What Is a Wallet Drainer? How to Spot and Limit Approval Risk

A wallet drainer is malicious software or a malicious transaction flow designed to move crypto assets out of a user’s wallet after the user signs something they do not fully understand. The attack may look like a mint, a token claim, a fake exchange login, a portfolio checker, a support form or an airdrop page. The common thread is simple: the victim is pushed to connect a wallet and approve a transaction or signature that gives the attacker a way to move assets.

This is not the same as someone “hacking the blockchain.” In many cases, the transaction is valid on-chain because the wallet owner signed it. That makes prevention, careful review and fast evidence capture more useful than promises of guaranteed recovery.

A drainer tries to convert user trust into wallet permissions. Depending on the asset and chain, the malicious flow may request a token approval, a permit-style signature, a direct transfer, or interaction with a contract that the victim has not verified.

Token approvals are especially important for ERC-20 and similar token standards. A normal decentralized app may need permission to spend a limited token amount for a swap or deposit. A malicious site may ask for a broad or unlimited allowance, giving a contract permission to transfer tokens later. MetaMask’s support pages explain token approvals as permissions that let a smart contract access a user’s tokens, and Etherscan provides a token approval checker for Ethereum addresses.

The dangerous part is timing. A victim may sign the approval, close the fake site and assume nothing happened. The loss can occur later when the approved contract or operator uses that permission.

Drainers often depend on social engineering before any on-chain action happens. The technical transaction matters, but the setup usually happens through a familiar-looking page or urgent message.

None of these signals proves a page is malicious on its own. The risk rises when urgency, wallet connection, unclear permissions and unfamiliar domains appear together.

A wallet drainer does not always need a seed phrase or private key. That distinction matters.

If a victim gives away a seed phrase, the wallet itself is compromised. The attacker can import the wallet and control assets directly. Revoking approvals is not enough, because the secret controlling the wallet has been exposed.

If the victim signed a bad approval but did not reveal the seed phrase or private key, the wallet may still be unsafe for some tokens, but the problem is different. The user should review and revoke suspicious allowances where possible, then consider moving remaining assets to a fresh wallet. Gas fees and chain-specific rules apply, so the exact steps depend on the network and assets involved.

MetaMask’s guidance on revoking token allowances notes that permissions can be reviewed and revoked through tools such as blockchain explorers and allowance-management services. For Ethereum, Etherscan’s token approval checker is one commonly used starting point. Revoke.cash also maintains educational material explaining how token approvals work across supported networks.

Wallet interfaces have improved, but a signature request can still be confusing. A safer review process focuses on the transaction’s source, purpose and scope.

Check the domain first. Many draining campaigns use clone domains with small spelling changes, extra hyphens, unusual top-level domains or fake “claim” subdomains. Do not rely only on a logo or website design.

Check the requested action. A token swap, NFT listing, staking deposit and message signature are different actions. If the wallet screen does not match what the site claims you are doing, stop.

Check the allowance amount. Unlimited approvals are common in DeFi, but they expand the damage if the approved contract is malicious or later compromised. When a wallet or dapp allows a custom allowance, a smaller amount may reduce exposure.

Check the contract address. Explorers can show whether a contract is verified, recently created or associated with known activity. This is not a guarantee of safety; malicious contracts can appear polished, and legitimate contracts can be complex. Treat explorer data as evidence, not a final verdict.

If you believe you signed something unsafe, speed matters, but panic can make the damage worse. Avoid sharing your seed phrase with anyone offering “recovery” help. A real wallet, exchange or investigator should not need your recovery phrase.

Start by saving evidence: transaction hash, wallet address, suspicious URL, screenshots, chat handles and timestamps. Then disconnect the wallet from the suspicious site inside the wallet interface. Disconnection alone does not revoke token approvals, but it reduces ongoing website access.

Next, review token allowances on the relevant chain. For Ethereum, Etherscan’s token approval checker can show approvals linked to an address. If suspicious approvals appear, revoking them requires an on-chain transaction and gas. On other networks, use the appropriate block explorer or a reputable allowance tool that supports that chain.

If valuable assets remain in the wallet, consider transferring them to a newly created wallet whose seed phrase has never been exposed. Do not transfer suspicious tokens or interact with unknown NFTs just because they appeared in the wallet; some are designed to lure users into another malicious transaction.

A drained wallet does not automatically prove that a specific website, project or person was responsible. On-chain records can show transactions and approvals, but attribution requires careful evidence. Scam accusations should be based on strong sources such as official warnings, law-enforcement notices, security research or verified infrastructure links.

Recovery is also uncertain. Blockchain transactions are usually irreversible, and anyone promising guaranteed return of funds should be treated as a separate risk. Some victims are targeted again by fake recovery agents who ask for upfront fees, remote access or seed phrases.

Bookmark the official sites you use often, including wallets, exchanges and explorers. Keep a separate low-value wallet for new mints, airdrops and experimental apps. Review active approvals after using unfamiliar DeFi services, not only after a suspected incident. If a loss has already happened, preserve evidence before deleting messages or closing browser tabs, then report through the relevant exchange, wallet provider, block explorer abuse channel or local law-enforcement route where available.