Wallet Drainers: How Malicious Approvals Steal Your Crypto
A wallet drainer tricks you into signing approvals that let attackers empty your wallet. Learn how drainers work, the warning signs and how to protect yourself.
A wallet drainer is a malicious website or script that tricks you into signing transactions or messages that give an attacker permission to move your tokens and NFTs, and then uses that permission to empty your wallet. The attacker never needs your seed phrase; your own signature does the work.
Drainers are behind many of the losses you see reported after fake airdrops, fake mints and hacked project social accounts. They have been sold as ready-made kits, sometimes called "drainer-as-a-service," which means even unskilled scammers can deploy them. Understanding what you are signing is the best defense.
How Token Approvals Work (and Why Drainers Love Them)
On Ethereum and other EVM chains, decentralized apps can't move your tokens on their own. You first grant an approval: permission for a specific contract to spend a specific token on your behalf, up to a set amount. DEXs and lending protocols need this to function.
The problem is that many apps request unlimited approvals for convenience, and approvals stay active until you revoke them. A drainer simply asks you to approve its contract instead of a legitimate one. Once you sign, the attacker can call a transfer whenever they like.
For NFTs, the equivalent is setApprovalForAll, which lets an operator move every NFT you own in a collection. Marketplaces use it legitimately; drainers use it to take entire collections at once. For a deeper look, see Crypto Scams on Instagram and TikTok.
The Signatures Drainers Use
| Request type | What it looks like | Why it's dangerous |
|---|---|---|
| Token approval | "Allow this site to spend your USDC" | Grants a spender rights over that token |
| NFT approval for all | "Give access to all your NFTs in this collection" | Lets the operator transfer every NFT in that collection |
| Permit or Permit2 signature | A message to sign, often with no gas fee | An off-chain approval the attacker can submit later |
| Direct transfer | "Claim" button that actually sends assets out | Immediate theft disguised as a claim |
| Blind signing | Unreadable hex data | You can't tell what you're authorizing |
Gasless signatures are especially deceptive. Because they don't cost a fee, people assume they're harmless "logins." Some are. Others are permits that authorize spending. Our article on ice phishing and permit signatures explains these in detail.
How Drainer Attacks Usually Unfold
- 1The lure. A link arrives via a fake airdrop announcement, a reply to an official post, a hacked Discord server, a sponsored search ad or a direct message offering "support."
- 2The convincing site. The page copies a real project's design and asks you to connect your wallet.
- 3Asset scanning. Drainer scripts check your balances and request approvals for your most valuable assets first.
- 4The signature. Prompts are framed as "claim," "verify," "mint" or "sync," with urgency like countdown timers.
- 5The sweep. Assets are transferred out, often within seconds, and quickly swapped or bridged to make tracing harder.
Why Drainers Work on Experienced Users Too
Drainers don't rely on obviously fake websites. Many attacks start from a genuine project's account that has been compromised, so the announcement looks real because it is posted from the real account. Others appear right when a real airdrop or mint is trending, when people expect to sign transactions and are rushing to be early. Related reading: SIM Swap Attacks. If you want to go further, read Fake Token Migration and Swap Scams.
Wallet prompts also look similar whether you are approving a trusted DEX or a drainer contract. The difference is in the details: the spender address, the token and the amount. Experienced users get caught when habit takes over and they click "confirm" the way they have a hundred times before. We cover this in more detail in Malicious Browser Extensions That Steal Crypto. Related reading: Email Account Security for Crypto Users.
Warning Signs Before You Sign
- You arrived through a DM, a reply, an ad or a link you didn't look up yourself.
- The site asks for approval of a token you didn't intend to trade.
- The approval amount is unlimited, or the spender address is unfamiliar.
- You're asked to sign a message you can't read, or your wallet warns about blind signing.
- There's pressure: "claim expires in 10 minutes," "your wallet will be suspended."
- The domain is slightly off, newly registered or uses an unusual extension. See crypto phishing sites.
How to Protect Yourself
- 1Use a burner wallet for new mints, airdrops and unfamiliar apps, holding only what you need. Keep long-term holdings in a separate wallet that rarely connects anywhere. Our guide to burner wallets explains the setup.
- 2Read every prompt. Check the action, token, amount and spender before signing. If you can't understand it, reject it.
- 3Prefer limited approvals when your wallet lets you set a custom amount.
- 4Enable transaction previews or simulation features in your wallet if available; they show what will leave your wallet.
- 5Revoke regularly. Review and remove old approvals. Our step-by-step guide on how to revoke token approvals shows how.
- 6Navigate directly. Type known URLs or use saved bookmarks instead of clicking links.
If You Think You've Been Drained
Act quickly, because attackers often return for remaining assets:
- Revoke all approvals you don't recognize.
- Move remaining funds to a brand-new wallet with a new seed phrase, especially if you entered your seed phrase anywhere.
- Note the transaction hashes, attacker addresses and the site URL.
- Report the site and addresses, for example through our scam report form, and to the platform where you found the link.
- Ignore anyone offering to recover funds for a fee; recovery scams target recent victims.
See also our checklist for what to do immediately if your wallet is compromised.
Bottom line
Wallet drainers don't break your wallet's cryptography; they get you to authorize the theft. Treat every signature as a potential transfer of control, keep valuable assets in a wallet that never touches unfamiliar sites, and clean up approvals regularly. Slowing down for thirty seconds before signing is the most effective security tool you have.
Frequently asked questions
Can a wallet drainer steal my seed phrase?
Usually not. Most drainers never see your seed phrase. They trick you into signing approvals or transfers that give them permission to move your tokens. Some phishing pages also ask for the seed phrase directly, which is a separate scam: no legitimate site ever needs it.
Does revoking approvals get my stolen funds back?
No. Revoking removes permissions so the attacker cannot take more of the approved tokens, but anything already transferred is gone. Revoke as soon as you notice a problem, then move remaining assets to a new wallet if you signed anything suspicious.
Do hardware wallets protect against drainers?
Partly. A hardware wallet keeps your private key offline, but if you approve a malicious request on the device, it will sign it. Hardware wallets help most when you read what the device displays and reject anything you do not understand.
Why did my wallet get drained days after I visited a site?
You probably signed an approval or permit earlier that remained valid. Attackers can wait and use that permission later, for example when your balance increases. This is why reviewing and revoking old approvals regularly matters. Signed permits can also remain valid until their deadline.