Why does your wallet show a transaction you did not make?

31 October 2026

A transaction that appears in your wallet but that you did not authorize usually means someone gained access to your private key, your seed phrase, or tricked you into signing a malicious transaction. The transaction you see is the result of that access, not a glitch or a random event.

How did someone send a transaction without your permission?

Blockchain transactions require a valid digital signature from the wallet's private key. If a transaction appears that you did not initiate, one of three things happened:

1. Your private key or seed phrase was compromised. Someone copied, guessed, or extracted it from an insecure storage method (screenshot, cloud file, typed into a website, written on paper that was photographed).
2. You signed a malicious transaction that gave the attacker control. This includes permit signatures, setApprovalForAll, or any approval that lets a contract spend your tokens without further confirmations.
3. Your browser extension wallet was drained through a session hijack. A fake WalletConnect request or a malicious dApp connection gave the attacker an active session that could send transactions on your behalf.

Check what type of transaction it is

Open the transaction on a block explorer (Etherscan, BscScan, etc.) and look for:

• "From" address: Is it your wallet address? If yes, the transaction was signed with your private key. If no, someone is sending you tokens (see address poisoning below).
• "To" address: A contract address that you did not recognize means you likely approved a malicious contract.
• Method called: Common draining functions include transfer, transferFrom, burn, swap, approve, setApprovalForAll, or permit. If you see a contract interaction you do not remember approving, that is the cause.

If you did not sign anything, check these possibilities

1. Address Poisoning (Dust Transactions)

If the transaction shows a tiny amount of a token (like 0.000001 ETH) sent to your wallet from an unfamiliar address, this is likely address poisoning. The attacker hopes you will copy that address from your transaction history and accidentally send funds to it later. You did not lose any money, and your wallet is not compromised. Ignore and hide the transaction.

2. A previously approved contract was exploited

You may have approved unlimited spending for a token on a legitimate DeFi protocol months ago. If that protocol suffered a hack or rug pull, the attacker can call the transferFrom function using your prior approval. The transaction appears as if you sent it, but the approval was the real vulnerability. Check your token approvals on a tool like Etherscan's "Token Approvals" tab or a dedicated approval checker.

3. Session Hijack

If you connected your wallet to a fake site and approved a WalletConnect session, the attacker can send transactions from your wallet without asking again. The transaction will show as originating from your address, and you may not remember signing it because the session was already active. Revoke all active sessions immediately.

What to do right now

1. Do not sign anything else. Close all browser tabs and dApps. Disconnect your wallet from any active sessions.
2. Check your seed phrase storage. If you have ever typed your seed phrase into a website, an email, or a cloud document, assume it is compromised. Move funds to a new wallet generated on a clean, offline device.
3. Revoke token approvals. Use a revoke tool (like Revoke.cash or Etherscan's approval checker) to remove approvals for any token that was drained or for any contract you do not fully trust.
4. Transfer remaining funds to a new wallet. Create a fresh wallet using a hardware device or a new software wallet that has never touched the compromised seed phrase. Send your remaining crypto there immediately.
5. Check for active WalletConnect sessions. Open your wallet's settings and look for "Active Sessions" or "Connected Sites." Revoke any sessions you do not recognize.

How to prevent unauthorized transactions

• Never share your seed phrase or private key with anyone, any website, or any support service.
• Use a hardware wallet for significant holdings. It signs transactions only when you physically press a button.
• Review every transaction before signing. Use a transaction simulator (like Tenderly or MetaMask's built-in simulation) to see what the contract will actually do.
• Keep token approvals minimal. Approve only the exact amount you need for a single swap, not unlimited amounts.
• Revoke unused approvals regularly. Many draining attacks use approvals you forgot about.
• Do not connect your wallet to unfamiliar sites. Verify the URL, domain age, and SSL certificate before connecting.

When to Assume the Wallet Is Lost

If you see repeated unauthorized transactions and you cannot identify the source, your seed phrase is likely exposed. No amount of revoking or disconnecting will stop someone who has the private key. Move everything to a new wallet immediately. The old wallet should be considered permanently compromised.

Back to phishing