A real case on Iris: the predict.fun drain of Oct 27, followed from the drained accounts to Tornado Cash. Open the board
How it happens
How TronLink wallets get drained
Tron has a trick EVM chains don't: an account's signing rights can be handed to someone else, and the balance stays in plain sight.
Account permission hijack
Tron accounts have owner and active permissions that say which keys may sign. A scam transaction, dressed up as a reward or an energy rental, makes the attacker's address the owner: your balance still shows, but you can no longer move it, and the attacker can.
TRC-20 approvals
approve gives a contract the right to pull your USDT whenever it wants; the drainer calls transferFrom later. Iris traced one such drainer, tronify.rent, in public.
Address poisoning
Zero or tiny USDT transfers from an address that looks like one you use, hoping you copy it from your history. Check the full address every time.
The first hour
Stop the losses first.
Drainers come back for what's left. Four steps, in this order.
USDT
to 0x8b1f…75ba
WETH
to 0x8b1f…75ba
USDC
to 0x0000…a3f1
Revoke approvals
Check the account's permissions and approvals on TronScan.
How
Check your account's permissions on TronScan: if the owner or active permission names an address that isn't yours, your key can no longer move that account, so don't send it TRX for fees. Revoke USDT approvals in TronScan's approval list. If your seed phrase may have leaked, move what you still can first.
Old wallet
9xQe…fN2k/Seed phrase exposed
New wallet
4Lp2…cR7m/New seed phrase
Move what's left
New seed phrase, new wallet. Not a new account.
How
Create a new wallet with a new seed phrase, on a device you trust, and send it everything still in the old one. A new account in the same wallet app shares the old seed phrase and isn't safe. If a bot takes every bit of gas you send, stop sending: each deposit is lost.
Asset Recovery Team
Message request
Saw your post. We can recover your funds for a 20% fee. Send 0.3 ETH for gas to start.
ScamIgnore recovery offers
Anyone offering to get it back for a fee is a scam.
How
Anyone who writes to you after the theft promising to get the funds back for a fee is running a second scam. No one can reverse a blockchain transaction. Real recoveries come from freezes, by an issuer or an exchange holding the funds, acting on a police report.
- Reference
- CR-2026-104882
- Incident
- Wallet drained
- Evidence
- 4 tx hashes, board link
- Also filed
- ic3.gov
Report it
A police report, then ic3.gov or your country's equivalent.
How
File a police report and keep its reference number: issuers and exchanges act on it. Report it to your country's cybercrime service too (in the US, ic3.gov). Keep the transaction hashes, the site or app you connected to, and any messages.
Seed phrase leaked? Skip step 1 and move first.
Where your funds went
Follow the money, past the swap and the mixer.
Drained funds rarely sit still: they're swapped, bridged or mixed within minutes. Iris follows each step and shows where they are now, on a board you can share with the police or an exchange.
Trace a drained wallet42.618 SOL
into the pool
Privacy Cashprivacy pool / mixer20 SOL
got 19.924 after the fee
22.618 SOL
got 22.532837 after the fee
20 + 22.618 = 42.618 SOL, to the lamport. Matched by amount, fees and timing.
Swaps
A DEX swap read from the transaction, and a FixedFloat or SideShift order tied to its payout by amount, rate and timing.
Bridges
Where a cross-chain transfer landed, from the bridge's own records: Relay, Mayan, deBridge, Wormhole, LayerZero, THORChain and more.
Mixers
Deposits matched to withdrawals in Tornado Cash, Railgun, Privacy Cash and other pools, even when the money comes out in pieces.
Free, no account
10 wallet analyses and 3 traces per device, on Solana, Ethereum, Base, Arbitrum, BNB Chain, Bitcoin, Tron and more.
Freezes
Some funds can still be frozen.
It depends on where they sit now. Tracing tells you which side.
your fundsUSDT on TronTether can freeze
Can be frozen
- USDT, USDC
- Tether and Circle blacklist the address, on a police request.
- Exchange
- It can freeze the account the funds reached.
Can't be frozen
- ETH, SOL, BTC, TRX
- Native coins: no issuer can freeze them.
- Thief's wallet
- Most tokens it holds. Tracing shows where they go next.
Trace, then request a freeze
Find the funds on the board, then press Request a freeze. Iris prepares the evidence and routes it to the issuer or the exchange. In beta: every request is reviewed by hand, and a freeze is never guaranteed.
By wallet
Drained from a specific wallet?
Questions
What victims ask first
My TronLink shows my USDT but I can't send it. What happened?
Most likely your account's permissions were changed: the owner or active permission now names the attacker's address, so your key can no longer sign. Check the permissions on TronScan, and don't send TRX to the account for fees, it can't help. Trace the funds that already left and report the address.
Can stolen crypto be recovered?
Sometimes, mostly through a freeze: when the stolen funds are still in USDT or USDC, or have reached an exchange, the issuer or the exchange can lock them, usually at the request of the police. A blockchain transaction itself can't be reversed. The sooner the funds are traced and reported, the better the odds.
How do I find out where my stolen crypto went?
Paste the drained wallet's address into Iris. It shows where the funds went and follows them through swaps, bridges and mixers, on Solana, Ethereum, Base, Arbitrum, BNB Chain, Bitcoin, Tron and more. It's free without an account: 10 wallet analyses and 3 traces per device.
Should I revoke approvals or move my funds first?
If your seed phrase or private key may have leaked, move first: the thief can sign anything, and revoking changes nothing. If you only signed an approval or a permit on a site, revoke it, then move what's left to a new wallet anyway.
Are crypto recovery services legit?
Be very wary. People who message you after a theft offering to recover the funds, often for an upfront fee or "gas", are a well-known second scam. No one can hack the funds back. Legitimate help works through freezes and the police, and never asks for your seed phrase.
Can stolen funds be traced through a mixer or a bridge?
Often, yes. A bridge records where each transfer lands, and a mixer pays out amounts at times that can be matched to what went in. Iris does both for the bridges and privacy pools it supports, and shows the trail on a board.
Can Tether freeze stolen USDT?
Yes. Tether can blacklist an address holding USDT, on Tron, Ethereum and other chains, and the USDT there can no longer move. It acts on requests from law enforcement, so file a police report and give it the address holding the funds and the transactions that moved them there.
Find out where your funds are now.
Paste the drained wallet. It takes a minute, and you don't need an account.
Trace my funds