A real case on Iris: the predict.fun drain of Oct 27, followed from the drained accounts to Tornado Cash. Open the board
How it happens
How Coinbase Wallet gets drained
The Coinbase name is the bait as often as the wallet is the target: many drains start with a call or a message, not a website.
Fake Coinbase support
Calls, texts and emails posing as Coinbase say your account is at risk and walk you through "securing" it: moving funds to a wallet whose recovery phrase they gave you, or typing yours into their site. Coinbase never gives you a recovery phrase or asks for yours.
Approvals and permit signatures
On Base, Ethereum and other EVM chains, a token approval or a Permit signature on a fake mint or airdrop lets the drainer move your tokens later.
A leaked recovery phrase
Kept in a screenshot, a cloud note or an email, the 12 words can be found by malware or by anyone who gets into that account.
The first hour
Stop the losses first.
Drainers come back for what's left. Four steps, in this order.
USDT
to 0x8b1f…75ba
WETH
to 0x8b1f…75ba
USDC
to 0x0000…a3f1
Revoke approvals
revoke.cash on Base, Ethereum and every chain you used.
How
Revoke approvals at revoke.cash on Base, Ethereum and every other chain you used. If funds left a Coinbase.com account instead, contact Coinbase from coinbase.com itself, never a number someone gave you. If your recovery phrase may have leaked, move everything to a new wallet first.
Old wallet
9xQe…fN2k/Seed phrase exposed
New wallet
4Lp2…cR7m/New seed phrase
Move what's left
New seed phrase, new wallet. Not a new account.
How
Create a new wallet with a new seed phrase, on a device you trust, and send it everything still in the old one. A new account in the same wallet app shares the old seed phrase and isn't safe. If a bot takes every bit of gas you send, stop sending: each deposit is lost.
Asset Recovery Team
Message request
Saw your post. We can recover your funds for a 20% fee. Send 0.3 ETH for gas to start.
ScamIgnore recovery offers
Anyone offering to get it back for a fee is a scam.
How
Anyone who writes to you after the theft promising to get the funds back for a fee is running a second scam. No one can reverse a blockchain transaction. Real recoveries come from freezes, by an issuer or an exchange holding the funds, acting on a police report.
- Reference
- CR-2026-104882
- Incident
- Wallet drained
- Evidence
- 4 tx hashes, board link
- Also filed
- ic3.gov
Report it
A police report, then ic3.gov or your country's equivalent.
How
File a police report and keep its reference number: issuers and exchanges act on it. Report it to your country's cybercrime service too (in the US, ic3.gov). Keep the transaction hashes, the site or app you connected to, and any messages.
Seed phrase leaked? Skip step 1 and move first.
Where your funds went
Follow the money, past the swap and the mixer.
Drained funds rarely sit still: they're swapped, bridged or mixed within minutes. Iris follows each step and shows where they are now, on a board you can share with the police or an exchange.
Trace a drained wallet42.618 SOL
into the pool
Privacy Cashprivacy pool / mixer20 SOL
got 19.924 after the fee
22.618 SOL
got 22.532837 after the fee
20 + 22.618 = 42.618 SOL, to the lamport. Matched by amount, fees and timing.
Swaps
A DEX swap read from the transaction, and a FixedFloat or SideShift order tied to its payout by amount, rate and timing.
Bridges
Where a cross-chain transfer landed, from the bridge's own records: Relay, Mayan, deBridge, Wormhole, LayerZero, THORChain and more.
Mixers
Deposits matched to withdrawals in Tornado Cash, Railgun, Privacy Cash and other pools, even when the money comes out in pieces.
Free, no account
10 wallet analyses and 3 traces per device, on Solana, Ethereum, Base, Arbitrum, BNB Chain, Bitcoin, Tron and more.
Freezes
Some funds can still be frozen.
It depends on where they sit now. Tracing tells you which side.
your fundsUSDT on TronTether can freeze
Can be frozen
- USDT, USDC
- Tether and Circle blacklist the address, on a police request.
- Exchange
- It can freeze the account the funds reached.
Can't be frozen
- ETH, SOL, BTC, TRX
- Native coins: no issuer can freeze them.
- Thief's wallet
- Most tokens it holds. Tracing shows where they go next.
Trace, then request a freeze
Find the funds on the board, then press Request a freeze. Iris prepares the evidence and routes it to the issuer or the exchange. In beta: every request is reviewed by hand, and a freeze is never guaranteed.
By wallet
Drained from a specific wallet?
Questions
What victims ask first
Can Coinbase reverse a drained Coinbase Wallet transaction?
No. Coinbase Wallet is self-custody, so Coinbase doesn't hold the funds and can't reverse a transaction on the chain. If the stolen funds were later sent to an exchange, Coinbase's included, that exchange can act on the account that received them, which is why tracing where they went matters.
Can stolen crypto be recovered?
Sometimes, mostly through a freeze: when the stolen funds are still in USDT or USDC, or have reached an exchange, the issuer or the exchange can lock them, usually at the request of the police. A blockchain transaction itself can't be reversed. The sooner the funds are traced and reported, the better the odds.
How do I find out where my stolen crypto went?
Paste the drained wallet's address into Iris. It shows where the funds went and follows them through swaps, bridges and mixers, on Solana, Ethereum, Base, Arbitrum, BNB Chain, Bitcoin, Tron and more. It's free without an account: 10 wallet analyses and 3 traces per device.
Should I revoke approvals or move my funds first?
If your seed phrase or private key may have leaked, move first: the thief can sign anything, and revoking changes nothing. If you only signed an approval or a permit on a site, revoke it, then move what's left to a new wallet anyway.
Are crypto recovery services legit?
Be very wary. People who message you after a theft offering to recover the funds, often for an upfront fee or "gas", are a well-known second scam. No one can hack the funds back. Legitimate help works through freezes and the police, and never asks for your seed phrase.
Can stolen funds be traced through a mixer or a bridge?
Often, yes. A bridge records where each transfer lands, and a mixer pays out amounts at times that can be matched to what went in. Iris does both for the bridges and privacy pools it supports, and shows the trail on a board.
Can Tether freeze stolen USDT?
Yes. Tether can blacklist an address holding USDT, on Tron, Ethereum and other chains, and the USDT there can no longer move. It acts on requests from law enforcement, so file a police report and give it the address holding the funds and the transactions that moved them there.
Find out where your funds are now.
Paste the drained wallet. It takes a minute, and you don't need an account.
Trace my funds