A wallet drainer does not steal your keys It gets your permission.

A wallet drainer is malicious code that persuades you to sign something — an approval, an off-chain permission, or a transaction whose real contents sit behind a friendly button — and then uses that signature to move everything it can reach out of your wallet. Your keys are not stolen and your recovery phrase is usually never seen: the wallet does exactly what a signature you gave told it to do. Most drainers today are rented kits, so the people who wrote the code and the people who built the site that got you to sign are frequently not the same.

That is the most common version of this theft. Some permissions can be granted by an off-chain signature instead of a transaction: you pay no gas, nothing appears in your wallet history, and there is nothing on the blockchain to look at until the permission is used. The attacker submits it later, on their own schedule, and the transfer that follows is entirely valid. That is why nothing seemed wrong at the moment of signing, and why the loss can appear hours or days afterwards.

Usually not, and the difference decides what you do next. A drainer works through permissions granted from the wallet, not through the recovery phrase. From the outside the two cases look identical, so treat the wallet as compromised either way: move what is left to a wallet created from a new recovery phrase, not to another account inside the same one. If the phrase itself was ever typed into a website or an app, every account derived from it is affected.

No. Revoking removes the attacker's permission to take anything further; it does nothing about what has already gone. Revoking is also a transaction from the same wallet and costs gas, so if assets are still sitting there, move them out first and revoke afterwards. The order matters more than people expect — drains do happen while the victim is busy revoking.

The device is almost certainly fine. A hardware wallet protects the key, not the decision: if it shows you a request and you approve it, it signs, and some requests cannot be rendered in readable form on a small screen at all. That gap is what drainers are built around. The device itself is only compromised if the recovery phrase was entered somewhere outside it.

Sometimes, and more often than after a rug pull. The theft is instant, but the proceeds still have to become ordinary money, and that almost always means a service which screens deposits and has a customer behind the account. Our path is to trace the assets through the swaps and bridges that follow the drain, flag them to AML providers within four hours of intake, and have them stopped at the point they touch such a service. Whether they arrive there before cash-out decides the case, and we say so before taking it.

Immediately. Drained assets are usually swapped and moved within minutes, and the useful window is measured in hours rather than days. Flagging happens within four hours of intake and a freeze request to an exchange takes two to four days once filed, so every hour before the first transaction hash reaches us is taken off the end where the money is still catchable.

Our published threshold is a loss from $200,000, and smaller cases are considered individually. Tracing, freeze requests and the legal steps through partner firms cost the same regardless of the amount, and below a certain size the process costs more than it returns. The assessment call is free either way, and if the answer is that nothing can be done we will say so on that call.