KeyStone
Get in touch
EN ES
← All articles

First aid · Antivirus

My antivirus deleted the wallet file

Good news first: antivirus tools almost never delete. Normally they move the file to a quarantine area, from which it can be restored. What you do need is to act before that quarantine clears itself.

October 6, 2026 · 3-minute read

Why this happens

Many wallets, especially old ones and those doing heavy computation, look from the outside like malicious programs: they access encrypted files, use a lot of processor and aren’t signed by a known company. Antivirus tools flag them as a precaution, not because the wallet is malicious.

What to do, in order

  1. Open your antivirus and find the quarantine area. It is usually called quarantine, blocked threats or detection history.
  2. Search by date, not by name: you will see what was blocked on the day the wallet stopped working.
  3. Restore the file and, at the same time, add it as an exception so it isn’t picked up again.
  4. Copy it immediately to two separate places outside that computer.
  5. If it isn’t in quarantine, check the system recycle bin and the machine’s automatic backups.
Do it soon. Many antivirus tools empty quarantine automatically after a few days or weeks. And meanwhile, don’t reinstall or uninstall the antivirus: that genuinely can take the quarantine with it.

If the file is nowhere to be found

Then the case becomes a deleted-file case, and the rule is the same: stop using that computer. Every minute of use reduces the chance of salvaging it from the disk. See I reformatted the computer where my wallet was.

And before anything else: if you have the recovery phrase written on paper, none of this matters. Restore the wallet in any app and forget the file. It is worth looking for that paper before fighting the antivirus.

A warning about the other scenario

If the antivirus detected something on the same day your wallet was emptied, the story may be different: perhaps it didn’t block your wallet but a program that robbed you. In that case the urgent thing isn’t recovering the file, it is securing whatever is left: what to do if you think your phrase is compromised.

Keep reading