Join

GuideNEWCONFIRMED2 min read

I signed a drainer. What do I do in the first hour?

Revoke the approval, move what is left to a new wallet, record the evidence. Confirmed transactions cannot be reversed.

Add to GoogleFollow on XFollow on Telegram

Three moves in the first hour after signing a drainer: revoke, move funds, record and report.
MINTGRAPHFIRST HOUR · CONFIRMED
The first hour: revoke, move, record
  1. Stopclose the site
  2. Revokecancel the approval
  3. Movenew wallet, clean device
  4. Recordhashes and addresses
  5. Reportcybercrime service

Seed phrase typed anywhere? Skip the revoke and move everything now.

Source · Group-IB, Phantom support, 25 Oct 2026

The first hour

  1. Stop signing. Close the site. Do not "try again" and do not connect to a recovery site.
  2. Revoke the approval. Open a token-approval checker (Etherscan has one, Revoke.cash is another) and cancel every approval you do not recognise. A drainer usually relies on an approval that stays active until you cancel it (CONFIRMED, Group-IB).
  3. Seed phrase typed anywhere? Then revoking will not secure the wallet. Move everything off it immediately (CONFIRMED, Group-IB).
  4. Move what is left. Create a new wallet on a device you trust, ideally a hardware wallet, and move funds and valuable NFTs there. Never reuse the old seed phrase. Use a clean device if you suspect malware.
  5. Record the evidence. Save the transaction hashes, dates, the drainer's address and the site address.
  6. Report it. US victims can report to the FBI's Internet Crime Complaint Center (IC3). Other countries have their own cybercrime lines.

What not to expect

  • Confirmed blockchain transactions cannot be reversed or cancelled, and wallet support cannot undo them (CONFIRMED, Phantom support).
  • Anyone offering to "recover" your funds for a fee is a second scam. Real recovery services do not message you first.

Next week

Review approvals on every wallet you use, and read the prompt before you sign. See What is a wallet approval, and how to revoke one and What the Phantom "domain is new" warning means.

GuideWhat is a wallet approval, and how to revoke one GuideWhat the Phantom "this domain is new" warning means

Questions

Can I get my money back after signing a drainer?

Usually not. Confirmed transactions cannot be reversed. Revoking and moving funds protects what is left.

Does revoking an approval stop the drain?

It stops that contract from moving more of your tokens. If your seed phrase was exposed, revoking is not enough: move everything.

Who should I report it to?

Keep the evidence and report to your national cybercrime service. In the US that is the FBI's IC3.

This is safety guidance, not financial advice. Facts checked 25 October 2026.

Sources

  1. Group-IB: crypto wallet drainers and how to respond www.group-ib.com
  2. Phantom support: security, scams and drained wallets help.phantom.com
  3. Trust Wallet: token approvals and wallet drainers trustwallet.com

#wallet-drainer #approvals #scams #wallet-safety

Comments

Add a comment…

Sign in with Telegram through Ari to comment, reply and react. Use the plain page

Comments go live at once and are checked automatically. Links are shown as text. Never post a seed phrase or private key. Ari is MintGraph’s assistant. Her replies here are written or checked by the MintGraph team.

No comments yet. Be the first.

Keep reading

All guides →
  1. Title card: what zkTLS proves, and what you still trust, on a dark orange-lit background. MOST READGuide What zkTLS proves, and what you still have to trust Primus says its zkTLS can prove a fact from a web page without handing over the page. This note explains the two modes, what a proof leaves out, and five questions to ask before you trust one.
  2. Drift hack recovery: 1.04% per dollar lost redeemable on day one, with a dated timeline from 1 April to 1 October 2026. GuideNEWREPORTED Drift pays back about 1 cent per dollar so far: what hack recovery really looks like Drift opened DFX claims on 1 October 2026. Each token redeemed for about 1 cent at launch. How recovery works, what is unknown as of 15 October, and how to spot fake offers.
  3. Four asks a scam Telegram mini app makes: login code, wallet approval, a fee to withdraw, an APK download. GuideNEWREPORTED Telegram mini-app scams: how a fake "verify wallet" or giveaway bot works A mini app opening inside Telegram is not a safety signal. The flow, the tells, and what to do.

Explore other categories