Wallet drainer

Quick answer: A wallet drainer is not one single tool. It is a scam pattern that combines a fake offer, a rushed wallet connection and one or more signatures or approvals that transfer value to the attacker.

Drainers often appear behind fake airdrops, NFT mints, token claims, urgent migration pages, compromised social accounts and cloned support websites. The user may see a familiar wallet popup, but the transaction being signed can grant permission or move tokens.

Some drainers rely on direct transfer transactions. Others use approvals that let another address spend a token later. A victim may not notice the damage immediately if the malicious approval is used after the first interaction.

The danger is that the victim performs the final authorization. The attacker does not need to guess a password if they can convince the wallet owner to approve a malicious action.

Modern wallet popups are improving, but prompts can still be confusing. A harmless-looking “claim,” “verify,” or “set approval” can carry very different risk depending on the contract, token, spender and chain.

• The page promises free tokens, guaranteed yield, priority refunds or exclusive access.
• The domain is new, misspelled, reached through an ad, or promoted by a recently compromised social account.
• The wallet asks for unlimited token approval, blind signing or repeated signatures.
• The site pressures you to act before a countdown ends or before “eligibility” expires.
• Other users report losses from the same contract, domain or wallet address.

1. Disconnect from the suspicious website and do not sign any follow-up transaction.
2. Use a known approval-checking tool to review and revoke risky permissions.
3. Move remaining assets to a fresh wallet if private keys or seed phrase exposure is possible.
4. Capture transaction hashes, contract addresses, website URLs, screenshots and chat handles.
5. Report the domain, addresses and incident to relevant platforms and law-enforcement channels.

• Believing disconnecting a site automatically revokes on-chain approvals.
• Signing a second transaction because the first one “failed.”
• Assuming a verified contract is safe without checking what permission is being granted.
• Sending a recovery fee to someone who says they can reverse a signed transaction.

• Token approval
• Approval-drainer permission alert
• Revoke.cash
• On-chain evidence

This page follows wallet-safety guidance and approval-review tooling references. It should be updated when major wallets change signature warnings or when new drainer patterns become common.

A wallet drainer is a malicious site, contract or approval flow designed to make a victim sign transactions or permissions that let an attacker take assets from a wallet.

CryptoRescue treats this explainer as a reader-safety page, not as a promotion or a recovery promise. The practical value is in the definition, common risks, verification steps and safer next actions. If a claim cannot be tied to a source, the page should describe it as a signal or reported pattern instead of a settled fact.

• Compare the wording on this page with the original source or official record.
• Save the exact URL, domain, support handle, wallet address or transaction hash if the topic relates to a possible loss.
• Do not pay a separate unlock, tax, AML, validator, liquidity or recovery fee without independent official confirmation.
• Use the warning checker and transaction lookup when the page mentions a service, wallet, domain or payment trail.

Wallet drainer should be read as a source-led safety reference. It does not prove that recovery is possible, that a wallet owner has been identified, or that a service is safe because one warning list has no match. Crypto cases can change quickly, so readers should check timestamps, official domains and the latest linked source before making decisions.

If this page connects to a suspected incident, build a short timeline: first contact, website, payment request, transaction hash, support route and current account state. Then use the CryptoRescue evidence kit, official report portals and exchange or wallet-provider support channels where appropriate.