Private key compromise

Keys leak in many ways: infostealer malware that copies wallet files and browser data, seed phrases typed into fake websites or stored in cloud photos, keys committed by mistake to public code repositories, weak random number generators, compromised devices bought second hand, and insiders at companies who misuse access. For institutions, stolen signing keys on servers or social engineering of key holders are the recurring patterns.

Compromised keys are behind many of the biggest losses in crypto. Unlike a bad token approval, which limits what an attacker can take, a stolen key exposes everything the address holds on every chain, now and in the future. Attackers often run sweeper bots that empty any deposit within seconds.

If you suspect a compromise, create a new wallet with a new seed phrase on a clean device and move remaining assets at once; never reuse the old phrase. Staked or locked tokens may need a race with the sweeper or the help of whitehat rescue services. Revoking approvals does not help when the key itself is gone, and reporting the theft to exchanges can sometimes freeze funds that arrive there.