What is wallet drainer?

Malicious software, usually sold as a kit, that tricks a user into signing a transaction or approval that transfers their assets to the attacker.

The word "drainer" describes a product rather than a technique. These are commercial toolkits, sold or rented on criminal forums with support and a revenue share for whoever brings the victims, which is why so many phishing pages look identical: they are running the same code behind different domains.

The critical thing to understand is that no software is broken when a drainer succeeds. You signed. The chain did what a valid signature told it to do.

How it works

The kit supplies a convincing front end and the malicious payload behind the connect button. Delivery is the operator's job, and the routes are consistent: a fake airdrop or token claim page, a cloned version of a real application, a link posted from a compromised project account, a search advertisement above the real site, or a direct message about a "support" issue.

The payload has two main forms. The first is a token approval granting the attacker's contract permission to spend a token balance, presented as a routine step in claiming or swapping. Approvals persist, so the wallet can be emptied hours or days later, well after the victim closed the tab. The second is an off-chain signature, often an eip 712 permit or a marketplace listing, which authorizes a transfer without appearing as a transaction at all and so shows no balance change to preview.

Kits also automate the sweep. They read the wallet's holdings on connection, rank assets by value, and request signatures in the order that extracts the most before the victim reacts.

The defenses that work are all pre-signature. Simulate before signing so an unexpected outflow becomes visible. Reach applications by bookmark rather than by search or link. Keep long-term holdings in a wallet that never connects to any site. Review and revoke standing approvals periodically.

Example

Illustrative. A post from a project's compromised account announces a claim window. The page looks correct and asks you to connect and sign to verify eligibility.

The request is a permit signature, not a transaction, so no fee is quoted and no balance change is shown. You sign. Nothing appears to happen and no tokens arrive. Four hours later a transaction you did not send moves your entire stablecoin balance, using the permission that signature granted. Every step was valid, nothing can be reversed, and the only intervention point was before signing.

Why it matters when you buy

This risk begins when coins leave an exchange. While assets sit with a custodian, there is no signature for anyone to trick out of you, and the tradeoff is exchange risk instead. The guide on moving crypto off an exchange covers the transition, and the guide on spotting a crypto scam covers the delivery routes.

Related terms

• phishing: how drainers reach victims
• token approval: the permission most often abused
• eip 712: signatures that move nothing until later
• transaction simulation: the preview that exposes them
• approval revocation: removing permissions already granted
• blind signing: approving data you cannot read

Questions

Can a drained wallet be recovered?

No. The transactions are valid and final. Any service promising to reverse them or to recover funds for an upfront fee is a second scam targeting the same victim.

Is my hardware wallet safe from this?

It protects the key, not the decision. A hardware wallet will happily sign a malicious payload if you approve it on the device, which is why signing what you cannot read is the risk rather than where the key is stored.

What should I do right after signing something suspicious?

Move remaining assets to a fresh wallet with new keys immediately, then revoke approvals from the compromised one. Revoking first can be too slow, since the attacker may act while the revocation is pending.