My wallet was drained: what to do right now

What happened: you almost certainly signed something, not “lost your key”

Most drains don't happen because someone guessed your private key. They happen because you interacted with a malicious site — a fake airdrop, a bogus mint, a “connect your wallet to claim” — and signed a transaction or an approval that gave a contract permission to move your tokens.

These contracts are called wallet drainers. With a single deceptive signature (an approve, a permit, a setApprovalForAll, or a blind-signed message) they get permission to drain a token, an NFT collection, or — in the worst cases — everything they can reach. That's why the wallet is sometimes emptied minutes or hours after you signed: the approval stayed active.

The other scenario is a leaked seed phrase or private key: you pasted it into a phishing site imitating your wallet, saved it in a photo or the cloud, or typed it into a “support” form. In that case the attacker has full control and the drain is usually immediate and total.

First steps: do this now

Time is against you. If the wallet still holds anything, or if approvals are active, every minute counts. Do this in order:

• Move any remaining assets to a brand-new wallet created on a clean device (ideally a hardware wallet), with a fresh seed phrase that has never touched the internet. Don't use the compromised wallet — not even to “rescue” funds with that same seed.
• Revoke token approvals: go to revoke.cash or the Token Approvals section of Etherscan/BscScan and remove every suspicious or unknown authorization. As long as an approve stays active, the drainer can re-empty anything you deposit.
• Assume your seed phrase is compromised and never reuse it again — on any chain, in any wallet. A leaked seed can't be “fixed”: it gets abandoned.
• Disconnect the wallet from every dApp (in MetaMask: Connected sites / Permissions, or from the site itself) to cut active sessions.
• Never share your seed phrase or keys with anyone — not “support”, not a “recovery agent”, not a supposed wallet employee. No legitimate service will ever ask for it.

Beware the second scam: “recovery agents”

The moment your wallet is drained, messages start appearing from people promising to get everything back: on Telegram, X, forum comments, or replies to your cry-for-help tweet. They're scammers who smell a freshly hit victim.

Simple rules: nobody legitimate guarantees recovery, nobody legitimate contacts you first to “help”, and nobody doing real work will ask for your seed phrase or an upfront fee to “unlock” the money. If you see any of those signs, it's the same scam again.

What can actually be done: trace the drainer

Every move of the drain was recorded on the blockchain forever. Forensic analysis reconstructs the path hop by hop: from your wallet to the drainer's collector wallet, and from there to wherever the attacker tries to cash out (an exchange, a mixer, or a cross-chain bridge).

The advantage with drainers is that they're rarely handmade: they're usually kits (drainer-as-a-service) that reuse the same collector wallets and contracts across hundreds of victims. That pattern lets us cluster addresses and link your case to others, which strengthens identification of the operator.

If the funds end up at an exchange with identity verification (KYC), the case becomes especially useful; if they enter a mixer, we document it and honestly explain the limit.

What the forensic report enables

The trace is delivered in a report that documents, with hashes and addresses, where your funds went and which drainer wallets are involved. That gives you concrete options — not a promise.

• Report the drainer's collector wallets so they get flagged in the risk databases exchanges rely on.
• Submit the evidence to an exchange's fraud desk if the funds reached a KYC platform, to request a freeze or escalation.
• Back a police complaint or claim, with the technical traceability already done and ready to present.
• Know the real scope of the theft with certainty: what moved, over which chain, and how far the trail can be followed.