Breaches & scams
Clicked a crypto phishing link? Separate what happened next
By Jolly Ledger editorial · Published · Reviewed · 4 min read
Short answer
Close the suspicious page and identify exactly what happened after the click. Visiting a page, running software, approving an action and disclosing recovery words require different responses; a click alone does not establish wallet-key theft.
Respond first, using official sources
Typed or shared your recovery words? Go straight to the urgent shared-words guide. →Go to your wallet maker’s official support by typing its address yourself. Do not use links or contacts from the message that worried you.
- Identify phishing scams — BitBox (opens in a new tab)
- Security incident at Brevo, our third-party email provider — Trezor (opens in a new tab)
- How to verify a message claims to be wallet support
A click is a starting point for questions, not a diagnosis. Close the suspicious page and stop interacting with the sender. Do not return to the site to reproduce what happened. Write down the sequence while you remember it, without including passwords, recovery words or other secrets.
Name the furthest action you took
| What happened | What to establish next |
|---|---|
| Received a message only | Whether anything was opened or acted on; receipt alone does not grant wallet access. |
| Visited a page or scanned a QR code | Whether a download, permission request or data entry followed. |
| Downloaded a file | Whether it remained unopened or was run or installed. |
| Connected a wallet | Whether you also signed a message, transaction or permission. |
| Entered account credentials | Which account and whether an authentication code was also disclosed. |
| Shared recovery words | Treat the words as compromised and seek urgent official instructions. |
These categories can overlap. Connecting a wallet is not the same as revealing its backup, and a signature is not automatically a transfer. Equally, an approval may have consequences without an immediate outgoing payment. Record what the device or application displayed rather than assuming that an unchanged balance settles the question.
If you only opened the page
Close it, decline prompts and leave unexpected downloads unopened. A visit may expose ordinary browsing information, but it does not by itself establish that your wallet keys were taken. Do not install a supposed scanner or connect a wallet to let the page diagnose your exposure. Check the vendor’s official phishing guidance through an independently opened website.
If software ran or an account secret was entered
BitBox’s official guidance says to stop sensitive activity on a computer where suspicious software ran or remote access was allowed, disconnect the hardware wallet and approve nothing further. Use a separate trusted device to find official support. Do not reconnect the wallet merely to see whether it still works.
For a disclosed email or exchange password, independently open that account provider’s security and recovery instructions from a trusted device. Follow its process for securing access and reviewing sessions. This is an account incident, which may coexist with a wallet incident but should not be confused with recovery-phrase exposure.
If you signed something or disclosed a backup
Preserve any existing transaction identifier and the wording of the approval, without reconnecting to the suspicious site. Ask the official wallet provider how to review that specific action. Permissions and transaction behavior differ across networks; a generic instruction to revoke everything can introduce new mistakes.
If you shared recovery words, use the urgent route in shared recovery phrase: what next. Do not wait for a missing balance to confirm exposure, and do not accept a stranger’s transfer instructions.
A useful support report
- State the time, device and sequence of actions.
- Distinguish downloading, running, connecting and approving.
- Provide redacted sender details and existing transaction identifiers where relevant.
- Never include recovery words, private keys, passphrases or authentication codes.
Use independently verified support, not the original sender. Even an official-looking email address cannot establish that its requested action is safe.
Sources
Reported facts are attributed to their sources. Spotted an error? Read our corrections approach.
Later: prepare calmly
This checkup cannot diagnose a current compromise or tell you whether funds are at risk. It helps you prepare: backups, official instructions and a family briefing.
Start the free preparation checkup