How crypto wallets get drained on a Mac, and how to stop it.

1Where stealers look for your recovery phrase

Mac stealers go straight for wallets. Atomic (AMOS) targets about 50 browser wallet extensions and desktop wallets such as Electrum and Exodus, plus the keychain and files on your Desktop and in Documents (BleepingComputer, 2023). MacSync, spread through pasted Terminal commands in 2025 and 2026, takes crypto wallet recovery phrases with the keychain (The Hacker News, 16 March 2026).

So a recovery phrase typed into Notes, saved as a .txt file, kept as a screenshot or sent to yourself by email is one search away for any stealer that runs on the Mac, even for a minute.

2Find the phrases you left on your Mac

These commands list files on your Mac whose text contains the words people write next to a phrase. They only search; they don't open or send anything:

mdfind -onlyin ~ "recovery phrase"

mdfind -onlyin ~ mnemonic

mdfind -onlyin ~ "seed phrase"

Look through your Screenshots too: in Photos, search for "recovery phrase", "seed" or "wallet"; Photos finds text inside pictures. Delete what you find after you've copied the phrase to paper, then empty the Trash and the Recently Deleted album.

3Clipboard swaps

A clipper watches your clipboard. When you copy something that looks like a crypto address, it swaps in the attacker's address of the same kind, so what you paste isn't what you copied.

The habit that stops it: after pasting, compare the whole address, not just the first and last few characters, with the one you meant to use. On a hardware wallet, compare it on the device's screen before you confirm.

4Address poisoning: the look-alike in your history

Attackers send tiny amounts from addresses that start and end like ones you've used, so a look-alike sits in your own history. Copy from the history once and the money goes to them.

It works: two people lost over $62 million this way in December 2025 and January 2026, one about $50 million and one $12.2 million, the second after copying an address from their transaction history (Cointelegraph on Scam Sniffer's figures, 9 February 2026).

It happened to MLX too: right after MLX moved its funds to new cold wallets on 2 November 2026, look-alike addresses started sending dust to them on Solana and BNB Chain.

• Never copy an address from your transaction history.
• Save the addresses you send to often as contacts, and pick them from there.
• Ignore tiny incoming amounts from addresses you don't know. Don't send them back.
• Send a small test first to any new address, and check it arrived.

5A five-minute wallet check

1. Search your Mac for written-down phrases (the commands above) and your screenshots.
2. Open your browser's extensions page. Keep only the wallets you installed yourself, from the wallet maker's own link; remove anything you don't recognise.
3. Check that macOS is up to date: System Settings → General → Software Update.
4. On EVM chains, review old token approvals you no longer need and revoke them, for example with Revoke.cash.
5. If you ever pasted a command from a web page into Terminal, do the Mac check as well.

6If your wallet was drained

1. Move whatever is left to a new wallet created on a clean device, with a new recovery phrase. Never reuse the old phrase.
2. Change the passwords for your email and exchange accounts from that clean device, and turn on two-factor authentication.
3. If the funds went to an exchange deposit address, report it to that exchange right away with the transaction ID.
4. A blockchain transfer can't be reversed. Anyone who offers to get your crypto back for a fee is running a second scam.

7Questions

My wallet was drained. What do I do?

Move what's left to a new wallet made on a clean device, with a new recovery phrase, and change your email and exchange passwords from that device. If the funds went to an exchange, report the transaction ID to that exchange. Then check how the phrase leaked before you use the Mac for crypto again.

What is address poisoning?

Attackers send tiny amounts from addresses that look like ones you've used, so a look-alike appears in your history. If you copy from the history, you send to them. It happens on every chain, including Ethereum, BNB Chain, Tron and Solana. Pick addresses from saved contacts instead.

Where should I store my seed phrase?

On paper or metal, offline, in two separate places. Never in Notes, a text file, a screenshot, a photo, an email or a cloud drive. For larger amounts, use a hardware wallet so the keys never touch the computer.

Is it safe to keep my recovery phrase in a password manager?

It's far better than a note or a screenshot, but it's still on the computer: a stealer running as you can sometimes reach it. For anything you can't afford to lose, keep the phrase offline.

Can stolen crypto be recovered?

Usually not: a transfer on a blockchain is final. If it went to an exchange, that exchange may freeze it when you report it quickly. Ignore anyone who offers recovery for a fee.