THE FIRST HOUR
What to do after a drain, in order
Nothing here needs Frostwit. Do these first; trace in parallel.
- Stop signing. Do not approve, connect or sign anything else with the drained wallet or the device it ran on until you know how it happened.
- Move what is left to a fresh wallet. Create the new wallet on a clean device, with a new seed phrase, then move remaining assets there. Native ETH for gas may be needed first.
- Save the evidence. Copy the transaction links of the theft (Blockscout), your address, the time and what you were doing. Take screenshots. Frostwit's case page and pack collect these for you.
- Do not pay recovery services. Anyone who contacts you offering to get funds back for a fee, or asks for your seed phrase, is part of the scam. Robinhood and Paxos never need your seed phrase.
- Report to the police and keep the report number. Robinhood and Paxos usually need a police report or a legal directive before they act on an address.
- Revoke approvals you gave to unknown contracts, from a wallet you control.
I signed something
A signed approval or permit can let a contract move your tokens later. Stop using the wallet, move the remaining assets to a fresh wallet, then revoke the approval from a wallet you control (an explorer's approval checker or your wallet's own revoke tool). Then paste the theft transaction on the trace form.
My seed phrase leaked
Treat the whole wallet as lost: anyone with the phrase can sign. Move what is left to a new wallet with a new phrase immediately, on a clean device. Do not reuse the phrase on any chain. Then trace the drain from the transaction.
I sent to a scammer
Sending is final. Paste the transaction hash, or use “thief's address” mode with 24 hours, to see where the value is now and what the issuer could still act on. Frostwit cannot freeze or recover anything. Robinhood and Paxos decide, and they usually need a police report or a legal directive.
Where to ask
Robinhood: robinhood.com/contact or support@robinhood.com (avoid scams). Paxos (USDG): support.paxos.com. Paxos freezes USDG only on a formal legal directive (court, regulator, law enforcement).
Which approval did the drainer use? Check approvals (read-only; revoke from your own wallet): it lists the spenders that still hold an allowance on your official tokens, including Permit2.