Minute zero: move what is left
If anything of value remains, it is still at risk. A drainer that holds an approval or your key does not stop at one transaction. Create a brand new wallet on a clean device, write the seed phrase on paper, and transfer every remaining asset there now. Speed beats elegance: pay the gas, take the dust loss, get out.
Do not send anything to an exchange account you opened from the same possibly compromised device. The new wallet is a quarantine zone. It receives, it does not interact with anything else yet.
Cut the standing permissions
If the drain came through a token approval, your remaining tokens on other chains or in the same wallet may still be approved to the attacker's contract. Open an approval checker, go through every active approval on the drained address, and revoke anything you do not recognize plus anything with an unlimited allowance.
This matters even if the wallet looks empty. Airdrops, vesting claims, and refunds can land on that address later, and an open approval means they leave as fast as they arrive.
Find the leak before you rebuild
There are only a few ways this happens, and the response differs. If you signed a malicious approval or a fake claim, the wallet key itself may be fine: the damage is limited to what that contract could touch. If your seed phrase leaked (a phishing site asked for it, it sat in a screenshot, a note app synced it), the wallet is burned forever, and so is every account derived from it.
Reconstruct your last day: what did you sign, what did you install, where did you type anything sensitive. Be honest with yourself here. Rebuilding on top of a leaked seed phrase just funds round two.
Report it, with realistic expectations
File a report with your local cybercrime unit and, if an exchange received the funds, contact its compliance team with the transaction hashes. Chain analytics teams do freeze funds at exchanges sometimes, and a police report number is what makes an exchange listen.
At the same time, know the base rate: most drained funds are not recovered. Anyone who contacts you promising recovery for an upfront fee is running the second scam of your day. No legitimate recovery service messages victims first.
Make it not repeat
The clean setup after a drain looks like this: a hardware wallet for holdings, a small hot wallet for daily interactions, and nothing valuable sitting behind old approvals. Approve minimal amounts, revoke after use, and treat every unsolicited token and airdrop claim as hostile.
Then put the new address under watch. A monitor that pings you when the score drops or funds move buys you the one thing you did not have this time: an early signal while there is still something to save.
FREE SCAN · NO SIGN-UP · READ-ONLY. We never ask for keys or signatures.