Act fast
If you suspect a compromise, move any remaining assets to a fresh wallet with a brand-new seed phrase immediately. Assume the old wallet is fully controlled by the attacker.
Cut off approvals
From a safe device, revoke approvals connected to the compromised address if you can still transact, but prioritize moving funds first.
Prevent recurrence
Never reuse the compromised seed phrase. Identify how it happened — a signed approval, a leaked phrase, or malware — and fix that root cause before moving on.