A real case on Iris: the predict.fun drain of Oct 27, followed from the drained accounts to Tornado Cash. Open the board
How it happens
How Ledger wallets get drained
The device protects the keys, not what you sign with them, and not a recovery phrase written down somewhere else.
Blind signing
When the device can't decode a transaction or a message, it shows only a hash, and you approve without seeing what it does. Clear signing, where the screen spells out the action, is the safer path: keep blind signing off unless you need it.
The recovery phrase typed online
Ledger never asks for your 24 words: not by email, letter, phone, support chat or app. Fake Ledger Live apps, fake firmware updates and phishing that says your device needs "verifying" all end with a form for the phrase. With it, anyone can empty the wallet without the device.
Approvals signed with the device
A token approval or a permit signed through MetaMask or Phantom with a Ledger connected is as binding as one signed without it. The drainer can use it later, without ever touching your device.
The first hour
Stop the losses first.
Drainers come back for what's left. Four steps, in this order.
USDT
to 0x8b1f…75ba
WETH
to 0x8b1f…75ba
USDC
to 0x0000…a3f1
Revoke approvals
revoke.cash for EVM, TronScan for Tron, confirmed on the device.
How
Revoke approvals on each chain your Ledger accounts used (revoke.cash for EVM chains, a token-approval revoker for Solana, TronScan for Tron), confirming each one on the device. If the 24 words may have leaked, skip this and move everything to a new wallet with a new recovery phrase at once.
Old wallet
9xQe…fN2k/Seed phrase exposed
New wallet
4Lp2…cR7m/New seed phrase
Move what's left
New seed phrase, new wallet. Not a new account.
How
Create a new wallet with a new seed phrase, on a device you trust, and send it everything still in the old one. A new account in the same wallet app shares the old seed phrase and isn't safe. If a bot takes every bit of gas you send, stop sending: each deposit is lost.
Asset Recovery Team
Message request
Saw your post. We can recover your funds for a 20% fee. Send 0.3 ETH for gas to start.
ScamIgnore recovery offers
Anyone offering to get it back for a fee is a scam.
How
Anyone who writes to you after the theft promising to get the funds back for a fee is running a second scam. No one can reverse a blockchain transaction. Real recoveries come from freezes, by an issuer or an exchange holding the funds, acting on a police report.
- Reference
- CR-2026-104882
- Incident
- Wallet drained
- Evidence
- 4 tx hashes, board link
- Also filed
- ic3.gov
Report it
A police report, then ic3.gov or your country's equivalent.
How
File a police report and keep its reference number: issuers and exchanges act on it. Report it to your country's cybercrime service too (in the US, ic3.gov). Keep the transaction hashes, the site or app you connected to, and any messages.
Seed phrase leaked? Skip step 1 and move first.
Where your funds went
Follow the money, past the swap and the mixer.
Drained funds rarely sit still: they're swapped, bridged or mixed within minutes. Iris follows each step and shows where they are now, on a board you can share with the police or an exchange.
Trace a drained wallet42.618 SOL
into the pool
Privacy Cashprivacy pool / mixer20 SOL
got 19.924 after the fee
22.618 SOL
got 22.532837 after the fee
20 + 22.618 = 42.618 SOL, to the lamport. Matched by amount, fees and timing.
Swaps
A DEX swap read from the transaction, and a FixedFloat or SideShift order tied to its payout by amount, rate and timing.
Bridges
Where a cross-chain transfer landed, from the bridge's own records: Relay, Mayan, deBridge, Wormhole, LayerZero, THORChain and more.
Mixers
Deposits matched to withdrawals in Tornado Cash, Railgun, Privacy Cash and other pools, even when the money comes out in pieces.
Free, no account
10 wallet analyses and 3 traces per device, on Solana, Ethereum, Base, Arbitrum, BNB Chain, Bitcoin, Tron and more.
Freezes
Some funds can still be frozen.
It depends on where they sit now. Tracing tells you which side.
your fundsUSDT on TronTether can freeze
Can be frozen
- USDT, USDC
- Tether and Circle blacklist the address, on a police request.
- Exchange
- It can freeze the account the funds reached.
Can't be frozen
- ETH, SOL, BTC, TRX
- Native coins: no issuer can freeze them.
- Thief's wallet
- Most tokens it holds. Tracing shows where they go next.
Trace, then request a freeze
Find the funds on the board, then press Request a freeze. Iris prepares the evidence and routes it to the issuer or the exchange. In beta: every request is reviewed by hand, and a freeze is never guaranteed.
By wallet
Drained from a specific wallet?
Questions
What victims ask first
How can a Ledger be drained if the thief never had the device?
Either the 24-word recovery phrase got out, which lets anyone rebuild the wallet without the device, or you approved a transaction or a signature that gave the drainer permission to move your tokens. The device protects the keys, not what you sign with them.
Can stolen crypto be recovered?
Sometimes, mostly through a freeze: when the stolen funds are still in USDT or USDC, or have reached an exchange, the issuer or the exchange can lock them, usually at the request of the police. A blockchain transaction itself can't be reversed. The sooner the funds are traced and reported, the better the odds.
How do I find out where my stolen crypto went?
Paste the drained wallet's address into Iris. It shows where the funds went and follows them through swaps, bridges and mixers, on Solana, Ethereum, Base, Arbitrum, BNB Chain, Bitcoin, Tron and more. It's free without an account: 10 wallet analyses and 3 traces per device.
Should I revoke approvals or move my funds first?
If your seed phrase or private key may have leaked, move first: the thief can sign anything, and revoking changes nothing. If you only signed an approval or a permit on a site, revoke it, then move what's left to a new wallet anyway.
Are crypto recovery services legit?
Be very wary. People who message you after a theft offering to recover the funds, often for an upfront fee or "gas", are a well-known second scam. No one can hack the funds back. Legitimate help works through freezes and the police, and never asks for your seed phrase.
Can stolen funds be traced through a mixer or a bridge?
Often, yes. A bridge records where each transfer lands, and a mixer pays out amounts at times that can be matched to what went in. Iris does both for the bridges and privacy pools it supports, and shows the trail on a board.
Can Tether freeze stolen USDT?
Yes. Tether can blacklist an address holding USDT, on Tron, Ethereum and other chains, and the USDT there can no longer move. It acts on requests from law enforcement, so file a police report and give it the address holding the funds and the transactions that moved them there.
Find out where your funds are now.
Paste the drained wallet. It takes a minute, and you don't need an account.
Trace my funds