What to Do After a Rug Pull or Getting Scammed

If a token you bought just collapsed, a wallet got drained, or a project vanished with the liquidity, the first thing to know is this: some damage is done, but some is still preventable — and there are concrete steps that protect what remains. Act methodically, not in panic, and avoid the "recovery" scams that target people at exactly this moment.

First: stop the bleeding

1. Disconnect your wallet from every dapp you can, especially any site involved in the incident.
2. Revoke token approvals. If a malicious contract still has permission to move your tokens, it can keep taking them. Use a reputable checker like Revoke.cash or your explorer's token-approval tool to set risky allowances to zero. See How to Revoke Token Approvals.
3. Move remaining assets to a safe wallet. If you believe your wallet or device may be compromised (not just a bad token), treat the wallet as burned: create a new wallet on a clean device and transfer what's left there. Never re-use a seed phrase you suspect was exposed.

These steps stop future unauthorized transfers. They cannot reverse what already left your wallet — but they often save the rest.

Understand what actually happened

Knowing the mechanism helps you respond correctly and avoid a repeat:

• A rug pull / honeypot (the token itself was the trap): your funds went into a token that lost its value or blocked selling. There is usually nothing to "un-approve" that recovers the loss, but revoking still protects other tokens. See What Is a Rug Pull and What Is a Honeypot.
• A wallet drainer (you signed a malicious approval or transaction): revoking and moving assets is urgent, because the attacker may still have standing permissions.

What you (unfortunately) usually can't do

Blockchain transactions are, by design, irreversible. Once funds have been moved by a transaction you authorized — or by an approval you granted — there is no "undo," no support line that reverses it, and no bank to charge it back. Accepting this early protects you from the second wave of harm below.

Avoid the "recovery" scam — this is critical

People who have just lost money are the prime target for a follow-up scam. Be aware:

• Anyone who DMs you offering to "recover" your funds for a fee is almost always a scammer. Legitimate recovery does not work by paying a stranger upfront.
• No one can reverse an on-chain transaction by "hacking it back." Claims otherwise are a lie.
• Ignore "recovery agents," fake support accounts, and anyone asking for your seed phrase or another approval. Never share your seed phrase with anyone, ever.

Report it (it can still help)

Reporting won't usually recover funds, but it feeds the data that protects others and, occasionally, aids investigations:

• Record the evidence: the token/contract address, the transaction hashes, the site URL, and any wallet addresses involved.
• Report the address to a public scam registry such as Chainabuse.
• File a complaint with the relevant authority in your jurisdiction — in the US, the FBI's Internet Crime Complaint Center (ic3.gov); elsewhere, your national cybercrime or consumer-protection body.

Turn it into prevention

The most valuable thing you can do next is make the same loss harder to repeat. Before the next purchase, check the token itself — sell simulation, owner powers, liquidity lock, holder concentration — rather than trusting a chart or a chat. See How to Identify a High-Risk Crypto Token Before Buying.

Before buying again, scan the contract address in Orixa to see honeypot status, owner permissions, liquidity, and holder concentration in one report — and verify the critical findings independently. Orixa is decision support, not financial advice, and cannot recover lost funds.