I signed or approved something and tokens are leaving
A connect, a claim, a "verification". The approval is still valid until it is revoked, so this can continue after you close the page.
- Move what is left, before anything else Send the remaining assets to a wallet the attacker has no permission over — a new one created now, or a hardware wallet. Revoking takes a transaction and a fee; moving is faster and does not depend on the drainer being idle. If gas is the problem, move the most valuable asset first, not the largest number of tokens.
- Treat the whole wallet as compromised, not just that token One malicious approval usually comes with several, granted in one signing session. The address stays usable in principle, but nothing valuable should sit on it again.
- Do not import the seed phrase anywhere new to "rescue" it A phrase typed into a rescue tool found through search is how a bad day becomes a total one. Move the assets with the wallet you already have.
- Revoke the approvals afterwards Use the revoke feature inside your own wallet software where it exists, or a revocation site you reached from the wallet's own documentation. This stops future drains from that address, which matters if anything ever lands there again.
- Write down the sequence while it is fresh The site you were on, how you reached it, the time, the transaction hashes. Ten minutes now is worth more than anything you can reconstruct next week.
- If a hardware wallet signed it, the device is fine The device did what it was asked. It is the permission that is the problem, not the hardware, and the phrase has not been exposed by this.
What is recoverable
The tokens already taken are gone in the practical sense: the transfers were authorised by a valid signature and there is nobody to reverse them. What is recoverable is everything the drainer has not reached yet, which is why the first step is moving rather than revoking.
Why it can continue after you close the tab
An approval is not a session. It is a standing permission recorded on the network, valid until revoked, and it can be exercised at any time — including days later, when the wallet receives something new. This is what makes it different from an ordinary theft: wallet drainers and signatures covers the mechanism.
Worth reporting
The police in your country, and the exchange the funds reach if they arrive at one — a transaction hash and a timestamp are what a compliance team can act on. Expectations, honestly set, are on if your funds are gone.
Anyone who contacts you offering to recover this is the next thief
It follows losses within days, sometimes hours, and it copies the names of real firms, regulators and police units. Nobody legitimate finds you first. How the recovery scam works →
Last checked 19 Oct 2026. This page is procedure, not legal advice — what a report achieves depends on where you live.