Not financial, legal, or tax advice. Act quickly; this guide describes general steps, not a guarantee of fund recovery.
If your wallet is compromised, the priority is moving any remaining funds to a new, secure wallet immediately and cutting off the attacker's access. Recovery of funds already taken is unlikely, since transactions are irreversible, a reality covered in \[pillar hyperlink: How to Keep Your Crypto Safe\].
Immediate steps
Stop using the compromised device or wallet app right away. If you suspect malware, disconnect the device from the internet before doing anything else, to prevent further data from being captured.
Move remaining funds
Using a separate, trusted device, create a brand-new wallet with a fresh seed phrase and transfer any remaining assets there immediately, before doing anything else. Speed matters more than caution here; every minute increases the chance of further loss.
Revoke approvals
If you've interacted with decentralized apps, check and revoke any token approvals granted to smart contracts, since a compromised key can otherwise be used to drain assets through previously approved permissions.
Prevent recurrence
Once secured, figure out how the compromise happened, whether a phishing link, a leaked seed phrase, or malware, and address that specific gap. Review the fundamentals in Common Crypto Scams to avoid a repeat.