Most wallet drains do not involve a stolen seed phrase. They involve an approval: a transaction you signed that granted a contract permission to move a token on your behalf, often for an unlimited amount. The signature looked routine. The permission persists.
Why funds vanish later
Because the approval remains valid, an attacker can return at any point and move newly received tokens. People who topped up a wallet weeks after an incident have watched the new balance disappear immediately. Nothing new was compromised — the original permission was still live.
How to revoke
- Navigate to a well-known revocation tool by typing the address yourself. Do not use a link from a message, a search advertisement or a support chat.
- Connect the wallet and review the list of active approvals per chain — an approval on one chain does not appear on another.
- Revoke anything you do not recognise, and anything granting unlimited allowance to a contract you no longer use.
- Each revocation is an on-chain transaction, so you will need gas on that chain.
When revocation is not sufficient
If the seed phrase or private key itself was entered anywhere, the attacker controls the wallet completely and revocation changes nothing. In that case, create a new wallet on a clean device and move any remaining assets immediately, starting with the most valuable. Treat the old address as permanently compromised and never reuse it.
Preventing the next one
- Use a separate wallet for interacting with new applications, holding only what you can afford to lose.
- Keep long-term holdings in a hardware wallet that never touches unfamiliar sites.
- Read what you are signing — approvals for unlimited amounts deserve a pause.
- No legitimate service, airdrop or support agent ever needs your seed phrase.