A wallet drainer is malicious software, usually a script embedded in a phishing website, that tricks a crypto wallet owner into signing transactions or messages which hand control of tokens and NFTs to an attacker, who then moves the assets out automatically. It is one of the most damaging scams in crypto & blockchain security because it does not need to steal a private key: the victim authorizes the theft with a single signature.
Drainers exploit the gap between what a user thinks a signature does and what it actually permits on-chain. A prompt that appears to mint a free NFT or claim an airdrop can in fact grant unlimited spending rights over every valuable token in the wallet.
How a wallet drainer attack works
A drainer attack runs as an automated pipeline. The victim is lured to a convincing copy of a real project site and connects a wallet. The drainer script then reads the wallet’s holdings, ranks assets by value and requests the signatures that would transfer the most valuable ones first. As soon as a signature arrives, a backend service submits the transfers, often within seconds.
Modern drainers are sold as drainer-as-a-service kits. Operators maintain the code, the asset-pricing logic and the laundering infrastructure, while affiliates run phishing campaigns and receive most of the proceeds, with the operator keeping a share commonly reported at around 20 to 30 percent. This division of labor explains the scale and polish of current campaigns.
The stages of a typical attack are shown below.
| Stage | Attacker action | What the victim sees |
|---|---|---|
| Lure | Fake airdrop, mint or support message | An urgent or attractive offer |
| Connection | Phishing site requests wallet access | A normal connect prompt |
| Profiling | Script scans balances and approvals | Nothing visible |
| Signature request | Approval, permit or order prepared | A claim, verify or mint button |
| Extraction | Backend transfers assets immediately | Balances drop to zero |
| Laundering | Swaps, bridges and mixers | Nothing; funds are gone |
Signature types that drainers abuse
Drainers rely on legitimate wallet functions. The most dangerous are token approvals and off-chain signed permissions, because they authorize future transfers rather than moving assets directly, and because off-chain signatures cost no gas and may look like harmless text messages.
| Signature type | What it grants | Why it is dangerous |
|---|---|---|
| Unlimited token approval | Spending right over a token balance | Remains valid until revoked |
| Collection-wide NFT approval | Transfer right over all NFTs in a collection | One click covers every item |
| Permit signature | Approval created by an off-chain message | No transaction and no gas shown |
| Marketplace listing order | Sale of assets at an attacker-set price | Looks like a routine login message |
| Account delegation | Code control over a wallet account | Can move every asset at once |
| Direct transfer | Immediate movement of the native coin | Disguised as a claim or fee |
The common thread is blind signing: the wallet shows raw data or a short label, and the user approves without understanding the effect. This is the same mechanism that powers approval phishing, of which wallet drainers are the automated, industrial form.
Wallet drainers compared with related scams
Drainers belong to a family of crypto scams that differ in what the victim gives away. Telling them apart helps choose the right defense.
| Threat | What the victim gives up | Key defense |
|---|---|---|
| Wallet drainer | A signature granting control of assets | Read and simulate every signature |
| Seed phrase phishing | The recovery phrase itself | Never type a seed phrase online |
| Address poisoning | A transfer to a look-alike address | Verify full addresses, not fragments |
| Rug pull | Money invested in a fraudulent project | Due diligence on the project |
| Pig butchering scam | Repeated voluntary deposits over weeks | Distrust unsolicited investment contacts |
Drainers also differ from these scams in their delivery channels. Campaigns spread through hijacked social media accounts, paid search advertisements, compromised project websites and fake support agents in community chats, so a link that appears in a trusted place is not proof that the destination is genuine.
How to defend against drainers
The strongest defense combines separation of funds, transaction simulation and approval hygiene. Long-term holdings belong in a vault wallet that never connects to new sites, while a separate low-balance wallet handles mints, airdrops and experiments. Wallets and browser extensions that simulate the outcome of a signature show which assets would leave the account before the user confirms.
| Warning sign | What it may indicate | Safe response |
|---|---|---|
| Countdown or limited-time claim | Pressure to sign without reading | Close the page and verify elsewhere |
| Approval for a token not involved | Hidden spending right | Reject the request |
| Unreadable typed data message | Permit or listing order | Decode it or refuse to sign |
| Link from a reply or direct message | Compromised or fake account | Use a saved bookmark instead |
Hardware wallets help only with clear signing. A hardware device that shows a hash instead of decoded details protects the key but not the user’s judgment, so the signing screen must be read just as carefully.
What to do after a drain
Blockchain transfers cannot be reversed, so the response focuses on limiting further losses and preserving evidence. Speed matters, because drainers often keep scanning the victim’s address for newly arriving funds.
- Revoke every remaining approval from a clean device and treat the affected wallet as permanently compromised.
- Move unaffected assets to a newly created wallet with a fresh recovery phrase.
- Record transaction hashes and the phishing domain, and report them to the wallet provider, exchanges and police.
- Ignore recovery offers: people promising to retrieve drained funds for an upfront fee are almost always running a second scam.
Stripped to the essentials
A wallet drainer is like a fake delivery form that is really a power of attorney. The victim believes they are signing to receive a free gift, but the small print gives a stranger the right to empty their account.
The thief never needs the password. The victim’s own signature does the damage, which is why reading and understanding every signing request matters more than any other habit in crypto.
Where it is applied
A collector sees a post from what looks like the official account of an NFT project announcing a limited airdrop for existing holders. The link leads to a pixel-perfect copy of the project site, where a button labeled verify eligibility triggers a signature request showing only typed data.
Because the collector uses a wallet with transaction simulation, the prompt warns that signing would list two valuable NFTs for sale at zero and approve the transfer of all stablecoins. The collector rejects it, checks the project’s real site through a bookmark and finds no airdrop. The outcome is no loss, and the collector reports the domain so wallet providers can block it for other users.