You Are Being Hacked?
Follow these steps immediately to contain the damage.
DISCONNECT FROM INTERNET
If your MetaMask or wallet is on your computer/phone, Turn off WiFi and unplug Ethernet immediately. Malware needs an internet connection to send your funds or keys to the hacker.
DO NOT ENTER SEED PHRASE
If a popup, email, or "Support Agent" asks for your 12/24 words to "secure" or "reverse" the transaction, IT IS THE HACKER. Never type your seed phrase anywhere.
Check Revocations (From a SAFE Device)
If you can engage a Clean Device, use Revoke.cash to inspect wallet permissions. Do not reconnect the compromised device yet.
Preserve Evidence
Do not shut down (sleep mode is better) or wipe the computer yet. Forensic artifacts in RAM (Memory) or Logs might help us identify the vector. Take photos of your screen with another phone.
Once you have secured the environment (disconnected), contact our Forensic Intake team.