A real case on Iris: the predict.fun drain of Oct 27, followed from the drained accounts to Tornado Cash. Open the board
How it happens
How USDT on Tron gets drained
Stolen USDT often sits in an address for a while before it's cashed out. That window is when a freeze can still happen.
Approval drainers
A fake exchange, energy rental or airdrop site asks you to approve USDT. The drainer pulls everything later with transferFrom, sometimes days after.
Address poisoning
A lookalike address sends you 0 USDT or a few cents so it shows in your history. Copying it for your next transfer sends the money to the thief.
Fake investments and OTC deals
Trading platforms, "guaranteed" yields and OTC desks that take USDT and never pay out. The address you paid is the one to trace.
The first hour
Stop the losses first.
Drainers come back for what's left. Four steps, in this order.
USDT
to 0x8b1f…75ba
WETH
to 0x8b1f…75ba
USDC
to 0x0000…a3f1
Revoke approvals
Revoke USDT approvals in TronScan's approval list.
How
Revoke USDT approvals in TronScan's approval list, and check your account's permissions there too. If your seed phrase may have leaked, move first. Then trace: if the USDT is still sitting in an address, that's the address to give the police and Tether.
Old wallet
9xQe…fN2k/Seed phrase exposed
New wallet
4Lp2…cR7m/New seed phrase
Move what's left
New seed phrase, new wallet. Not a new account.
How
Create a new wallet with a new seed phrase, on a device you trust, and send it everything still in the old one. A new account in the same wallet app shares the old seed phrase and isn't safe. If a bot takes every bit of gas you send, stop sending: each deposit is lost.
Asset Recovery Team
Message request
Saw your post. We can recover your funds for a 20% fee. Send 0.3 ETH for gas to start.
ScamIgnore recovery offers
Anyone offering to get it back for a fee is a scam.
How
Anyone who writes to you after the theft promising to get the funds back for a fee is running a second scam. No one can reverse a blockchain transaction. Real recoveries come from freezes, by an issuer or an exchange holding the funds, acting on a police report.
- Reference
- CR-2026-104882
- Incident
- Wallet drained
- Evidence
- 4 tx hashes, board link
- Also filed
- ic3.gov
Report it
A police report, then ic3.gov or your country's equivalent.
How
File a police report and keep its reference number: issuers and exchanges act on it. Report it to your country's cybercrime service too (in the US, ic3.gov). Keep the transaction hashes, the site or app you connected to, and any messages.
Seed phrase leaked? Skip step 1 and move first.
Where your funds went
Follow the money, past the swap and the mixer.
Drained funds rarely sit still: they're swapped, bridged or mixed within minutes. Iris follows each step and shows where they are now, on a board you can share with the police or an exchange.
Trace a drained wallet42.618 SOL
into the pool
Privacy Cashprivacy pool / mixer20 SOL
got 19.924 after the fee
22.618 SOL
got 22.532837 after the fee
20 + 22.618 = 42.618 SOL, to the lamport. Matched by amount, fees and timing.
Swaps
A DEX swap read from the transaction, and a FixedFloat or SideShift order tied to its payout by amount, rate and timing.
Bridges
Where a cross-chain transfer landed, from the bridge's own records: Relay, Mayan, deBridge, Wormhole, LayerZero, THORChain and more.
Mixers
Deposits matched to withdrawals in Tornado Cash, Railgun, Privacy Cash and other pools, even when the money comes out in pieces.
Free, no account
10 wallet analyses and 3 traces per device, on Solana, Ethereum, Base, Arbitrum, BNB Chain, Bitcoin, Tron and more.
Freezes
Some funds can still be frozen.
It depends on where they sit now. Tracing tells you which side.
your fundsUSDT on TronTether can freeze
Can be frozen
- USDT, USDC
- Tether and Circle blacklist the address, on a police request.
- Exchange
- It can freeze the account the funds reached.
Can't be frozen
- ETH, SOL, BTC, TRX
- Native coins: no issuer can freeze them.
- Thief's wallet
- Most tokens it holds. Tracing shows where they go next.
Trace, then request a freeze
Find the funds on the board, then press Request a freeze. Iris prepares the evidence and routes it to the issuer or the exchange. In beta: every request is reviewed by hand, and a freeze is never guaranteed.
By wallet
Drained from a specific wallet?
Questions
What victims ask first
How do I check if a USDT address is frozen?
Tether's blacklist lives on the USDT contract itself, so it can be read for any address. On Iris, an address's page says when Tether or Circle has frozen it, from the contracts' own blacklist events on Tron, Ethereum and Solana.
Can stolen crypto be recovered?
Sometimes, mostly through a freeze: when the stolen funds are still in USDT or USDC, or have reached an exchange, the issuer or the exchange can lock them, usually at the request of the police. A blockchain transaction itself can't be reversed. The sooner the funds are traced and reported, the better the odds.
How do I find out where my stolen crypto went?
Paste the drained wallet's address into Iris. It shows where the funds went and follows them through swaps, bridges and mixers, on Solana, Ethereum, Base, Arbitrum, BNB Chain, Bitcoin, Tron and more. It's free without an account: 10 wallet analyses and 3 traces per device.
Should I revoke approvals or move my funds first?
If your seed phrase or private key may have leaked, move first: the thief can sign anything, and revoking changes nothing. If you only signed an approval or a permit on a site, revoke it, then move what's left to a new wallet anyway.
Are crypto recovery services legit?
Be very wary. People who message you after a theft offering to recover the funds, often for an upfront fee or "gas", are a well-known second scam. No one can hack the funds back. Legitimate help works through freezes and the police, and never asks for your seed phrase.
Can stolen funds be traced through a mixer or a bridge?
Often, yes. A bridge records where each transfer lands, and a mixer pays out amounts at times that can be matched to what went in. Iris does both for the bridges and privacy pools it supports, and shows the trail on a board.
Can Tether freeze stolen USDT?
Yes. Tether can blacklist an address holding USDT, on Tron, Ethereum and other chains, and the USDT there can no longer move. It acts on requests from law enforcement, so file a police report and give it the address holding the funds and the transactions that moved them there.
Find out where your funds are now.
Paste the drained wallet. It takes a minute, and you don't need an account.
Trace my funds