Scams · July 8, 2026 · 10 min read

First 48 hours after you suspect a wallet drain

Discovering unexpected outgoing transactions is stressful. The next two days matter for limiting further loss and preserving evidence. This timeline assumes you still control the wallet or can access it to revoke permissions.

Hour 0–2: Stop the bleeding

Do not panic-sign more transactions trying to reverse the loss — that is not possible on-chain. Instead:

Disconnect all connected dApps in your wallet settings.
Open Solscan or Solana Explorer, paste your wallet address, and screenshot recent outgoing transactions.
Note the exact time, the link or message that preceded the drain, and any transaction signatures.
If assets remain, consider moving them to a fresh wallet with a new seed phrase — but only after understanding how the drain occurred, so you do not carry a compromise forward.

Hour 2–12: Revoke active approvals

Many drains exploit token approvals granted days or weeks earlier. In Phantom, open Settings → Trusted Apps → revoke anything you do not recognize. Alternatively use Solscan's token approval tool for your address. Revoke broadly — you can re-approve legitimate dApps later.

Hour 12–24: Document for yourself and others

Write a factual timeline: where you found the link, what the page asked you to do, what the wallet prompt showed, and which transaction signatures correspond to the loss. Save screenshots locally. This documentation helps if you file a report with Korean cybercrime authorities (via ecrm.police.go.kr) or warn your community.

Hour 24–48: Decide on professional review

A Scam Incident Review makes sense when:

The loss exceeds an amount you can assess yourself
You are unsure which approval or signature enabled the drain
You need a written report for authorities or community warnings
Remaining assets in the wallet are at risk and you want expert guidance on isolation steps

It does not make sense if you already understand the mechanism and the wallet is empty — no analysis will recover funds.

What not to do

Do not pay "recovery services" that ask for upfront fees or your seed phrase
Do not respond to DMs offering to hack the scammer back
Do not reuse the compromised seed phrase for new holdings
Do not share your seed phrase with anyone claiming to help