How to Recover Stolen Crypto from MetaMask or Trust Wallet

If funds just disappeared from your MetaMask or Trust Wallet, the first instinct is to look for a support line to call. There isn't one — and understanding why changes how you should actually respond.

Why there's no "customer support" fix

MetaMask and Trust Wallet are self-custody wallets. Neither company holds your funds, neither can see your private keys, and neither has the technical ability to reverse a transaction once it's confirmed on-chain — that's the entire design point of self-custody. This is different from a bank or a centralized exchange, where the platform itself controls the ledger and can, in some cases, freeze or reverse activity.

That means once a transaction is signed and confirmed, no wallet provider — not MetaMask, not Trust Wallet, not any other self-custody wallet — can undo it. Recovery has to happen downstream: tracing where the funds went next, and acting on that.

How funds actually leave these wallets

Almost every case we see falls into one of a few patterns:

• Seed phrase phishing. A fake wallet-support site, browser extension, or "wallet recovery" tool tricks the victim into typing their 12-24 word recovery phrase, handing over full control.
• Malicious approvals. A fake dApp or NFT mint page asks for a token "approval" that looks routine, but actually grants a scam contract permission to move specific tokens whenever it wants — sometimes not draining the wallet until days or weeks later.
• Fake wallet apps. A cloned MetaMask or Trust Wallet app, often found through a search ad or a link in a scam message, that's built to exfiltrate the seed phrase on setup — see our full guide to fake wallet scams for how to spot one before you install it.

What to do in the first hour

1. Move anything left. If the wallet still holds other assets and the seed phrase may be compromised, move remaining funds to a brand-new wallet with a freshly generated seed phrase immediately.
2. Revoke open approvals. If a malicious approval is the likely cause, use a reputable approval-checking tool to revoke any permissions granted to unfamiliar contracts, on every chain the wallet has touched.
3. Record everything. The transaction hash, the destination wallet address, the approximate time, and how you believe access was lost. This is exactly what a trace investigation starts from.
4. Report it. File with IC3.gov or the FTC, regardless of what else you do.

How to track stolen crypto from here

This is where tracing actually starts to matter. A transaction hash is enough for a certified investigator to follow the funds across wallets, bridges, and exchanges — the same multi-hop tracing used in far larger cases. The goal is to find out whether the funds landed on an exchange that requires identity verification (KYC), since that's typically the point where a well-documented complaint can lead to a freeze and an identification of who's behind the receiving account.

Funds that stay entirely within self-custody wallets, or that route through services with no compliance program at all, are harder to act on — we'll tell you honestly if that's what your case looks like before you spend any time or money pursuing it further.

Last reviewed Sep 8, 2026 · Reviewed by our CEH-certified investigation team