MetaMask Drainer Recovery

MetaMask drainers don't hack MetaMask — they trick you into signing a contract that gives them permission to move your tokens. The transaction looks normal. By the time you realize what happened, the tokens are already gone.

1. The first hour

1. Disconnect MetaMask from every dApp (Settings → Connected sites → Disconnect all).
2. Revoke approvals at revoke.cash or Etherscan Token Approval Checker. Revoke anything you don't recognize — especially setApprovalForAll on tokens or NFTs.
3. Move remaining assets to a brand-new wallet created on a different, clean device. Don't reuse the compromised seed phrase, even after revoking.
4. Screenshot the malicious transaction on Etherscan/Polygonscan/BscScan, including the TXID, the drainer's address, and the contract you signed.
5. File with the Canadian Anti-Fraud Centre at antifraudcentre-centreantifraude.ca and your local police. Get a file number.

2. How drainers actually work

You visited a fake airdrop page, fake NFT mint, fake "claim rewards" site, or a compromised Discord link. MetaMask popped up asking you to sign — usually a setApprovalForAll, permit, or a custom contract method. You signed because it looked routine. That signature handed a smart contract permission to move specific tokens (or all tokens of a type) from your wallet at any time.

The drainer then called that contract and pulled the tokens. ETH itself can't be drained without a direct signed transfer, but every ERC-20 token, USDC, USDT, and NFT in your wallet is fair game once approved.

3. Tracing the funds

Every hop is public. Investigators follow the drainer's wallet through bridges, mixers, and DEX swaps using Chainalysis or TRM Labs until the funds either rest at a regulated exchange (recoverable) or vanish into a mixer (much harder). Most drainer operations consolidate stolen funds at a small number of addresses before cashing out — those choke points are where recovery happens.

4. When recovery is realistic

• You acted within days.
• The trail leads to a major centralized exchange.
• The loss is large enough to justify legal action ($25K+ typically).
• You preserved every TXID and screenshot.

5. Do not pay a "recovery hacker"

Within days of being drained you'll be contacted by people on Telegram, Instagram, or email offering to "reverse the transaction" or "hack the drainer's wallet." It is not technically possible to reverse a blockchain transaction. They are scammers building a second loss on top of your first. Read the full recovery-scam warning.