crypto theft / wallet drain — quick-start

checklist

1. revoke connected wallet permissions on every dapp the victim authorized — use revoke.cash or etherscan token approval checker now.
2. move any remaining assets out of the compromised wallet to a fresh cold wallet — do not reuse the compromised seed.
3. record the exact UTC timestamp of the first unauthorized transaction — block explorer timestamp, not memory.
4. save the full transaction hash and recipient address of every outbound tx in the suspicious window.
5. export wallet transaction history from etherscan/polygonscan/solscan as CSV — include internal txs and token transfers.
6. pull browser history, clipboard history, and extension list from the device used to sign — look for malicious dapps or phishing sites.
7. if a seed phrase was entered anywhere online: treat the entire wallet as permanently compromised, not just the current balance.
8. note the exchange or bridge the funds moved through — most have subpoena-friendly transaction lookup APIs.
9. check NFT approvals separately — setApprovalForAll transactions drain collections without individual token transfers.
10. begin the primary tool path below — wallet drain tracer and malicious dapp detector.

primary tools

1. 01ethereum transaction decoderpaste raw ethereum transaction hex · rlp decode · from to value gas · erc20 calldata · runs locally
2. 02bitcoin transaction decoderpaste raw transaction hex · decode inputs outputs scripts · fees · locktime · segwit · p2pkh p2sh p2wpkh · runs locally
3. 03crypto tx graphpaste json csv btc hex · directed graph · hub peel fan patterns · ascii viz · stats · csv json export · runs locally
4. 04crypto transaction graphdrop tx list csv · build adjacency · node edge counts · export nodes edges csv · runs locally
5. 05smart contract bytecode analyzerpaste evm hex · disassemble push pop · flag delegatecall selfdestruct · opcode table · runs locally
6. 06cryptocurrency mixer and tumbler detectordrop bitcoin transaction csv · apply statistical analysis to detect mixing service patterns · equal output detection · timing patterns · coinjoin identification · peel chain vs mixed funds · estimate mixing confidence · runs locally
7. 07bitcoin address clusteringpaste or drop csv · extract btc addresses · common-input heuristic clustering · cluster table · export csv · runs locally
8. 08private key format detectorpaste or drop a key file · identify WIF · hex · PEM · PKCS8 · BIP32 xprv/xpub · Ethereum keystore · validate format only · never derives · runs locally

go deeper