Short answer. Most wallets drained after a link were not 'hacked' in the usual sense: the owner signed an approval or transaction that gave a malicious contract access. Revoke all token approvals, move remaining assets to a new wallet with a new seed, record the transactions and report them. If you typed your seed into a site, treat the whole wallet as compromised.
Need help applying this to your notice? Request a free written assessment: tell us what happened. We reply within one business day. Paid preparation is quoted separately; the platform decides the outcome.
How drainers work
A fake mint, airdrop or support page asks you to connect and sign. The signature grants a contract permission to move tokens or NFTs. The drain can happen immediately or later, whenever the attacker chooses.
Contain it now
- Revoke token approvals using a reputable approval checker
- Create a new wallet with a new seed on a clean device
- Move remaining assets to it, starting with the most valuable
- Stop using the old seed entirely if it was ever typed into a website
Record and report
Save the phishing URL, the transactions you signed and the drain transactions. Report to IC3 or your national cybercrime unit, and to any exchange where the stolen funds arrive.
Avoid the follow-up scams
Drained wallets are watched. Messages offering recovery, or tokens that appear in your wallet with links, are part of the same operation.
FAQs
Was my seed phrase stolen?
Not necessarily. Approval drains do not need the seed. If you never typed it anywhere, your seed may be safe, but moving to a new wallet is still the safe choice.
Can a drain be reversed?
No. On-chain transactions are final.
Do hardware wallets prevent this?
They protect keys, but you can still sign a malicious approval. Read what you sign.
Official sources