If your wallet has been emptied the money is almost certainly gone, and anyone telling you otherwise is running the second scam. What you can still do is stop it continuing and protect whatever else is reachable. Answer one question and this gives you the specific steps for how it happened.
This page will never ask for a seed phrase, a private key or a wallet connection, and nothing you type here leaves your browser. It all runs on your own device. If any site, person or app asks for your recovery phrase in order to help you, that is the attack, not the help. There is no legitimate reason for anyone to need it, including support staff, wallet developers, exchanges, police or a recovery service.
Read this before anything else. If a wallet has been drained, the money is almost certainly gone and cannot be brought back. There is no support desk, no chargeback and no reversal. Anyone who tells you otherwise is running the second scam, which targets people in exactly your position.
What you can still do is stop it continuing, and protect whatever else that phrase or that device can reach. That is worth doing right now, because drains often come back for what arrives later.
A blockchain transaction is final by design. There is no institution able to reverse it, no insurance behind it and nobody with the authority to move it back. The attacker did not break into anything: they used a key or a permission they were given, so from the chain's point of view the transfer was entirely legitimate. That is why the answer is so blunt, and being told otherwise politely helps nobody.
Not because it will get the money back, but because it contributes to cases that are occasionally built against larger operations, and because some jurisdictions require a report for tax relief on the loss. In the UK that is Action Fraud. Elsewhere it is your national fraud or cybercrime unit. Do not pay anyone to do this for you.
Most drains reach a phrase that was typed into something, photographed, stored in cloud notes, or kept on a machine that later ran something it should not have. A hardware wallet fixes this because the phrase is generated on a device that has never been online and never leaves it. If you are holding an amount that would hurt to lose, the hardware wallet chooser is a better use of the next hour than anything else on this page.
Almost never, and it is kinder to say so directly. A blockchain transaction is final by design, with no institution able to reverse it and nobody holding the authority to move it back. The exception is funds held by an exchange rather than in your own wallet, where the company controls the ledger and can sometimes freeze or reverse an internal movement if you reach them fast. If the funds were in a wallet you control, treat them as gone and spend your energy on protecting what remains.
No. This is a scam without exception, and it is aimed at you specifically because you have just proved you can be taken. They find victims by watching public posts about losses and by buying lists. They will ask for an upfront fee, or your recovery phrase, or both, and some send convincing screenshots of funds supposedly located. Nobody can reverse a blockchain transaction, so there is nothing for a fee to buy.
Yes, and quickly, but the order matters. If a permission was exploited rather than your phrase, revoke the approvals first, otherwise the same permission can follow the tokens. If your phrase is compromised, create the new wallet on a different, clean device, because a phrase generated on a compromised machine is compromised the moment it exists.
Usually no. Many drains leave an automated script watching the address that sweeps anything arriving within seconds, including the gas you just sent. People lose money twice this way. If something genuinely valuable is stranded there, it needs a specialist approach that sends the gas and the rescue in one atomic bundle, and that is not something to attempt casually.
Most often through a signature rather than the phrase. Approving a transaction on a malicious site grants permission to move your tokens, and that permission does not expire. It can be used days or weeks later, which is why the timing often seems unconnected to anything you did. Running the theft transaction through a decoder tells you which of the two it was.
Yes, though not because it is likely to return the money. Reports contribute to cases occasionally built against larger operations, and some jurisdictions require one to claim tax relief on the loss. Report to your national fraud or cybercrime body directly, and never pay anyone to file it for you.
We seal the list every week and keep re-checking every token on it, so you can see what actually happened to them rather than only what is trading today.
