You clicked “Sign.” The site looked right — an airdrop checker, a mint page, a protocol upgrade. Somewhere between 30 seconds and a few minutes later, your tokens or NFTs moved out of your wallet in transactions you never wrote. The balance is zero, or close to it.
This article is about everything that happens after that moment: what the attacker actually took, where the assets go, which post-attack actions still accomplish anything, and the second wave of fraud that reliably follows the first. For the full emergency runbook — triage, evidence preservation, exchange freeze requests — read our stolen crypto first-24-hours guide. This piece assumes you know what happened and are now asking the harder question: what now?
What a drainer actually took from you
A wallet drainer does not steal your password. It tricks you into signing a message or transaction that is the theft. Two families matter, because they determine whether you still have a time window:
| Signature type | What the attacker got | Your time window |
|---|---|---|
| Direct transfer (transferFrom, eth_sign, blind-signed raw tx) | The specific assets moved out, now | None — it is done |
| Token approval / permit signature | Standing permission to move approved tokens, at will | Yes — until revoked, the allowance stays live |
If you signed a transfer, the stolen assets are gone in the strict sense, and the rest of this article is about reporting and defense. If you signed an approval — including an infinite approval — the attack is not over. The allowance is a standing order. It endangers not just what is in the wallet now, but anything you deposit later. That single mechanical fact drives the first action below.
Where your assets go next
Understanding the destination is not morbid curiosity — it determines whether reporting can accomplish anything.
Chainalysis, which maintains longitudinal tracing of drainer operations, describes the typical pipeline: stolen assets are consolidated by the drainer’s infrastructure, then laundered through conversion services. Their data shows drainer proceeds sent to mixing services rising since 2021, while direct deposits to centralized exchanges have declined — and in 2022–2023, most drainer proceeds moved through DeFi (swaps, bridges, DEXes) where no compliance desk exists to freeze anything. Read the full breakdown in Chainalysis’s drainer analysis.
The scale is large but shrinking. Scam Sniffer’s 2025 annual phishing report measured drainer losses falling roughly 83% year over year — from about $494 million in 2024 to about $84 million in 2025 (Scam Sniffer 2025 report).
Two practical takeaways from the money flow:
- Speed beats everything. The only stage where anyone can intercept funds is while they sit in an identifiable wallet — before a mixer, before a hop chain of swaps. Every hour of delay shrinks that surface.
- Exchanges are the choke point that remains. Even with the mixer trend, most stolen value eventually touches a cash-out venue. That is where law-enforcement freezes actually happen — but only if a report with transaction hashes exists to act on.
The first hour: kill the standing allowance
If there is any chance you signed an approval rather than a one-shot transfer, treat this as the emergency it is:
- From a clean device (not the browser that got phished), open an approval checker — revoke.cash or Etherscan’s token approval checker — and connect the affected wallet.
- Find the allowance granted to the address or contract you do not recognize. Sorting by “unlimited” approvals surfaces the dangerous ones first.
- Revoke. You will pay gas for the revocation transaction — that is normal and unavoidable.
- If you cannot revoke immediately (no gas token left), do not fund the old wallet to pay for it from your other holdings without understanding the exposure — the faster pattern is moving remaining assets to a fresh wallet first, then handling the revocation.
The reason to hurry: a live approval makes your address a tripwire. Deposit anything later — a refund, a friend repaying you, an airdrop claim — and the drainer’s bot can sweep it with the allowance you already granted. We cover the full decision tree (what to move first, gas ordering, exchange deposit risks) in the first-24-hours runbook.
Reporting: the only realistic interception path
“On-chain transfers are irreversible” is true and also incomplete. Funds move through infrastructure, and that infrastructure has choke points: exchanges with compliance teams, fiat off-ramps with KYC. Freezes at those points are how publicized recoveries actually happened — not wallet sorcery, but tracing plus law enforcement plus a deposit-address freeze.
What makes a report actionable:
- Transaction hashes of the theft (from your wallet’s history or the block explorer).
- The attacker’s receiving address(es) — where funds landed, one hop out.
- Timestamps and the phishing URL if you still have it.
- In the US, file with the FBI’s IC3 — crypto complaints are aggregated and cross-case matched. Elsewhere, your national cybercrime unit.
We walk the full pipeline — IC3 field-by-field, how to word an exchange freeze request, what happens after — in how to report a crypto scam. The honest expectation: most small cases are not individually worked. But reports feed pattern files, and pattern files are what get drain rings seized. Filing is not theater.
The second wave: recovery fraud will find you
This is the part nobody warns you about, and it costs victims a second fortune.
After a theft, you are a known, verified, currently distressed lead. The CFTC’s advisory “Don’t be Re-Victimized by Recovery Frauds” is blunt about this ecosystem: recovery scams are a form of advance-fee fraud — pay upfront for the chance of recovering a larger sum later — and they specifically target people who were already victimized. The advisory cites research that the majority of fraud victims are victimized more than once, and that prior victims are targeted more than non-victims. Attackers share and resell victim lists; your loss made you a better mark, not a safer one.
The CFTC also documents the trust-manufacturing playbook: fake “recovery experts” plant press releases on small news websites through cheap distribution services, complete with fake testimonials and five-star ratings, sometimes even citing real CFTC advisories to look legitimate.
Red flags, in one table:
| Signal | What it means |
|---|---|
| They contacted you first, shortly after the theft | They are working a victim list |
| Upfront fee, “retainer,” or gas money | Advance-fee fraud, by definition |
| They ask for your seed phrase or wallet access | Second theft, in progress |
| Proof is screenshots of “recovered” wallets | Fabricatable in minutes |
| Recovery promised in days | On-chain reality does not work that fast |
| Pressure and urgency | The product is your panic |
For how these operations are structured end to end, see crypto recovery scams explained.
Why the drained address is burned
Two independent reasons to never reuse it:
- Mechanical: any approval you signed survives until revoked. A wallet with a live attacker allowance is not a wallet; it is a funnel.
- Reputational: your address now sits in the attacker’s records as an owner who signs things. Blockchain history is permanent and public — dusting attacks and address-poisoning campaigns work precisely because attackers can cheaply monitor and re-target known-active addresses.
The cheapest path is a clean break: new wallet, new seed phrase, generated on a device you trust. For interacting with unfamiliar sites going forward, keep a dedicated burner wallet that holds nothing you would miss. For long-term holdings, move them to a hardware wallet — every drainer case we have traced in our drainer identification guide shares one root cause: high-value assets lived in a hot wallet that signed things daily.
The checklist, condensed
- Clean device → revoke live approvals (revoke.cash / Etherscan)
- Move surviving assets to a fresh wallet, new seed
- Save evidence: tx hashes, attacker addresses, phishing URL, timestamps
- File IC3 / national cybercrime report same day
- Send freeze requests to exchanges if funds touched a labeled deposit address
- Treat every inbound “recovery” offer as hostile until proven otherwise (it will not be proven otherwise)
- New hygiene: burner wallet for experiments, hardware wallet for storage
- Warn the community where the phishing link circulated — you will not be the last target
Related reading
- Stolen crypto: the first 24 hours — the full emergency runbook
- How to report a crypto scam — IC3 field-by-field + exchange freeze templates
- Crypto recovery scams explained — how the second-wave industry works
- How to prevent wallet drainers — signature hygiene before it costs you
- Airdrop signature scams — the most common drainer on-ramp
- How to detect NFT wash trading — reading chain data before trusting a marketplace
Frequently Asked Questions
Can funds stolen by a wallet drainer be recovered?
Rarely, and never by services that contact you first. On-chain transfers are irreversible by design. The only realistic recovery path runs through on-chain tracing plus law enforcement plus an exchange freeze, and it works only while stolen funds are still sitting in identifiable wallets. That window is why reporting within the first day matters. Anyone DMing you with a guaranteed recovery is running the advance-fee follow-up scam that the CFTC explicitly warns about.
How do I revoke a malicious token approval?
Use a dedicated approval checker such as revoke.cash or Etherscan's token approval tool, connect the drained wallet, find the allowance granted to the attacker's contract, and revoke it. You will pay a small amount of gas for the revocation transaction. Do this from a clean device only — if malware or a fake browser extension caused the phishing, revoking from the same machine hands the attacker your next signature too.
Someone messaged me saying they can recover my stolen crypto. Is it legitimate?
No. The CFTC classifies these as advance-fee fraud targeting people who were already victimized, and its advisory notes that research shows the majority of fraud victims are victimized more than once. The tells: upfront fees, requests for your seed phrase or remote wallet access, and proof consisting of screenshots. Real recovery runs through law enforcement and takes months — it never starts with a stranger who found you after your loss.
Should I keep using the wallet that was drained?
No. If a malicious approval is still live, any asset you deposit back into that address can be swept with the same allowance — that is how token approvals work mechanically. And the drained address is now part of the attacker's infrastructure, marked as a wallet whose owner signs things. Generate a fresh wallet with a new seed phrase on a clean device, move surviving assets there, and treat the old address as burned.