Ethereum NFT Drain — Trace Stolen ERC-721 & ERC-1155 Collections

How EVM NFT drains usually work

Most NFT sweeps follow approval abuse: you signed setApprovalForAll or a Permit2-style permission, then a drainer contract transferred every collection in minutes. Sometimes the drain tx itself is a direct transfer if the attacker had key access.

• Bulk outbound NFT transfers in one block or consecutive blocks.
• Native ETH sent first to pay gas for sweeps.
• Marketplace listings at floor price immediately after theft — document listing txs separately.

What to copy from Etherscan

• Wallet address on the correct EVM chain (Ethereum, Base, Arbitrum, etc.).
• Each NFT transfer tx hash with collection name and token ID.
• Approval txs preceding the sweep — critical for abuse desk context.
• Recipient addresses and any labeled CEX or marketplace hot wallets.

OpenSea, Blur, and marketplace steps

• File support tickets with on-chain proof — hashes, collection, token IDs.
• Note: marketplaces cannot reverse blockchain transfers; they may flag stolen items per policy.
• Revoke NFT operator approvals at revoke.cash before moving remaining assets.

Single tx vs full wallet report

• $5 single_tx — decode the approval or first sweep hash only.
• $20 incident report — indexes all outbound NFT and token flows in the drain window.
• $10 approval audit — find standing operators before or after the incident.

Solana NFT drains

Solana uses compressed NFTs, Metaplex, and different delegate mechanics. See our Solana NFT drain guide and use case for Phantom/Solflare victims — do not apply EVM steps to Solana.

When Tracefunds helps

NFT proof table with per-collection filters, fund-flow graph toward labeled destinations, and verification checklist — verify every row on Etherscan before sharing externally.