What Is a Wallet Drainer? How Crypto Drainers Empty Wallets

Most crypto thefts don't involve anyone guessing a password. The victim opens a website, connects a wallet and clicks Approve or Sign on a request that looks routine. Minutes later, the tokens are gone.

The tool behind many of those losses is a wallet drainer: a script that sits on a fake or hijacked web page and turns one careless signature into a sweep of your balance.

Here is how drainers work, the signatures they rely on, the warning signs to watch for, and what to do if you think you have already signed something you shouldn't have.

What a wallet drainer is

A wallet drainer is malicious code built into a phishing website. It does not crack your wallet's encryption or read your seed phrase. Instead, it asks for permission, and you grant it.

That distinction matters. Your keys stay on your device the whole time. The drainer simply prepares transactions or signature requests that hand control of your assets to the attacker, then waits for you to confirm them.

Because a blockchain treats a valid signature as final, there is no bank to call afterwards. Once the assets move, getting them back depends on the thief's mistakes, not on any reversal process.

Most crypto drainers are now sold as a service. Developers rent out the code, hosting and fake site templates to affiliates, then take a share of whatever is stolen. Group-IB reported that Inferno Drainer, one of the best-known kits, kept 20% of each theft while the affiliate kept 80%.

How a crypto drainer attack unfolds

The attack nearly always starts with traffic. Scammers need you on their page, so they post links from hacked project accounts on X or Discord, buy search and social ads, or promote a fake airdrop or mint.

The page usually copies a real project closely: the same logo, the same layout and a web address that differs by a letter or two. A "Claim" or "Connect wallet" button is the hook.

Once you connect, the script reads your public address and checks what you hold. Many kits rank assets by value and how easy they are to move, so the first request targets the most valuable token in the wallet.

Then comes the prompt. It might be a token approval, an off-chain signature or a transfer dressed up as a claim. Some kits retry with a different request if you reject the first one, which is why repeated pop-ups are a red flag.

After you sign, the attacker's contract or bot moves the assets out, often splitting them across several addresses and swapping them quickly so they are harder to trace.

The signatures drainers rely on

Knowing the request types makes the danger easier to spot. On Ethereum and other EVM networks, most crypto wallet drainer attacks use one of a handful of patterns.

Token approvals. An ERC-20 approve call lets another address spend your tokens up to a set limit. Drainers ask for an unlimited allowance, then pull the balance whenever they like, even days later.

Permit signatures. Some tokens support Permit, which grants the same spending right through an off-chain signature. Nothing is sent to the blockchain when you sign and there is no gas fee, so many people assume it is harmless. Scam Sniffer found Permit was behind 56.7% of losses in the large drainer cases it tracked in 2024.

NFT approvals. An NFT wallet drainer typically requests setApprovalForAll, which lets one address move every NFT you hold from a collection. Approving it on a fake marketplace can empty a whole collection in a single transaction.

Ownership changes. Rarer but costly, these hand control of a contract or vault to the attacker. Scam Sniffer linked a setOwner signature to the largest single theft of 2024, a loss of about $55 million in DAI in August.

Other chains have their own versions. On Solana, one transaction can bundle many instructions, so a single confirmation may move several tokens at once.

How big the problem has become

Scam Sniffer, which tracks phishing on EVM chains, estimated that wallet drainers took about $494 million from roughly 332,000 addresses in 2024. That was 67% more than the year before.

The number of victims barely grew, but the average theft got larger. Thirty incidents topped $1 million each, and staked assets and stablecoins were the most common targets in those big cases.

The kit market keeps reshuffling. Inferno Drainer announced it was shutting down in November 2023 after being linked to more than $80 million in thefts, yet its tools stayed available to past customers and it was again one of the most active drainers in 2024. Pink Drainer announced its exit in May 2024, and newer kits filled the gap.

The lesson is not that one group is the threat. Brands come and go, but the technique stays the same.

Warning signs before you sign

Most drainer attacks can be stopped at the confirmation screen. A few habits catch the majority of them.

Check the address every time. Type known sites yourself or use saved bookmarks instead of clicking links in posts, direct messages or ads, even from accounts you follow.

Distrust urgency. Free airdrops, surprise mints, "last chance" claims and wallet "verification" requests are the most common bait.

Read what the wallet shows. If a simple claim asks for an unlimited approval, a Permit or access to an entire NFT collection, stop. A genuine airdrop rarely needs permission to spend tokens you already hold.

Notice odd behaviour. A site that keeps prompting after you reject a request, or switches networks on its own, is acting like a drainer kit. Unexpected tiny transfers into your wallet deserve the same suspicion; our guide to dusting attacks explains how scammers use them to plant lookalike addresses.

Use transaction previews. Many wallets and browser extensions now simulate what a transaction will do before you confirm it. If the preview shows assets leaving your wallet, believe it.

Set up your wallets to limit the damage

Even careful people get fooled now and then, so it helps to cap what any single mistake can cost.

Keep a separate hot wallet for minting, trying new apps and claiming airdrops, funded with only what you need for that session. Long-term holdings belong in a different wallet that never connects to unfamiliar sites.

A hardware wallet adds a physical confirmation step and shows transaction details on its own screen. It cannot stop you from approving a bad request, but it makes blind clicking harder and keeps your keys off an internet-connected computer.

Review your approvals every few months. Tools such as Revoke.cash and the token approval checkers on block explorers like Etherscan list the allowances your address has granted and let you cancel the ones you no longer use. Each revocation costs a small network fee.

And never share your seed phrase. Some drainer sites skip the signature trick entirely and ask you to type your recovery words to "fix" or "sync" a wallet. No legitimate app needs them.

What to do if you signed a drainer request

Speed matters, because some drainers wait before acting or sweep tokens in stages.

First, move whatever is left to a fresh wallet with a new seed phrase that has never been linked to the old one. If you only granted an approval, revoking it may close the hole, but if you are unsure what you signed, treat the whole wallet as compromised.

Next, revoke any remaining approvals on the old address, and check other networks where the same address holds assets.

Then write down the details: the website address, the transaction hashes and the receiving addresses. Report the theft to the project that was impersonated, to your local police or cybercrime unit, and to any exchange the funds were sent to. Exchanges can sometimes freeze deposits linked to theft.

Finally, be wary of "recovery specialists" who contact you afterwards. Offers to retrieve stolen crypto for an upfront fee are a well-known follow-up scam.

The bottom line

A wallet drainer does not so much hack you as persuade you. Every theft depends on a signature you chose to give, which also means you can refuse it.

Slow down at the confirmation screen, keep risky activity in a separate wallet and clean up old approvals. Those three habits put you well ahead of the people drainer kits are built to catch.