Minted to Empty
A Toronto motion designer chased a sold-out collection to a “official” mint mirror and clicked Claim. No NFT arrived. Instead, a single signature handed an automated drainer the keys to her wallet — and it emptied two chains in under a minute.
Illustrative composite. This case file is a dramatized reconstruction of recurring patterns. Names, the “VaultMint” platform, figures, and details are fictionalized; it is not a record of a specific named client.
Last Known Position
Priya, 34, designed motion graphics for a living and had been minting art for two years — careful, not naive. When a collection she had been watching announced a surprise companion drop, the link came from a Discord server she trusted, posted by an account wearing the moderator badge. The server had been compromised hours earlier; the badge was real, the hands behind it were not.
The link led to “VaultMint,” a pixel-faithful clone of the marketplace she used daily — same fonts, same wallet-connect modal, same lock icon in the address bar on a domain one character off from the real one. The page offered a free companion mint to existing holders. All she had to do was connect and claim.
Point of No Return
The wallet popup did not ask her to buy anything. It asked her to sign. Buried in the request was a setApprovalForAll — a blanket permission granting an unknown contract the right to move every token in her wallet. She approved it the way most of us approve cookie banners. The drainer fired immediately, sweeping her ETH-chain assets, then bridging to drain her Polygon holdings on the same authorization.
It didn’t charge me anything. That’s what fooled me. Free things don’t feel like theft until the wallet is empty.
Recovery Track
Revoke before anything else
The instant Priya reached us we walked her through revoking the malicious approval and moving the two assets the drainer had missed to a clean wallet. Stopping the bleed comes before chasing what is gone.
Identify the drainer kit
The contract signature matched a drainer-as-a-service template we had catalogued. Known kit means known cash-out behavior — we knew where these funds tend to surface.
Track both chains to the bridge
We followed the ETH-chain sweep and the Polygon sweep separately to the bridge that consolidated them, then onward to the laundering wallets the kit operators favor.
Tag the centralized exit
A meaningful slice was sent to a centralized exchange for cash-out. We mapped that deposit address to Priya’s stolen tokens and prepared a freeze request with full chain provenance.
Freeze, verify, return
The exchange froze the deposit pending verification. After proof of ownership, the seized portion was returned — partial, because the drainer dispersed the remainder through self-hosted wallets we could trace but not seize.
CAD $31,300 of $71,200 returned. A single approval did the damage; disciplined revocation and a fast freeze recovered what reached an exchange.
Warning Lights
- A “free” mint that asks you to sign setApprovalForAll is a drainer — claiming should never require blanket token access.
- Links in Discord and Telegram are not safe because a moderator posted them; server takeovers are routine.
- Always read the signature request, not just the dollar amount — the dangerous part is the permission, not the gas.
- A domain one character off from the real marketplace is a clone, lock icon and all.
- Surprise “holder-only” drops manufacture the urgency that stops people from checking the contract.
Signed something you shouldn’t have?
Revoke first, then send us the wallet and the transaction. We will trace where the drainer took it.
Open a Case