Your wallet was drained — what to do in the first hour
The Editor·11 min read·Updated 31 Aug 2026
Wallet drained: what to do first, in order. Move what is left, revoke approvals, identify the vector, preserve hashes, report — and why recovery is unlikely.
Move whatever survived to a brand-new wallet on a clean device, revoke approvals on the compromised address, treat the seed phrase as permanently burned, work out how the attacker got in, preserve the transaction hashes, and file a report. Recovery is very unlikely. Anyone contacting you to promise it is running the next attack.
Jurisdiction: United States, with pointers for other jurisdictions below. Last reviewed 31 August 2026. This is general information, not legal, tax or security advice — consult a qualified professional about your own facts.
Recourse is poor, and knowing that changes what you do next
On-chain settlement is final by design. There is no chargeback, no deposit insurance, no ombudsman and no intermediary who can reverse a transfer. If the assets left a self-custodied wallet, whoever holds them now controls them.
The cases where victims saw money again share two features: the attacker was identifiable and within reach of a court, and assets were traced and frozen quickly, usually because the funds hit a centralised exchange before being laundered. Neither is common in a routine drain — which is a reason to spend the first hour stopping further loss, building a record, and filing a report, rather than chasing recovery.
Step one: move what is left, before anything else
This is the only step where minutes matter. Do it before you investigate, post, or contact anyone.
- Create a genuinely new wallet. New seed phrase, generated on a device you have reason to trust — ideally not the one you were using, or a hardware wallet. Do not import the old seed, and do not use a spare account derived from it: every account under one seed shares one secret, and if that secret leaked they are all gone.
- Send the surviving assets out, highest value first. Check every chain the address has touched, not just the one where the loss appeared, and check staked, deposited and vesting positions — attackers often take the easy balance and come back for the rest.
- Expect a sweeper bot if the key itself is compromised. Where an attacker holds your private key, scripts watch the address and take any incoming gas within a block or two, so funding it to "rescue" tokens usually just donates the gas. Doing it properly means bundling funding and transfer into one atomic transaction through a private relay — specialist work, rarely worth it for small balances.
- Do not sign anything else from the old wallet, and never sign a transaction someone sends you as a fix.
Step two: revoke approvals on the compromised address
A token approval is a standing permission you gave a contract to move a specific token on your behalf, often for an unlimited amount, and it persists until revoked. If the drain came through an approval you signed on a malicious site, the attacker does not have your key — they have a permission, and cancelling it closes the door.
Revoke on every chain the address has used, because allowances are per-chain and per-token. The mechanics and gas cost are in how to revoke token approvals. Revoke.cash is the standard EVM tool; on Solana, revoke delegate authority on the relevant token accounts.
Two caveats. Revoking does not reverse a transfer that has already happened. And if your seed phrase leaked it is close to pointless, because the attacker can sign as you and re-approve.
Step three: treat the seed phrase as permanently burned
If there is any realistic chance the seed was exposed — you typed it into a site or app, photographed it, stored it in a cloud note, or simply cannot account for how the drain happened — it is compromised for the rest of its life. There is no rotation, no password reset, no way to make it safe again.
The address is unusable forever, not just for now. Do not receive an airdrop to it, accept a refund to it, or fund it for gas. Do not use any other account derived from that seed, on any chain, and treat any second wallet app set up from it as compromised too.
A hardware wallet does not change this if you entered the recovery phrase into software. If the device signed the malicious transaction and the seed never left it, the hardware is not the problem — the fix is a change in what you sign, not new equipment.
Step four: identify the vector, because it determines what else is exposed
You cannot secure the rest of your holdings without knowing which failure this was. Four vectors cover most drains.
| Vector | What it looks like | What is compromised | Does revoking help? |
|---|---|---|---|
| Malicious approval | You connected to a site, signed an approval, tokens left later — sometimes days later | The allowance only | Yes |
| Malicious signature | An off-chain signature (Permit, Permit2, or a "sign in" prompt) that authorised transfers without an on-chain approval | The allowance or an order authorisation | Yes, where it created an on-chain allowance |
| Seed or key exposure | Everything went at once, across chains, including native gas assets | The entire seed, permanently | No |
| Clipboard or malware | Funds went to an address that looks similar to the one you copied, or your device behaves oddly | The device, and potentially the seed | No — clean the device first |
The tell that separates the first two from the third is scope. Approval-based drains take specific tokens and typically leave the native gas asset behind, because an approval only covers ERC-20-style tokens. A drain that takes the gas asset too means the attacker signed as you — the key is gone.
Record how you reached the site — a search advertisement, a link in a reply, a message from an account impersonating a project. The channel is often more diagnostic than the site, and phishing sites that mimic explorers, bridges and DEXs covers the patterns these campaigns reuse. If the token involved was itself an impersonation, checking you have the right contract explains how the mismatch shows up.
Then clean the machine. Where malware is plausible, assume anything typed on that device since the compromise — exchange passwords, email — is known to the attacker.
Step five: preserve the evidence before it disappears
Do this before you post publicly. Phishing domains, project channels and impersonator accounts are frequently deleted within hours.
Record the transaction hashes for every unauthorised transfer, your own addresses, the destination addresses, the token contracts and chains involved, and timestamps in UTC. Note amounts in tokens and in fiat value at the time of transfer, since a loss quantified later at a different price is a weaker claim.
Then capture the off-chain half. Screenshot the site with the full URL visible, the message or advertisement that sent you there, and any wallet prompt you approved. Submit the URLs to a public web archive so there is a timestamped third-party record rather than an image on your own machine.
Finally, follow the money one hop. If the funds landed at a centralised exchange's deposit address, that is the single most useful fact in your report — exchanges can freeze deposits and act on law enforcement requests far faster than on individual emails. Say so explicitly when you file.
Step six: report it
Reporting probably will not return your money. It is still worth an hour, because aggregated reports are how campaigns get identified, and an exchange freeze is only possible where a report exists.
In the United States, file with IC3.gov, the FBI's Internet Crime Complaint Center — the primary federal intake for fraud with an online component, and the report law enforcement most often works from. Keep the reference number. Then file with the FTC at ReportFraud.ftc.gov and your state attorney general's consumer protection division. These are separate intakes.
Outside the United States, report to your national cybercrime service and your financial conduct or securities regulator — in the UK, Action Fraud and the FCA. Coverage is narrower than people assume: UK memecoin holdings carry no FSCS protection and no Financial Ombudsman access, so a regulator report is an intelligence contribution, not a compensation route.
If the amount is large, speak to counsel about emergency civil options immediately rather than after filing. Asset-freezing applications depend entirely on speed.
The second attack: recovery scams find you within hours
This is where victims lose more than they lost in the original drain, and it starts as soon as the loss is visible on-chain.
You will be contacted. The approaches are consistent: a "blockchain recovery specialist" or "certified crypto investigator", a firm with a polished site and fabricated case studies, a fake law firm, a "white hat" claiming to have located your funds, an account impersonating your wallet's support, or someone posing as law enforcement following up on the report you filed. Many will correctly cite details of your loss. That proves nothing — your transactions are public, and so is your post about them.
The rules are absolute:
- Never pay an upfront fee. Every advance-fee variant ends the same way, with new charges appearing after each payment — taxes, gas, unlocking costs, escrow — until you stop paying.
- Never share a seed phrase or private key with anyone. No legitimate recovery process, regulator or support team ever needs it. A request for it is a theft attempt by definition.
- Never connect the new wallet to a "recovery" tool. The standard outcome is that whatever survived the first attack goes in the second.
- Never trust an unsolicited approach, including one in the replies to your own post or in a group you were added to.
Legitimate blockchain analytics firms exist and work for law enforcement, exchanges and litigants. They do not cold-message individuals. If you want professional help, initiate it yourself through an attorney you found independently, and expect to be told the prospects are poor. Report the recovery approach too.
What this doesn't tell you
It does not tell you that you will get your money back, because in most cases you will not. It cannot tell you which vector hit you, only how to narrow it down — where the amount is significant and the cause unclear, a professional review of your device and signing history beats any checklist.
It also does not cover the different situation where the token failed rather than your wallet being compromised: no approval, no leaked key, just liquidity pulled or a team walking away. That is a different sequence, set out in what to do after a rug pull. The reporting channels above are current as of 31 August 2026 and do change; check each agency's own site before filing.
Going forward, the defences that work are unglamorous: a separate wallet holding only what you can lose for launch-day activity, a hardware wallet for what you intend to keep, periodic approval revocation, and reading each transaction before approving it. Verifying a token contract yourself rules out a whole category of this.
Frequently asked questions
Can drained crypto be recovered?
Rarely. Self-custody and irreversible settlement mean there is no one to reverse the transfer. The realistic exception is where funds reach a centralised exchange quickly and law enforcement or a court order reaches that exchange before the assets are withdrawn. Report fast and include the destination exchange if you can identify it, but do not plan around recovery.
Should I move my remaining crypto or revoke approvals first?
Move first. Revoking is a transaction that takes time to confirm and only helps against approval-based drains, while an attacker holding your key can act during that window. Get the surviving assets into a wallet with a brand-new seed phrase, then revoke on the old address, then work out the vector.
Is my wallet safe if I just remove the malicious approval?
Only if an approval was the vector. If your seed phrase or private key was exposed, revoking changes nothing — the attacker can sign as you and re-approve at will. In that case the address is permanently compromised and the only remedy is to stop using it and every account derived from that seed.
Someone messaged offering to recover my funds. Is it real?
No. Unsolicited recovery offers are a follow-on scam that targets victims within hours of a visible on-chain loss. They ask for an advance fee, a seed phrase, or a wallet connection, and each of those ends in a second loss. Legitimate investigators work for exchanges, courts and law enforcement, and do not cold-message individuals.
Do I have to report a drained wallet?
There is no obligation, but there are reasons to. Reports are the only route to an exchange freeze or cross-victim pattern matching, and a complaint reference is useful if you later discuss a theft-loss position with a tax professional — a genuinely unsettled area for individuals in the US, and one for a CPA rather than an article.
The one claim a stranger can actually verify before money moves
Nothing above undoes a loss. What it suggests is which claims are worth checking first, and a liquidity lock is one a buyer can confirm without trusting anybody. A fixed-term LP lock recorded on-chain with Team Finance — built by TrustSwap, which also builds Meme Central — holds LP tokens for a set period on Ethereum, Robinhood Chain, Polygon, Base and BNB, and shows as a verified badge on that token's page in the Meme Central launch feed. It says nothing about the site you connect your wallet to, which is where drains start.
Nothing here is financial, legal or tax advice. Memecoins are extremely high-risk: most lose most of their value, and the majority of tokens launched never reach a decentralised exchange at all. Never spend money you cannot afford to lose entirely. Meme Central does not recommend any specific token. Data described as Meme Central's own reflects tokens indexed by Meme Central and is not whole-market data.
This article is general information about a fast-moving area of law and was last reviewed on 31 August 2026. It is not legal or tax advice, rules differ materially by jurisdiction, and your facts matter. Consult a qualified attorney or accountant before acting.
