Cryptocurrency wallet drain, malicious smart contracts, and seed phrase compromise¶

Discovering that your self-custody cryptocurrency wallet (such as MetaMask, Rabby, Phantom, Trust Wallet, Coinbase Wallet, or a hardware wallet like Ledger or Trezor) is actively being drained of tokens and NFTs is an acute, second-by-second digital financial emergency. Because public blockchain transactions on Ethereum, Bitcoin, Solana, Arbitrum, Base, Polygon, and BNB Chain are cryptographically irreversible once confirmed in a block, your ability to save any remaining assets depends entirely on what you do in the first five minutes.

Every cryptocurrency wallet drain falls into one of two distinct technical categories: either you signed a malicious smart contract approval or Permit2 signature on a phishing website (which allows an attacker to pull specific tokens from your address without having your seed phrase), OR your 12-to-24-word secret recovery seed phrase / private key itself was compromised (via a fake wallet site, clipboard malware, cloud backup hack, or infostealer virus). Diagnosing which of the two attacks is occurring, creating a clean air-gapped rescue wallet on an uncompromised device, revoking unlimited token allowances, and tracing stolen funds to centralized exchange off-ramps gives you the best chance of stopping the drain and freezing stolen assets.

Do this now¶

If you see unauthorized outgoing transactions draining your cryptocurrency wallet or realize you just connected to a phishing site or leaked your seed phrase, execute these six steps in exact order:

1. Do NOT use the same computer to generate a new rescue wallet: If your PC or Mac is infected with infostealer malware (such as Lumma Stealer, Atomic macOS Stealer, or Poseiden) or a malicious browser extension, creating a new wallet on that same computer immediately hands your new seed phrase to the attacker. Pick up a separate, clean smartphone or hardware wallet to create a fresh, uncompromised destination wallet address right now.
2. Transfer your surviving native gas tokens and transferable coins to the new clean wallet FIRST: Before doing anything else, send your remaining transferable coins (ETH, BTC, SOL, USDC, USDT, WBTC) from the compromised wallet directly to your brand-new clean wallet address. Leave just a few dollars of native gas (such as 3 to 5 USD of ETH, SOL, or BNB) if you need to revoke smart contract approvals on remaining locked positions.
3. Determine if the attacker has your Seed Phrase or only a Malicious Token Approval:
   • Sign of a Malicious Smart Contract / Permit2 Approval: Only one specific token (like USDT or an NFT collection) was pulled via TransferFrom after you clicked "Approve" or "Sign" on a website, while your native ETH/SOL gas balance sits untouched.
   • Sign of a Compromised Seed Phrase / Private Key: Every coin across multiple different blockchains (Ethereum, Solana, Bitcoin, Arbitrum) is being swept out via direct Transfer calls, and any native ETH/SOL you send in is stolen within 1 second by an automated sweeper bot.
4. Revoke all active smart contract token approvals immediately: If your native ETH/SOL gas is still in your wallet, open a trusted allowance manager (revoke.cash, Etherscan Token Approval Checker at etherscan.io/tokenapprovalchecker, or Rabby Wallet's built-in Approval Manager) and Revoke all unlimited token spending approvals and Permit2 signatures granted to unfamiliar contract addresses.
5. Disconnect all active dApp sessions and WalletConnect links: Open your wallet settings -> Connected Sites / WalletConnect Sessions and click Disconnect All so the phishing website can no longer pop up signature requests.
6. If a "Sweeper Bot" is instantly stealing gas you deposit to rescue staked tokens, use a Flashbots / MEV rescue bundler: Never keep sending ETH into a wallet controlled by a sweeper bot, the bot's automated script monitors the mempool and steals your ETH in milliseconds before you can click "Unstake". Instead, use a private ERC-4337 / Flashbots MEV atomic bundle rescue service (such as flashbots.net whitehat tools or revoke.cash delegated fee features) to fund gas and extract tokens in a single un-frontrunnable block.

Decision tree: stopping an active crypto wallet drain¶

Follow this real-time technical triage flowchart to stop the bleed and rescue your surviving digital assets:

flowchart TD
    A["Unauthorized Outgoing Crypto Transactions Detected"] --> B["Generate Brand-New Clean Wallet on a Separate Clean Device / Hardware Wallet"]
    B --> C{"Did you type your 12/24-word seed phrase or download a file, or only click Sign/Approve on a site?"}
    C -->|"Only clicked Sign / Approve / Claim on a dApp"| D["Malicious Smart Contract or Permit2 Drain"]
    D --> E["Immediately go to revoke.cash or Etherscan Token Approvals and Revoke malicious allowances"]
    E --> F["Transfer remaining liquid tokens to your new clean wallet as a precaution"]
    C -->|"Typed Seed Phrase, exported Private Key, or ran PC malware"| G["Full Seed Phrase / Private Key Compromise"]
    G --> H{"Is an automated Sweeper Bot instantly stealing any ETH/SOL gas you deposit?"}
    H -->|"No: Native gas still works"| I["Evacuate all liquid coins & unstake DeFi positions immediately to new clean wallet"]
    H -->|"Yes: Sweeper Bot steals gas in < 2 seconds"| J["STOP sending gas. Use Flashbots private RPC atomic bundle to rescue staked/airdrop tokens"]
    F --> K["Trace attacker wallet on Block Explorer, report to Exchange Compliance & FBI IC3 / Police"]
    I --> K
    J --> K

Diagnosing the attack vector: Smart Contract Drainer vs. Seed Phrase Compromise¶

To avoid losing more money while trying to save your wallet, you must first understand how the attacker is moving your funds by looking up your wallet address on a public block explorer (etherscan.io, solscan.io, arbiscan.io, basescan.org, or mempool.space).

Comparison of the 4 major cryptocurrency wallet drain mechanisms¶

Protocol 1: Stopping a Malicious Smart Contract or Permit2 Drainer¶

When you interact with decentralized finance (DeFi) protocols on Ethereum and EVM-compatible blockchains (Arbitrum, Optimism, Base, Polygon, Avalanche, BNB Chain), tokens like USDC, USDT, DAI, PEPE, or WETH use the ERC-20 standard. By design, a smart contract cannot move ERC-20 tokens out of your wallet unless you first grant it an Allowance. Phishing kits ("Drainers-as-a-Service" such as Angel Drainer, Pink Drainer, or Inferno Drainer) trick users into granting an Unlimited Allowance (115792089237316195423570985008687907853269984665640564039457584007913129639935 units) or signing an off-chain EIP-2612 Permit / Uniswap Permit2 message directly to the scammer's contract.

How to revoke malicious token approvals in 60 seconds¶

1. Open a legitimate, independent Allowance Revocation tool:
   • Revoke.cash (revoke.cash) , Supports over 100 EVM blockchains and displays both standard ERC-20/ERC-721 approvals and Permit2 signatures with expiration dates.
   • Block Explorer Official Approval Checkers:
     • Ethereum: etherscan.io/tokenapprovalchecker
     • BNB Chain: bscscan.com/tokenapprovalchecker
     • Polygon: polygonscan.com/tokenapprovalchecker
     • Arbitrum: arbiscan.io/tokenapprovalchecker
     • Base: basescan.org/tokenapprovalchecker
   • Rabby Wallet Built-in Security Tab: If you use Rabby Wallet, click the Approvals shield icon directly inside the wallet interface to batch-revoke risky contracts without opening a web page.
2. Sort approvals by "Newest" or "Value at Risk":
   • Look at the Spender column. Legitimate protocols will display verified labels like Uniswap: Universal Router or Aave: Pool V3.
   • Malicious drainers typically appear as an unverified raw hexadecimal address (e.g., 0x4f8a...9c12) or a recently deployed fake contract.
3. Click "Revoke" and confirm the transaction in your wallet:
   • Clicking Revoke submits an on-chain transaction that overwrites the spender's allowance back to 0.
   • Once that transaction confirms on the blockchain (usually within 2 to 12 seconds), the drainer contract is mathematically severed from your wallet and cannot pull another cent of that token.

Protocol 2: Defeating an automated "Sweeper Bot" on a compromised seed phrase¶

If a hacker has stolen your actual 12-word or 24-word recovery seed phrase (or raw private key), they immediately load your private key into an automated server script called a Sweeper Bot.

How a Sweeper Bot traps victims¶

Suppose your compromised Ethereum wallet still has $15,000 worth of staked tokens in an Aave, Lido, or EigenLayer contract (or an upcoming claimable token airdrop), OR still holds an ERC-20 token the attacker hasn't moved yet, but the attacker swept your native ETH balance down to 0.0000 ETH.

1. To unstake or transfer your \(15,000 of tokens out to safety, your compromised wallet needs **\)2.00 worth of ETH to pay the blockchain network gas fee**.
2. You send $5.00 of ETH from your Coinbase account into your compromised wallet so you can click "Unstake".
3. Within 0.8 seconds of your $5.00 ETH deposit landing, before your human fingers can even click the "Unstake" button, the hacker's automated Sweeper Bot detects the incoming ETH in the public mempool and instantly fires a high-priority gas transaction that steals your $5.00 of ETH right back out to the hacker's address.
4. Victims often try sending ETH 10 times in a row, losing $50 or $100 in gas to the Sweeper Bot every single time while their staked tokens remain trapped inside the compromised wallet.

How to beat a Sweeper Bot using Flashbots / Private MEV Atomic Bundles¶

Stop sending regular ETH deposits to a wallet monitored by a Sweeper Bot. Sweeper bots watch the public transaction mempool and need 1 block (or a public pending transaction) to see and steal your deposited ETH. You can defeat any Sweeper Bot by using Flashbots Protect / MEV Atomic Bundling (on Ethereum and EVM chains) or Jito Bundles (on Solana):

1. How an Atomic Rescue Bundle works: Instead of sending ETH in Block #1 and trying to click "Transfer/Unstake" in Block #2, an atomic bundle packages two separate transactions into a single private array sent directly to block builders via a Private RPC (completely invisible to the public mempool where the Sweeper Bot is watching):
   • Bundle Transaction #1 (from your Clean Safe Wallet): Sends exact gas (0.0015 ETH) to the Compromised Wallet.
   • Bundle Transaction #2 (pre-signed by the Compromised Wallet): Immediately executes the unstake() or transfer() of your valuable tokens out to your Clean Safe Wallet, consuming 100% of that 0.0015 ETH gas in the exact same block at the exact same microsecond.
2. Because both transactions execute atomically inside the same block with zero public mempool visibility, the hacker's Sweeper Bot never sees the ETH arrive and leaves with 0.0000 ETH left over while your tokens land safely in your clean wallet.
3. Trusted Whitehat Rescue Resources for Sweeper Bot Victims:
   • Seal 911 (Security Alliance Whitehat Emergency Hotline): Created by Paradigm and leading blockchain security researchers. If you have significant funds trapped behind a sweeper bot or an active smart contract exploit, contact the official verified SEAL 911 bot at seal911.org (or via their official Telegram link on securityalliance.org) for free whitehat MEV rescue bundling assistance.
   • Flashbots Whitehat Rescue Documentation: Open-source scripts (flashbots/searcher-sponsored-tx) at docs.flashbots.net allow you to sponsor gas from a clean wallet to rescue ERC-20/ERC-721 assets from a compromised key without writing custom code.
   • EIP-7702 / Delegated Gas Tools: Modern rescue utilities integrated into tools like revoke.cash and Ambire/Rabby allow paying revocation or rescue gas from a secondary wallet.

Protocol 3: Tracing stolen funds, freezing exchange off-ramps, and law enforcement reporting¶

While no one can reverse a transaction on a decentralized blockchain, cybercriminals eventually want to convert stolen crypto into spendable cash or clean stablecoins. When stolen funds touch a Centralized Exchange (CEX) (such as Binance, Coinbase, Kraken, OKX, Bybit, or KuCoin) or remain held in centralized stablecoins (Tether / USDT and Circle / USDC), those funds CAN be frozen by the issuer or exchange compliance team if you act fast and file an official law enforcement report.

1. Immediate on-chain tracing and stablecoin freeze alerts¶

1. Copy the Transaction Hash (TxID) and the Attacker's Receiving Address: Open the block explorer for your chain, copy the exact transaction hash of the theft, and click on the recipient wallet address that received your funds.
2. Never delete your browser history or wallet logs: Forensic investigators need the exact phishing URL you visited and the exact timestamps.
3. If large amounts of USDT (Tether) or USDC (Circle) were stolen: Unlike decentralized ETH or BTC, both Tether (USDT) and Circle (USDC) have a built-in smart contract function (addBlackList() / blacklist()) that can permanently freeze stolen USDT or USDC directly inside the hacker's self-custody wallet upon receiving an urgent law enforcement request or court order.
4. Track where the hacker moves the funds using free visual tracers:
   • Paste the hacker's wallet address into MetaSleuth (metasleuth.io), MistTrack (misttrack.io), Breadcrumbs (breadcrumbs.app), or Arkham Intelligence (platform.arkhamintelligence.com).
   • Set up a free Etherscan / Solscan Watch Alert on the hacker's wallet address so you receive an email the instant the hacker sends the stolen coins to a Centralized Exchange deposit address (for example, an address labeled Binance 14, OKX, FixedFloat, or ChangeNOW).

2. Contacting Centralized Exchange Compliance Desks & Filing Police Reports¶

The instant your on-chain trace shows stolen funds entering a Centralized Exchange deposit address or instant swapper service:

1. Submit an urgent Law Enforcement Freeze Request Ticket to that specific exchange: Every major exchange operates an emergency fraud/stolen-funds ticketing portal (such as Binance Law Enforcement / Stolen Funds support, Coinbase Support, Kraken Security, or FixedFloat/ChangeNOW support). Provide:
   • Your victim wallet address, the attacker's intermediate addresses, the exact Deposit Address at the exchange, and the Transaction Hash (TxID) showing the funds entering their exchange hot wallet.
   • Most exchanges will place a temporary 24-to-72-hour internal compliance hold on suspiciously flagged deposit accounts to give you time to upload an official police report number and have the investigating officer email the exchange's Law Enforcement Request portal (kodexglobal.com or the exchange's direct LE portal).
2. File official national cybercrime reports immediately (100% free):
   • United States: File an immediate report with the FBI Internet Crime Complaint Center (IC3) at ic3.gov (select virtual currency and include every transaction hash, token ticker, USD value, and recipient wallet address), report to the Secret Service local field office cyber fraud task force, and file a local police report to obtain a formal Case Number.
   • United Kingdom: File an online report with Action Fraud at actionfraud.police.uk or call 0300 123 2040 so the National Fraud Intelligence Bureau and Police Cyber Crime Unit can issue an exchange preservation notice.
   • European Union, Canada, & Australia: File via Chainabuse (chainabuse.com, operated by TRM Labs), which automatically shares your scammer wallet address report across major exchanges, wallet security blacklists, and law enforcement partners, alongside the Canadian Anti-Fraud Centre (CAFC), Australian Cyber Security Centre (cyber.gov.au), or your national Europol cybercrime desk.

Post-incident decontamination: cleaning your devices and hardening future wallets¶

Before using your new cryptocurrency wallet for everyday transactions, eliminate the root vulnerability that caused the compromise:

1. If your Seed Phrase was stolen while using a Windows PC or Mac, assume you have an Infostealer virus: Malware hidden inside fake game cracks, fake Zoom/Calendly links, fake Notion/PDF sponsorships, or pirated software silently reads the local LevelDB vault files of browser extensions (MetaMask, Phantom) and watches your clipboard. Disconnect the PC from Wi-Fi, back up only plain documents, and perform a complete USB clean reinstall of Windows or macOS.
2. Use a dedicated Hardware Wallet (Cold Storage) for savings, and a separate "Hot Wallet" for daily dApps:
   • Vault / Cold Wallet (90%+ of funds): Keep your long-term Bitcoin, Ethereum, Solana, and stablecoins on a dedicated hardware wallet (such as a Trezor, Ledger, Coldcard, or Keystone) where the private key is stored inside an offline Secure Element chip that never touches your computer's RAM. Never connect your Cold Vault address to random websites, NFT mints, or airdrops.
   • Burner / Hot Wallet (< 10% of funds): Keep a separate browser wallet containing only the small amount of funds you plan to swap or mint with that day. If you ever click a malicious link on your Hot Wallet, your Cold Vault remains 100% untouched.
3. Install a real-time Web3 transaction simulator extension: Modern wallets like Rabby Wallet and Phantom, or free browser security extensions like Pocket Universe and Wallet Guard, simulate every transaction before you sign it and pop up a bright red warning reading: "WARNING: Signing this message will drain all your USDC and NFTs to an untrusted address."
4. Never store your 12/24-word seed phrase digitally: Never take a smartphone photo of your seed phrase (cloud photo backups are a prime target for hackers), never save it in a password manager, Apple Notes, Google Docs, or Draft emails, and never type your seed phrase into any website or keyboard. Only write your seed phrase on physical paper or stamp it onto fireproof stainless steel plates stored in a physical safe.

Frequently asked questions¶

Sources checked¶

• Federal Bureau of Investigation (FBI, United States): Internet Crime Complaint Center (IC3) Cryptocurrency Fraud Reports and Public Service Announcements on DeFi Smart Contract Drainers (ic3.gov).
• Cybersecurity and Infrastructure Security Agency (CISA, United States) & NSA: Cryptocurrency Security, Phishing-Resistant Authentication, and Infostealer Malware Advisories (cisa.gov).
• Consumer Financial Protection Bureau (CFPB) & Federal Trade Commission (FTC, United States): Avoiding Crypto Scams and Fake Recovery Services (consumer.ftc.gov).
• National Cyber Security Centre (NCSC) & Action Fraud (United Kingdom): Cryptoasset Security Guidance and Reporting Stolen Digital Assets (ncsc.gov.uk, actionfraud.police.uk).
• Ethereum Foundation & EIP Standards (International): ERC-20 Token Standard (EIP-20), Permit Gasless Approvals (EIP-2612), and Account Abstraction / Bundling (ethereum.org, eips.ethereum.org).
• Security Alliance (SEAL 911) & Flashbots Whitehat Collective (International): Emergency Whitehat Sweeper-Bot Rescue Protocols and MEV Atomic Bundling (securityalliance.org, docs.flashbots.net).

Related guides¶

• Data breach response and password leaks
• MFA phishing and adversary-in-the-middle bypass
• SIM swapping
• Scams and fraud