Wallet drainer = smart contract that abuses the token approval of the user connecting to the fake site / dapp. The victim's wallet is emptied. Collection: on-chain tracking + issuer freezing + blocked on the Turkish stock exchange.
Attack anatomy
Victim first 24 hours
On-chain tracking
- Drainer's smart contract (etherscan contract address).
- Cluster of exit wallets.
- Pre/post mixer monitoring.
- File number + amount upon exit to the central stock exchange.
I gave Approve unlimited, should only the negotiated amount appear?
No — "unlimited approval" allows the drainer to withdraw the entire balance. Approving the "exact amount" on a token basis is the only protection.
How does USDT/USDC freeze work?
Tether (USDT) and Circle (USDC) are central issuers; They can freeze certain addresses upon court order or prosecutor's request. The Turkish prosecutor's office request is forwarded to the USA through the MLAT procedure; 1-3 months period.
Are there refunds in DeFi?
No — The DeFi protocol is decentralized; No admin can withdraw. The only hope: Collection at the point of exit with KYC.
Is tracking possible after Mixer (Tornado Cash)?
It gets difficult but not impossible. Chainalysis and Elliptic mixer use "demixing" techniques; 30-60% of the chain is established.
Is there insurance?
Some crypto wallets (Coinbase Wallet) offer limited insurance; Insurance limited for individual wallets. DeFi insurance protocols (Nexus Mutual) provide coverage for some types of attacks.
Relevant legislation
- TCK art.158/1-f — Qualified fraud through information system.
- 5549 SK — MASAK crypto notification, account blocking.
- Crypto Asset Service Provider Communiqué — CBRT / CMB regulations.
- BRSA 2021/30 — Ban on using crypto in payments.
- HMK art.400-405 — Determination; on-chain evidence fixing.