Wallet Drained? What to Do in the First Hour (Ethereum Checklist)
By Merunas Grincalaitis, founder of MEV DAO and a developer who builds MEV, sniping and trading bots on Ethereum. Last updated: October 2026.
TL;DR: If your wallet was drained, spend the first hour on four things, in this order: stop sending ETH to it, work out from the drain transaction whether your key leaked or you signed a malicious approval, move everything that's still exposed to a brand-new seed phrase, and write down the transaction hashes for a report at ic3.gov. Stolen funds can't be reversed on Ethereum, but whatever is still in the address (tokens, staked positions, claimable airdrops) can often be saved. Ignore anyone who DMs you offering to "recover" it.
If your wallet got drained a few minutes ago, I'm sorry. I build MEV and rescue tooling on Ethereum, and the people who message me in your position usually start with a burst of panicked actions that make things worse. This is the checklist I walk them through instead, ordered by what can still be lost.
One thing to accept first: Ethereum transactions are final. Flashbots, who run the best-known free rescue hotline, say on their Whitehat page that they can only try to save remaining funds and can't get back funds that already left the address. Your job in the first hour is to protect what's left.
What should you do in the first five minutes?
Stop, and don't feed the attacker. Specifically:
- Don't send ETH to the drained address to "pay for gas" to move your remaining tokens. If the attacker has your key, a sweeper bot is almost certainly watching it and will take any ETH that arrives. MetaMask's support article on fighting back against sweeper bots explains why topping up never wins.
- Don't sign anything else on the site or dapp you were using, and close it.
- Don't post your address in public asking for help yet. Replies to "I got hacked" posts fill up with fake recovery agents within minutes (I cover how those work in crypto recovery scams).
- Switch to a device you trust. If there's any chance the drain came from malware, the computer you're on may still be logging what you type.
How do you tell how your wallet was drained?
Open your address on Etherscan and look at the transaction that moved your funds. The way it was sent tells you whether your private key is compromised, which decides everything that follows.
A private key (or the seed phrase it comes from) is what signs transactions for your address. An approval is permission you gave a contract to move a specific token for you. A Permit is the same permission, given with an off-chain signature instead of a transaction, so it costs you no gas and is easy to sign without noticing.
| What you see on Etherscan | Most likely cause | Is the key compromised? | First move |
|---|---|---|---|
| ETH and tokens sent in transactions from your address that you didn't make | Leaked key or seed phrase | Yes | Move everything else off that seed now |
Tokens moved by a transferFrom in a transaction sent by another address |
Malicious approval or Permit signature | Probably not | Revoke approvals, then move funds anyway |
| NFTs moved by an "operator" address | setApprovalForAll you signed on a phishing site |
Probably not | Revoke the operator approval |
| Any ETH you send in leaves within seconds | Sweeper bot on a leaked key | Yes | Stop funding it; plan a bundle rescue |
| Your address shows a delegation to a contract | Malicious EIP-7702 delegation | Treat as yes | Check and remove the delegation |
Signature phishing is the most common pattern I see, and the data backs that up. Scam Sniffer's 2024 report counted about $494 million stolen by wallet drainers on EVM chains from 332,000 addresses. In its breakdown of the year's million-dollar-plus cases, republished in SlowMist's annual report, Permit signatures accounted for 56.7% of losses.
If you see the last row, the attacker attached code to your address using EIP-7702, which lets a normal account delegate to a smart contract. I explain how to read and clear it in how to check and remove a malicious EIP-7702 delegation.
What should you secure first if your key leaked?
Everything that shares that seed phrase, on every chain. That's the part people forget.
One seed phrase usually controls several accounts in your wallet app, and each account has the same address on every EVM chain. An attacker with your seed can drain your second MetaMask account, and your balances on Arbitrum or Base, just as easily as the one they started with. So:
- Create a new wallet with a new seed phrase on a device you trust, ideally a hardware wallet. Adding a new account inside the same wallet doesn't help, because it comes from the same compromised seed.
- Move funds from every other account and chain under the old seed to the new wallet, starting with the largest balance. These accounts still have ETH for gas, so a normal transfer works as long as no sweeper is on them yet.
- Leave the drained address alone for now. Anything still in it needs a different approach (next section).
- Change passwords and 2FA on your exchange accounts and email if you stored your seed anywhere online or suspect malware.
What if it was an approval or Permit drain?
Revoke first. Then move to a fresh wallet anyway.
If the drain came from a contract spending an allowance, your key may be fine, but that allowance is still open and the drainer will take any more of that token you receive. Use revoke.cash or Etherscan's approval checker to find the spender from the drain transaction and revoke it, along with anything else you don't recognise. My guide to revoking token approvals and Permit2 signatures walks through it, including Permit2 allowances, which don't show up as a normal token approval.
Once that's done, I'd still move your remaining funds to a new wallet. You can't be completely sure how the attacker got the signature, and a new wallet costs a few dollars in gas.
How do you save what's still in the drained wallet?
Make a list, then use a bundle, not a top-up.
Write down everything that's still in the drained address or tied to it: token balances the drainer skipped, staked or restaked positions, lending collateral, LP positions, NFTs, vesting contracts and any unclaimed airdrops. Attackers usually take the liquid assets first, and the positions that need an unstake or claim are often still there.
If the key is compromised and a sweeper is watching, the way to move those assets is a Flashbots bundle: a funding transaction from a clean wallet and the transfers from the drained wallet, sent privately to block builders and included together in one block or not at all, so the sweeper never gets a chance at the gas money. You have three routes:
- Do it yourself with open-source code, as in my Flashbots guide to rescuing tokens from a compromised wallet.
- Ask the Flashbots Whitehat Hotline, which only helps when the remaining assets exceed $1,000 and asks you to submit only through whitehat.flashbots.net, per its docs.
- Use a rescue tool you run yourself. I compare the options in sweeper bot rescue: your options.
For claimable tokens there's an extra step, because the claim and the transfer have to land in the same block. I cover that in how to claim an airdrop from a compromised wallet.
What should you document and report?
Write it down while it's fresh. The FBI's guidance for crypto scam victims says the most useful details are transaction hashes, the addresses involved, the amounts and types of crypto, and the dates and times, plus how you first encountered the scammer and the websites they had you use. File a complaint at ic3.gov if you're in the US, or with your local police elsewhere, and keep a copy.
Then follow the money one hop. Etherscan labels the deposit addresses of many large exchanges. If your funds went straight to one, contact that exchange's support with your report; the FBI notes that exchanges only freeze accounts through their own processes or legal process, so a police or IC3 report number helps.
What to do and what not to do: the short version
| Do | Don't |
|---|---|
| Diagnose from the drain transaction | Send ETH to the drained address |
| Move other accounts to a new seed phrase | Create a "new account" under the old seed |
| Revoke the drainer's approval | Sign anything on the site that drained you |
| Rescue leftovers with a bundle | Paste your seed phrase into a "recovery" form |
| Report with transaction hashes | Pay anyone who DMs you offering recovery |
How do you stop it happening again?
Find the cause before you fund the new wallet. In my experience it's almost always one of these: a seed phrase stored in a screenshot, cloud note or email; malware from a cracked app or a fake "trading bot" repo; a signature on a phishing site; or a scam contract like the one in the YouTube MEV bot scam. If it was malware, wipe the machine before you type a new seed anywhere near it. Keep long-term holdings on a hardware wallet, use a separate hot wallet with small balances for dapps, and read what you're signing, especially anything that says Permit, approve or setApprovalForAll.
Frequently asked questions
Can I get my drained crypto back?
Not once it has left your address, because Ethereum transactions can't be reversed. You can often save what's still in the wallet, and an exchange may freeze funds that reach it if you report quickly with transaction details.
Is the rest of my wallet safe after a drain?
Only if the drain was a single malicious approval and you've revoked it. If your seed phrase leaked, every account and chain under that seed is exposed, so move everything to a new seed phrase.
Should I make a new wallet or just a new account?
A new wallet with a new seed phrase. A new account in the same wallet comes from the same seed, so the attacker can derive it too.
Does revoking approvals stop a drainer?
It stops a drainer that's spending an allowance you gave it. It does nothing if the attacker has your private key, because they can sign transfers directly.
Can a hardware wallet get drained?
Yes, if you approve a malicious transaction or sign a malicious Permit with it. A hardware wallet keeps the key off your computer, but it can't stop you from signing something harmful.
Should I trust someone who DMs me offering to recover my funds?
No. Unsolicited recovery offers after a hack are a known second scam, and the FBI warns that private recovery companies can't issue seizure orders.
Related guides
- Rescue Tokens From a Compromised Wallet: Sweeper Bot Rescue Service
- How to Rescue Tokens From a Compromised Wallet With a Sweeper Bot (Flashbots Guide)
- How to Revoke Token Approvals and Permit2 Signatures
- How to Check and Remove a Malicious EIP-7702 Delegation
- Crypto Recovery Scams: How to Spot Fake "Wallet Recovery" Services
If tokens are still in your drained wallet and a sweeper is watching it, MEVDAO's Token Rescue Bot moves them out with a Flashbots bundle. It's included in the MEVDAO subscription, and you can start a 3-day free trial. If you're not sure what kind of drain you're dealing with, message me on Telegram with the transaction hash.