Attack; (3) you just signed a suspicious approval or clicked a suspicious link, but haven't seen any irregularity with your assets yet. These three scenarios call for a different order of action from here, but they share one common first principle: don't delay acting because you want to "figure out exactly what happened first." Understanding the full picture can wait — what matters right now is stopping the loss that's still actively happening.
If it's an unauthorized transaction: immediately open an approval management tool, check and revoke every Token approval on that wallet (not just the one that was exploited, since you don't know whether other approvals might be targeted too), and note down that unauthorized transaction's hash and timestamp — key evidence for any future claim or police report. If other assets remain in the wallet, assess the situation and move them as quickly as possible to a brand-new, never-before-used wallet address.
If it's a suspected SIM swap: immediately log into your email account through another channel (a family member's phone, a computer's web browser), since email is usually the hub other accounts use for password resets — first confirm your email itself hasn't been compromised and switch its two-factor authentication to a non-SMS channel; then check your cryptocurrency exchange accounts one by one for any unusual login or withdrawal activity; and simultaneously contact your mobile carrier, explaining the situation and requesting an immediate freeze or reversal of the phone number.
If you just signed a suspicious approval but haven't seen any irregularity yet: revoke that approval immediately (don't wait until you actually see assets moved out to act, since an attacker may have deliberately delayed triggering it), and, following the same handling as an unauthorized transaction, check whether that same wallet has any other approval you signed at some point and have since forgotten, which also needs cleaning up.
Once the most urgent bleeding has been stopped, widen your check to every potentially affected account — if you use the same or similar passwords across multiple platforms, now's the time to change all of them; if your phone or computer has shown any unusual behavior recently (unknown programs, browser extensions, abnormal battery drain), that could be a clue of a malware infection worth running a full security scan for, or even a full system reinstall. At the same time, begin systematically documenting: every abnormal transaction's hash, the timestamp of every unusual login, screenshots of any suspicious links or messages you received — these records aren't just for a future claim; they're also important clues for identifying the attack's source and scope.
The point of this checklist isn't for you to memorize every detail — it's for you to know "something like this exists." In a genuine emergency, you won't even need to precisely recall every step; just knowing the priority order is "stop the bleeding first, widen the check next, and preserve evidence and pursue remedies last" already puts you far ahead of most people's instinctive reaction under panic. Whether a loss can be stopped, and how much of it, often depends on how fast you react in that first hour — not how much effort you eventually put into investigating or filing a claim afterward. Bookmark this article, or print a copy and keep it near wherever you normally store your Seed Phrase — you hope you'll never need it, but if the day ever comes that you do, it should be something you can find immediately.