Crypto wallet drained? What to do now, and how to trace the stolen funds

Your wallet was emptied. The transfers are on-chain and final: no bank can reverse them. But stolen crypto doesn't disappear. It moves through addresses anyone can read, and often ends up somewhere that can freeze it: an exchange, or a stablecoin issuer like Tether or Circle.

This guide is the order we'd work in: stop the losses, trace where the money went, ask the people who can freeze it, and file the reports that make them act.

If you only do one thing now: paste the drained wallet on Iris to see where the funds went. No account needed.

The first hour: stop the bleeding

What to do depends on how the attacker got in. Look at the theft transactions on a block explorer, or on Iris, and match them to one of these three cases.

1. Your seed phrase or private key leaked

Signs: everything left at once, often on several chains. Tokens you never approved anywhere were taken. Native coins (ETH, SOL, BNB) you send in to pay for gas disappear within seconds: a sweeper bot is watching the address.

What it means: the attacker can sign anything you can. Revoking approvals won't help. The wallet is lost for good, and so is every other address made from the same seed.

What to do:

• Create a new wallet with a new seed phrase, on a clean device. A hardware wallet is best. Never reuse or import the old seed.
• Move what's left to it, most valuable first. Staked, locked or vesting tokens stay exposed until they unlock.
• Don't send gas to the old wallet if a sweeper bot is active: it will be taken. Rescuing assets from a swept wallet needs bundled transactions. Ask SEAL 911 for help, for free (more on them below). Revoke.cash's guide also points to the Flashbots Whitehat Hotline when more than $1,000 is left.
• Find the leak. A seed typed into a website, a photo or note in the cloud, a fake wallet app or browser extension, malware on your computer, a key in a server's environment variables (as in the Railway hack). Scan or reset the device, and change your passwords, before you trust it again.

2. You approved a malicious contract

Signs: one token was taken, or a few, but not everything. You recently connected to a site and confirmed a transaction: a "claim", a "mint", an airdrop, cheap energy on Tron. A token approval checker shows an approval to a contract you don't know.

What it means: you gave a contract the right to spend a token. The contract keeps that right until you remove it, and it will take any more of that token you receive.

What to do:

• Revoke the approval now. On EVM chains, use Revoke.cash. On Tron, use a token-approval checker such as Tronscan's. Revoking costs a little gas.
• Check every chain you used with that wallet, not just the one that was hit.
• Your seed is not compromised. Once every bad approval is revoked, the wallet can stay in use. Moving to a fresh one costs little and removes the doubt.

Example: tronify.rent asked Tron users for one unlimited USDT approval, then emptied their wallets seconds later.

3. You signed a message (permit or marketplace order)

Signs: you signed something in your wallet, without paying gas, and tokens or NFTs left later. Explorers show the attacker's address sending the transaction, not you.

What it means: a permit signature is an approval made off-chain. The attacker submits it when they choose. Marketplace signatures work the same way for NFTs.

What to do:

• If the funds are already gone, the signature has been used. Check for an approval it left behind, and revoke it as in case 2.
• If you signed but nothing moved yet, cancelling may still work. Revoke.cash has a Signatures page for this. Attackers usually use a signature within seconds, so this rarely wins the race (how permits work).
• Unless you also typed your seed somewhere, the key is safe.

Not sure which case you're in? Treat it as a leaked key. Moving to a new seed phrase is safe in all three cases.

Get help during an active incident

SEAL 911 is a free emergency hotline run by the Security Alliance, a group of crypto security researchers. You reach it through its Telegram bot, linked from that page. Use it while something is still happening: a sweeper bot, funds still in a contract, a protocol under attack. SEAL 911 will never ask for your seed phrase, your keys or a payment.

Trace where the money went

Tracing does two things. It tells you whether anything can still be frozen. And it gives the police, the exchange and the issuer the exact addresses and transactions they need.

With Iris, step by step

1. Paste your wallet on iriscan.app/drained. Iris maps where its money went, card by card, biggest flows first. It works on Ethereum, Base, Arbitrum, BNB Chain, Solana, Bitcoin, Tron and more.
2. Find the attacker's address. It's the card that received the stolen tokens. In a key leak, it's often the same address on every chain. Iris flags wallets that behave like drainers, for example one that received the full balance of many wallets.
3. Follow the money one hop further. Open the attacker's card. Stolen funds usually go one of four ways:
   • An exchange deposit address. The best lead. A deposit address belongs to one customer, and the exchange knows who they are. Iris labels deposit addresses and the exchange they forward to.
   • A bridge. Iris reads where a cross-chain transfer landed from the bridge's own records (Relay, Mayan, deBridge, Wormhole, LayerZero, THORChain and more) and continues on the other chain.
   • An instant swap like SideShift or FixedFloat. Iris matches what went in to what came out by amount, rate and timing (how it works).
   • A mixer or privacy pool like Tornado Cash, Railgun or Privacy Cash. Iris suggests the withdrawals that match a deposit, each with a confidence score and its reasons. These are leads, not proof. The methodology explains how sure each match is.
4. Note where the money sits now. Stablecoins (USDT, USDC) still in the attacker's wallets can be frozen by their issuer. Funds in an exchange deposit can be frozen by the exchange.
5. Save the board and write a case report. A case report puts every address and transaction in one shareable page, with the evidence linked. It's the document to send to the police and the exchange. From a saved board, Request a freeze (beta) asks the Iris team to prepare the evidence and route it to the issuer, the exchange and law enforcement. Iris never charges for it.

Two real examples: in the Railway hack, $302,000 went into three HitBTC deposits and $80,000 of USDC stayed parked where Circle can freeze it. In the Vanish drain, the money crossed three bridges into Tornado Cash and FixedFloat, and one of the wallets on the trail was funded by a Bybit withdrawal nine days before the attack.

Beware of address poisoning. After a theft, scammers send fake tokens or tiny transfers from look-alike addresses, so your history shows addresses that match the real ones in the first and last characters. Copy addresses from the transaction itself or from your case report, never from your wallet's history.

Who can freeze stolen funds, and what they need

No one can reverse a transaction. A few parties can stop the money from moving again.

• Tether (USDT) and Circle (USDC) can block an address and freeze the stablecoins in it. Both act on requests from law enforcement or legal process, not on a victim's email. Circle's USDC terms say it may freeze USDC when it receives a legal order from a valid government authority. So the path runs through a police report: give the officer the addresses holding USDT or USDC, and ask them to contact the issuer.
• Exchanges can freeze the account behind a deposit address. Write to the exchange's support or compliance team as soon as you see a deposit. Many will only act, or share who the customer is, on a request from law enforcement, so include your police report number.
• Bridges and swap services sometimes hold or refund an order still in progress. It's worth a message when funds are mid-route.

What to send each of them, in one message:

• The drained wallet, and the attacker's address.
• The transaction hashes: the theft, and each hop to where the funds are now.
• The address holding the funds now (the deposit address, or the wallet with USDT or USDC), with the amount, the chain and the time.
• Your police report or crime reference number.
• A link to your case report, if you made one.

Speed matters most. Exchanges move deposits into their own wallets within hours, and stablecoins left in an attacker's wallet can be swapped or bridged at any time.

File a report

A police report is what lets issuers and exchanges act, and what lets an investigation start. File one even for a small loss: police link cases by the attacker's addresses.

• United States: IC3, the FBI's Internet Crime Complaint Center, or your local FBI field office. The FBI says transaction details matter most: addresses, amount and type of crypto, date and time, and transaction hashes (FBI guidance for crypto scam victims).
• United Kingdom: Report Fraud, which replaced Action Fraud in England, Wales and Northern Ireland. In Scotland, report to Police Scotland on 101.
• France: file a plainte at a police station or gendarmerie, or by letter to the procureur de la République (how to file, on service-public.gouv.fr). Some online scams can be reported online through THESEE. Cybermalveillance.gouv.fr helps victims with next steps, and Pharos takes reports of scam websites.
• Elsewhere: your national police or cybercrime unit.

Keep the report number. Quote it in every message to an exchange or issuer.

Watch out for recovery scams

Right after a theft, victims become targets again. "Recovery experts", "blockchain lawyers" and fake officials reply to your posts or message you directly. They promise to get your crypto back for a fee, or ask for your seed phrase to "secure" what's left.

• No one can reverse a blockchain transaction or hack it back. Anyone who says so is lying.
• The FBI warns of fake law firms that claim to work with government agencies and ask victims for fees. It says no law firm is an official partner of US government agencies, and law enforcement doesn't charge victims to investigate (FBI warning).
• Never share your seed phrase or private key. Not with support, not with police, not with SEAL 911, not with Iris. None of them need it.
• Never pay upfront to "unlock", "release" or "verify" recovered funds.
• If someone contacted you first, assume it's a scam. Revoke.cash has a good write-up on recovery scams.

Realistic expectations

Most stolen crypto is never recovered. Your chances are best when:

• the funds sit in USDT or USDC that the issuer can freeze;
• they reached a regulated exchange that knows its customer and answers law enforcement;
• you acted within hours, before the money moved again;
• you filed a police report with exact addresses and transaction hashes.

They are lower when the money went through a mixer, into a swap service that doesn't freeze, or to an exchange that doesn't cooperate. Even then, a precise trace on file means that if the attacker is caught, or touches a regulated exchange later, your case can be linked to them. Recoveries do happen: in our launchpad case, a user got his 20 SOL back 2.5 hours after we published the trace.

Checklist

1. Identify the drain type: leaked key, approval, or signature.
2. Leaked key: new seed, move what's left, find the leak. Approval or permit: revoke it.
3. Active incident: contact SEAL 911.
4. Trace the funds on Iris and note where they sit now.
5. File a police report, and keep the number.
6. Send the exchange or issuer the addresses, transaction hashes and report number.
7. Ignore anyone offering to recover your crypto for a fee.