The first-hour checklist
- Secure what is left. Create a new wallet with a new recovery phrase on a device you trust. Send any remaining coins and tokens there, largest first.
- Cut access. Revoke token approvals on the old wallet and disconnect all connected sites. If the phrase leaked, assume the old wallet is permanently unsafe.
- Find the theft transaction. Open your address on the explorer and note the hash, time, amount and receiving address of every outgoing transfer you did not make.
- Report. File a police report with those details and ask them to request a freeze from Tether. Report to the exchange if the funds moved to one.
- Save evidence. Screenshots of sites you visited, messages, apps you installed, and the explorer pages.
How it happened: the four usual causes
| Cause | What you see on the explorer | Fix for the future |
|---|---|---|
| Approval or permit you signed | A transfer from your address triggered by another contract, often an “Approve” earlier | Read every approval |
| Recovery phrase exposed | Several assets swept out in quick succession, all to the same address | Keep the phrase offline |
| Malware on your device | Transfers at odd times; sometimes a changed address when you pasted | Remove unknown apps |
| TRON permission change | A permission update transaction, then you cannot send | Check account permissions |
Knowing the cause tells you whether the old wallet can ever be reused. After a phrase leak or malware, it cannot.
Follow the funds yourself
You do not need special tools for the first steps. Open the receiving address on the explorer and look at what it did next. Note any address that received a large share, and any label such as an exchange name. If the USDT is still at the first address, tell the police officer immediately: this is the case where a freeze is most likely to help. See can USDT be traced and how Tether freezes USDT.
Where to report
- Your local police or national cybercrime service, with hashes and addresses.
- The exchange that received the funds, if the explorer labels one.
- The site, app or account that tricked you, on the platform where you found it.
- Scam report databases such as Chainabuse, so others can see the address.
Country routes are listed on our reporting page.
Recovery offers after a drain
Drained wallets are public, and scammers watch them. Within hours you may get messages offering to “hack back”, “reverse” or “recover” the funds. No one can reverse a confirmed transfer, and real investigators do not cold-message victims. Every one of these offers ends with a fee. See crypto recovery scams.
Set up so it cannot happen the same way again
- Keep savings in a wallet that never connects to websites, ideally a hardware wallet.
- Use a separate small wallet for apps, airdrops and experiments.
- Review approvals every few months and revoke what you no longer use.
- Install wallets only from links on their official websites.
Questions people ask
My USDT wallet was drained. Can I get it back?
Sometimes, if the USDT is still at the thief’s address and police ask Tether to freeze it quickly. Report immediately.
Should I keep using the drained wallet?
No, if the recovery phrase leaked or your device has malware. Create a new wallet on a clean device.
How do I know how my wallet was drained?
Look at the outgoing transactions on the explorer: approvals, permission changes and sweeps of all assets point to different causes.
Can someone hack back my stolen USDT?
No. Offers to hack back or reverse transfers are scams.
Sources
Not sure about an offer?
Send it to us before you pay. A person reads it. It costs nothing.
Ask us about it