Wallet drainers and approval phishing: how they work

A wallet drainer is a malicious website, usually built from a ready-made kit, designed to trick you into signing transactions that hand over your assets. It does not need to break any cryptography. It only needs one careless click.

How victims are reached

• Fake airdrop and mint pages promoted through compromised social accounts.
• Search ads that imitate popular wallets, exchanges and decentralised apps.
• Direct messages offering support, refunds or rewards.
• Hijacked project websites or Discord servers posting malicious links.

What the drainer asks you to sign

• Token approvals that let a contract spend an unlimited amount of a token.
• "Set approval for all" on NFT collections, which covers every item you own.
• Off-chain permit signatures that look like a harmless login message but authorise transfers.
• Direct transfers disguised as a "claim" or "verify" step.

Once signed, the attacker's contract can move your funds at any time, often within seconds.

How to protect yourself

• Type important addresses yourself or use bookmarks instead of following links.
• Read the wallet's transaction preview and simulation warnings before you confirm.
• Keep long-term holdings in a wallet, ideally a hardware wallet, that never connects to unfamiliar sites.
• Review and revoke old approvals regularly.

If you think you signed something malicious

Act quickly. Revoke the approval if the attacker has not used it yet, move remaining assets to a new wallet whose keys have never been exposed, and report the site to your wallet provider. Be wary of "recovery services" that contact you afterwards; they are frequently a second scam.

Key takeaways

• Drainers rely on your signature, not on hacking your wallet.
• Unlimited approvals and permit signatures are the most dangerous requests.
• Separate wallets and regular approval clean-ups limit the damage.