What to do if your crypto wallet was drained
If your crypto wallet has been drained, immediately revoke all token permissions, move any remaining assets to a clean wallet, and preserve your transaction records. Reporting the theft to Action Fraud and tracing onchain movements helps map where the stolen funds were routed.
- Wallet draining typically happens after you connect your self-custody wallet to a fraudulent decentralised platform, fake mint page, or phishing site and unwittingly sign an approval that allows a malicious smart contract to sweep your assets.
- Warning signs include unfamiliar wallet prompts requesting unlimited spending permissions, sudden unexpected zero-value transfers, or your tokens and digital assets disappearing moments after interacting with a site that offered an unprompted reward, claim, or airdrop.
- Immediately revoke all active token allowances using a reputable permissions checker, create an entirely new wallet on an uncompromised device, and move any remaining funds away from the compromised address without reusing the compromised recovery details.
- Save comprehensive evidence of the theft, including the web addresses you visited, transaction hashes for the unauthorised transfers, browser history logs, and the contract or recipient addresses that received your swept assets.
- Report the crime promptly to Action Fraud to secure a police reference number, and inform your UK bank or regular exchange accounts so that compliance teams can flag any associated illicit flows.
- An onchain trace can map where your stolen tokens were transferred and identify if they reached custodial exchanges, but it cannot automatically retrieve decentralised assets or unmask the perpetrator without exchange disclosure orders.
Read next
Written by the Wallsec investigations team. General information only, not legal or financial advice.
Need a case reviewed?
Tell us what happened and we will say honestly whether the onchain data supports a trace.