WhyDrained Check my wallet

In development. The wallet check isn’t available yet.

Wallet drained? Find out why — and what to do in the next hour.

We’re building a check that reads the blockchain and tells you how the funds were taken, what is still at risk, and where the money went first. It will only need the public address of the drained wallet.

Only your public address. Never your seed phrase, private key or a signature.

We do not recover funds.

Nobody legitimate can promise to get stolen crypto back. People who contact you offering “recovery” after a theft are almost always running a second scam. WhyDrained is meant to explain what happened and how to stop further losses.

What we find out

1. The cause

  • Token approval — an approve, permit or Permit2 signature on a fake site let someone spend your tokens.
  • Stolen seed phrase or private key — someone else signs from your wallet.
  • Address poisoning — you sent to a look-alike address copied from your history.
  • EIP-7702 delegation — your account was delegated to a malicious contract.
  • Voluntary transfer to a scammer — fake support, “investment”, romance or job scams.

2. What is still at risk

  • Approvals that are still open and can be used again.
  • Tokens and NFTs left on the address.
  • An active delegation, or a seed that is still in the attacker’s hands.

3. Where the money went

  • The first hop of your funds — for example to an exchange deposit address.
  • Transaction links you can check yourself and attach to a police report.

What we never ask for

  • Your seed phrase (12 or 24 words)
  • Your private key
  • A signature or a transaction
  • Connecting your wallet

If anyone asks you for these — including someone claiming to be us — it is a scam.

Sample report

Made-up address and numbers, shortened.

Ethereum · 0x1111…1111 · drained 26 Oct 2026

Most likely cause: a token approval you signed high confidence

On 24 Oct at 18:02 UTC this wallet approved unlimited USDT spending for 0xbad0…0bad (tx 0x9d57…a1c4). Two days later that address moved 4,850 USDT out in two transactions that the attacker signed, not you.

Still at risk

  • Open approval: LINK → 0x881d…7e20, unlimited. 212 LINK are still on the address.
  • 0.21 ETH remains on the address.

In the next hour

  1. Revoke the open approvals (for example on revoke.cash — it only needs your address to show them).
  2. Move what is left to a new wallet.
  3. Ignore anyone who messages you offering to recover the funds.

Where it went

2,300 USDT went to a deposit address at a large exchange (tx 0x4e1f…09bb). Exchanges can act on a police report that cites this transaction.

Check my wallet

We’re building this now. When it’s ready, you’ll be able to enter only your public address here.

FAQ

When will it be available?

We’re still working on it and have no date yet. We can’t look into individual cases for now. If something is at risk, revoke open approvals and move what is left to a new wallet.

Is it safe?

The check will only need your public address — the same thing you give anyone who sends you money. Everything it looks at is already public on the blockchain. We never ask for your seed phrase, private key, a signature or a wallet connection, and we never hold or move anyone’s money.

Why don’t you get my money back?

Because nobody can promise that honestly. Blockchain transfers can’t be reversed. Sometimes an exchange freezes stolen funds after a police report — WhyDrained is meant to show where your funds went so you can file one. Anyone who promises to get it back, usually for an upfront fee, is very likely scamming you again.