Theft & hacks

Your wallet was emptied: drainers, approvals and what to do in the first hour

A wallet does not get “hacked” in the way people imagine. In almost every case one of five specific things happened, and which one it was decides what you must do in the next sixty minutes — and whether the rest of your assets are still at risk right now. Start with the triage below, then act in the order given. Nothing here requires paid tools and nothing here asks for your seed phrase.

Updated 16 October 2026 · about 11 minutes to read

First: stop the bleeding

If assets are still in the wallet, order matters more than speed:

• Assume the wallet is permanently unsafe. If the seed phrase or private key is compromised, nothing done inside that wallet helps — changing the password, renaming it, reinstalling the app or revoking approvals does not take the keys back from whoever has them.
• Create a new wallet on a clean device, ideally a different one from the one you used, and write the new seed phrase on paper. If you own a hardware wallet that was never connected to the compromised seed, use it.
• Move what is left, highest value first. Watch for the trap: with a drained seed, a bot may be watching the address and will take any gas you send in. Send the smallest possible gas amount and move the valuable asset in the same minute, or use a wallet feature that batches it.
• Staked, locked and vested positions: unstake only if the exit is fast. If there is an unbonding period, the attacker usually cannot take the position either — do not panic-send gas repeatedly into a watched address. Get help for this specific step rather than improvising.
• NFTs and small balances last. People lose their large holdings while rescuing a token worth twenty dollars.
• If the loss was from an exchange account, not a self-custody wallet, the priority is different: change the password and email password, remove unknown API keys and withdrawal addresses, re-set two-factor authentication, and contact support immediately — see the exchange guide.

The five ways it actually happens

• 1. The seed phrase left your head or your paper. Stored in a photo, in notes, in email, in a password manager that was breached, in cloud backup, typed into a “wallet verification” or “sync” page, or given to fake support. This is the most common cause by a wide margin, and it explains the cases where several chains and several wallets inside one seed were emptied at once.
• 2. A signature you gave, not a key they stole. You connected to a site and approved a transaction — approve, increaseAllowance, setApprovalForAll, permit, or a blind eth_sign of unreadable data. The site looked like a mint, an airdrop claim, a staking page, a game, a “revoke” tool or a wallet-support form. With that permission the attacker spends specific tokens whenever they like, sometimes days later, without needing your key at all. The tell: only certain tokens went, the native coin stayed, and the outgoing transaction was signed by someone else’s address.
• 3. Malware on the device. Infostealers harvest browser extension data and files; clipboard hijackers swap an address you copied for theirs; a fake app or a cracked program installs remote access. Here the first step is a clean device, not a new wallet on the same machine.
• 4. Social engineering in real time. A “support agent” for a wallet or an exchange, a “security team” calling about a suspicious login, a job interview that asks you to run code, a Discord or Telegram moderator sending a “verification bot”. The goal is a seed phrase, a screen share, or one signature.
• 5. Account takeover around the wallet. SIM swap, email compromise, or a password reused from a leak. This hits custodial accounts and anything whose recovery depends on a phone number or an inbox.

Address substitution — a payment sent to an address that looked like yours — is a different mechanism entirely and has its own page: theft by address substitution.

Working out which one it was

This is not curiosity. The answer tells you what else is compromised, and it is the core of any report:

• Open the wallet address in a blockchain explorer and look at the outgoing transactions at the moment of the loss. Who paid the gas and signed? If the sender is your own address, your key was used. If the transaction was sent by a different address and your tokens moved as a transferFrom, it was an approval.
• Was the native coin taken too? A full sweep including the native coin points at key compromise. Selected tokens gone with the native coin still there points at approvals.
• Did it happen across several chains or several accounts of the same seed? That is the seed phrase, not a site.
• Check your approvals. Use the approvals or permissions screen built into your wallet to see what the address has authorised and to whom. Revoking still matters even after a loss, because an unused allowance stays open — but revoke from the compromised wallet only after everything of value has left it, and remember revoking costs gas and does not restore anything.
• Reconstruct the last 72 hours: every site you connected to, every file you opened, every person who messaged you, every app installed, every page where you entered anything that looked like a wallet form. Write it down while you remember it.
• Check your email and phone: new forwarding rules, unfamiliar logins, a recent SIM change or a period with no signal. If the inbox is compromised, fix that before anything else.

Rebuilding safely

• Clean device first. If malware is even plausible, do not create the new wallet on the same machine. A full reinstall of the operating system is the honest answer; antivirus on an already-infected machine is not.
• New seed, generated offline, written on paper, never photographed, never typed into a web page, never stored in a cloud note. For meaningful amounts, a hardware wallet.
• Separate wallets by purpose: a “hot” wallet with small amounts for interacting with sites, and a vault that never connects to anything. Most drainer losses would have been small ones with this split.
• Treat every signature as a payment. Read what a wallet says you are approving; unlimited allowances and setApprovalForAll deserve a pause, and unreadable blind signatures deserve a refusal.
• Rebuild the account layer too: unique passwords, app-based or hardware two-factor instead of SMS, a PIN or port-freeze with your mobile operator, and a recovery email that is not used anywhere public.
• Do not reuse the old address for anything, and do not “test” it with a small deposit. Watchers keep watching for months.

Tracing and what can still be done

Honestly, so you can decide where to spend effort:

• Follow the money one or two hops yourself in a public explorer. You are looking for one thing only: does the trail reach a regulated company — an exchange deposit address, a payment service, a bridge with an operator? That is where leverage exists. The method is in the first 48 hours.
• If stolen USDT or USDC is still sitting at an address, issuers can block addresses, and they do so when authorities require it. That route does not exist for a pure Bitcoin or ETH transfer.
• Send a freeze request fast to any exchange or issuer on the path, and report the receiving address to it. Our free templates include the letter.
• File a police report with a reference number — exchanges need it to do more than note your complaint: how to report crypto theft.
• A paid tracing report is worth it only when it leads somewhere. If the funds ended at an address nobody controls or went through a mixer, a report is a document, not a remedy. Anyone selling tracing without telling you that first is selling hope.
• Drainer kits are services with operators. Many losses of this type run through the same handful of operations, whose infrastructure is known and is sometimes seized. That is why reporting the exact signature and domain matters beyond your own case.

What never helps

• “White hat hackers” who will retrieve your coins. Nobody can move funds out of an address they do not control.
• Anyone asking for your seed phrase, private key, remote access or a screen share. Without exception.
• Paying a fee up front for a promised return. That is the second scam, run from victim lists — check any offer with our free seven-question test and read the warning signs.
• “Recovery” browser extensions and apps. Several are drainers aimed at people who have just been drained.
• Waiting. The window when funds are still identifiable at a cash-out point is hours and days, not months.