A wallet drainer is malicious code that empties a wallet through a single signature. The victim is shown something that looks like a login or a claim, and the signature actually grants permission to transfer their tokens. The main defenses are bookmarking real sites, using a wallet that simulates transactions, and reading what you are signing rather than the page around it.
How a drainer actually works
You arrive at a convincing page
Through a search ad, a direct message, a compromised project account, or a token airdropped into your wallet with a website in its name.
You connect your wallet
Harmless by itself. It shares your address and lets the site see what you hold, which the drainer uses to target the most valuable assets first.
You are asked to sign
Framed as verifying, claiming, logging in or enabling. The wallet popup is often technical enough that most people click through it.
The signature grants transfer rights
Commonly a Permit or an increaseAllowance. No transaction appears yet, which is exactly why it feels safe.
Your assets leave
Sometimes immediately, sometimes days later so the connection is not obvious. By then the permission is long forgotten.
The signatures worth understanding
| What you see | What it does | Risk |
|---|---|---|
| Sign in with Ethereum | Proves you control the address. Moves nothing | Low |
| Approve token | Grants a contract permission to spend that token | High if unlimited or unfamiliar |
| Permit or Permit2 | Gasless approval by signature. Very commonly abused | High |
| setApprovalForAll | Grants control of an entire NFT collection | Very high |
| Contract interaction | Executes a function. Depends entirely on what it does | Read the simulation |
Defenses that actually work
Use a simulating wallet
Rabby shows you exactly what a transaction will do to your balances before you sign. This single change catches most drainers.
Bookmark everything
Never reach a wallet or exchange through a search result. Attackers buy ads specifically because the ad outranks the real site.
Use a burner for risk
Mints, airdrops and unfamiliar protocols get a separate wallet holding nothing you care about.
Hardware for the vault
Even if you sign something bad on the hot wallet, the vault is untouched. Segmentation limits blast radius.
Revoke regularly
Every few months, review approvals and revoke what you no longer use. See token approvals.
Ignore unexpected tokens
A token you did not buy appearing in your wallet is bait. Do not visit the site named in it.
The tells on a fake site
- The URL is subtly wrong. A swapped letter, a hyphen, a different extension. Check character by character.
- You arrived from an ad. Paid results for wallet names are a persistent attack channel.
- It asks for a recovery phrase. No legitimate site ever does. This is definitive.
- It rushes you. Countdown timers and limited spots exist to prevent checking.
- The signature request does not match the action. A claim button should not need approval to spend an unrelated token.
If you signed something
Move remaining assets now
To a completely new wallet with a new seed phrase. Speed matters more than tidiness.
Revoke approvals
On the affected wallet, at revoke.cash. Moving funds out comes first.
Assume the wallet is burned
Do not reuse it. Approvals you do not know about may still exist.
Check every chain
Approvals are per chain. If you use several networks, check each one.
Common questions
Is connecting my wallet to a site dangerous?
Connecting alone only shares your address. The danger is in what you sign afterward. That said, a site that knows what you hold can craft a more convincing request.
Can a drainer take funds from my hardware wallet?
Only if you approve the transaction on the device. The hardware protects the key, not your judgment. Read the device screen before confirming.
What is Permit2 and why does it keep appearing?
A standard that lets you approve token spending by signature instead of an onchain transaction, saving gas. It is legitimate and widely used by real applications, which is exactly why drainers imitate it.
Where to go next
Get a second pair of eyes on your setup
A security session reviews what you hold, where it sits, what approvals are open and what would happen if your laptop were compromised tomorrow. Most people find at least one thing worth fixing.