Wallet or exchange hack
If your wallet or exchange account has been drained, I analyse your device and the blockchain together: how the attacker got in and where the funds went.
Member of AEPEJU (no. 1556). Barcelona and across Spain.
The first hours: what to do and what not to touch
The first thing is to cut off the attacker's access without destroying the evidence of how they got in.
- If there is a balance left, move it from a clean device to a new wallet with a new seed.
- Revoke token approvals you have granted to contracts you do not recognise.
- Change your passwords and turn on two-step verification with an authenticator app, not SMS.
- Tell the exchange as soon as possible and ask it to lock the account.
- Do not reset the phone or the computer: the trail of how the attacker got in is there.
- Note the hashes of the outgoing transactions and report it to the police.
How the attacker got in
Almost always through one of these routes, and each leaves different traces on the device and on the chain.
- Drainer: a website imitating a project that makes you sign an approval which empties the wallet.
- Malicious signature: a setApprovalForAll or a permit that looked harmless.
- Leaked seed: stored in a photo, in the cloud or typed into a fake website.
- Malware on the computer or phone that steals keys or swaps the address when you copy it.
- SIM swapping: your SIM is duplicated and your accounts are recovered with the SMS codes.
- Access to the exchange account with stolen credentials.
Device and chain, analysed together
This is what makes the difference: the chain shows where the money went and the device explains how the theft happened.
As a digital forensics expert I make a hashed forensic copy of the phone or computer, look for the malware, the phishing site or the malicious signature, and match it against the transactions on the blockchain. When two different people do this, the report usually ends up weak on one side.
If the exchange may be liable
The report documents the technical facts your lawyer needs to assess it.
For example, from which IP address and device the account was accessed, whether alerts were triggered, how long passed between your warning and the lock, or whether the withdrawal went to a new address without extra verification. Whether that is enough for a claim is your lawyer's decision; I provide the facts.
What you receive
A signed expert report, ready for the police complaint or the lawsuit.
- The explanation of the entry route, with the evidence found.
- The tracing of the stolen funds as far as they can be followed.
- The chain of custody of the evidence, with SHA-256 hashes.
- Testimony in court if needed, quoted from day one.
Frequently asked questions
Common questions about this kind of report.
Can I get back crypto stolen in a hack?
I cannot guarantee it. If the funds reach an exchange, the court can ask for them to be frozen; the report is the technical basis for that request.
Is the exchange liable if my account is hacked?
It depends on the facts and the terms of service, and your lawyer assesses it. I document how the access happened and how the exchange reacted.
What is SIM swapping?
It is the fraudulent duplication of your SIM card. With it, the attacker receives your SMS codes and recovers your accounts, including the exchange account.
What is a drainer?
It is a malicious website or contract that, after you sign, transfers your tokens to the attacker. It usually poses as an airdrop, a mint or a site imitating a well-known project.
How long do I have to act?
The sooner the better. Funds still at an exchange can be frozen; those that have gone through mixers or bridges are harder to follow.
Do you need my phone or computer?
If we want to prove how the attacker got in, yes. I make a hashed forensic copy and give it back to you; I only work with lawful access, without bypassing encryption or locks.
Related articles
To understand this kind of case better.
- El exploit de KelpDAO explicado para abogadosQué pasó, cómo se siguieron los fondos hasta Bitcoin y qué enseña para casos reales.
/blog/kelpdao-exploit-explicado - Drainers: cómo se demuestra qué firmasteApprove, permit y setApprovalForAll: qué rastro deja cada firma y cómo se prueba.
/blog/drainers-firmas-maliciosas
Tell me about your case
Free 30-minute consultation and a free quote within 24 working hours.