Wallet Drainers and Crypto Phishing

    Reviewed and updated September 18, 2026 by the SmartCryptoEarnings editorial team · editorial policy

    A wallet drainer is software that empties a crypto wallet using permission the owner granted, rather than a key the attacker stole. It is the reason a wallet can be emptied without the recovery phrase ever leaving your possession.

    Phishing in crypto has a sharper edge than elsewhere: there is no chargeback. Attacks aim either at your recovery phrase or at a signature that authorises a transfer you did not intend.

    Four different ways a wallet gets drainedThe entry point is usually similar. What the victim actually authorises is not — and the defence differs for each path.
    Entry pointContact or a convincing pageA cloned site, a fake airdrop or claim page, a sponsored search result, a hijacked project account, or a direct message. Connecting a wallet here moves nothing yet — it only reveals which assets the address holds.
    • Path A — Malicious transactionYou submit an on-chain transaction yourself. The interface describes one action; the contract performs another.
      1. A prompt appears for a mint, claim, swap or 'security migration'.
      2. The calldata is unreadable or decoded misleadingly.
      3. You confirm, pay the fee, and assets leave in that same transaction.
    • Path B — Token approvalYou grant a standing allowance. Nothing moves when you approve; the permission is what gets used later.
      1. An approval prompt requests an allowance, often unlimited.
      2. The allowance is recorded on-chain against a spender contract.
      3. The attacker's contract calls transferFrom — minutes or weeks afterwards.
    • Path C — Permit or typed-data signatureAn off-chain signature. Free, no fee, nothing on-chain at the moment you sign — which is exactly why it passes inspection.
      1. A structured signature request appears (a permit, or an order).
      2. You sign; the signature is handed to whoever asked for it.
      3. They submit it later, creating the allowance and spending it in one go.
    • Path D — Compromised key or seed phraseNo approval and no signature by you at all. The attacker holds the key and signs as you.
      1. A phrase is typed into a fake 'validation' page, photographed, stored in cloud notes, or taken by device malware.
      2. Every address derived from that phrase is under their control immediately.
      3. Automated scripts sweep balances, often the moment new funds arrive.
    Shared outcomeAssets move in a transaction you cannot reverseOnly the last stage looks the same. Revoking an approval stops Paths B and C from being used again; it does nothing for Path A or Path D, and it never reverses a transfer that already happened.

    Do not assume every incident followed one identical path. Identifying which path applies is what determines the correct response — revoke, retire the address, or abandon the wallet entirely.

    What is a wallet drainer?

    Definition: a wallet drainer is a kit — a malicious page plus a contract — that converts one approval or signature from a wallet owner into the ability to move that wallet's assets. The owner performs the authorising action themselves, usually believing they are claiming an airdrop, minting, connecting, verifying or migrating.

    The distinction from classic phishing matters. Classic phishing steals a credential: the recovery phrase. A drainer never needs one. It asks for something that looks procedural, and the permission it receives is enough.

    Drainer kits are sold and rented as a service, which is why unrelated fake sites often behave identically and why the same contract patterns reappear across campaigns. Security researchers who track these campaigns publish the specific contract addresses and domains involved; we do not name or accuse any operator without that evidence.

    The signature is the theft. By the time assets move, the attacker is only using permission that already exists on-chain.

    What the victim actually authorises

    None of these require your recovery phrase, and none of them are reversible. This is why 'I never gave anyone my seed phrase' and 'my wallet was drained' are entirely compatible statements.

    The four things a drainer typically asks for, and what each one grants.
    What you are asked to doWhat it grantsWhen assets move
    Approve a token allowanceA named spender may transfer up to a set amount of one token from your address, often unlimited.Whenever the spender chooses, until the allowance is revoked.
    Sign a typed-data permitThe same allowance, granted off-chain with no fee and no on-chain trace until it is used.When the attacker submits it — which can be much later.
    Approve all NFTs in a collectionTransfer rights over every item in that collection held by your address.Immediately after, in most reported campaigns.
    Submit a prepared transactionA direct transfer or a contract call that does the moving itself.At once, in the transaction you confirmed.

    Phishing entry points that lead to the prompt

    • Sponsored search results above the genuine site for a wallet, bridge or exchange.
    • Fake airdrop, claim, mint or 'token migration' pages promoted through replies and DMs.
    • Compromised or look-alike project accounts posting a link during real announcements.
    • Unsolicited tokens and NFTs delivered to your address, with a claim site named in the metadata.
    • Malicious browser extensions and cloned wallet apps that alter pages or requests.
    • Discord and Telegram 'verification' bots that route you to a wallet-connect page.

    Every entry point above is defeated by the same habit: reach applications through your own bookmarks, and treat anything that finds you as untrusted.

    Fake websites and fake apps

    Cloned exchange and wallet sites are reached through search advertisements, social posts, comment replies and message links. The page looks correct and asks you to 'restore', 'validate' or 'sync' your wallet, which is a request for your recovery phrase in disguise.

    Malicious apps appear periodically in mainstream app stores under familiar names. Install wallet software only from the link published in the project's own documentation, and confirm the developer name and listing history before installing.

    • No legitimate wallet ever asks you to type a recovery phrase into a website.
    • Support does not initiate contact and does not need remote access to your device.
    • A 'validation' or 'synchronization' step that requires your phrase is always an attack.

    Wallet drainers and approval abuse

    A drainer does not need your phrase. It persuades you to sign a message or grant a token approval that lets an attacker's contract move assets later, sometimes long after you have forgotten the interaction.

    Hardware wallets help, but only if you read what the device is actually asking you to sign rather than confirming reflexively.

    1. Slow down at every signature prompt and read the requested action, contract and spending limit.
    2. Refuse unlimited approvals unless you have a specific reason and you trust the contract.
    3. Use a separate wallet with limited funds for interacting with unfamiliar applications.
    4. Review and revoke stale approvals periodically using your wallet's own permissions screen.
    5. Treat unexpected NFTs and unknown tokens in your wallet as bait; do not interact with them.

    If you think a drainer already has permission

    1. Move remaining assets out of the affected address first, starting with the highest value.
    2. Open your wallet's approvals or permissions screen and revoke the allowance you granted, then the other unlimited ones on that address.
    3. Remember that an off-chain permit stays redeemable until the on-chain allowance is revoked — revoking is the only thing that cancels it.
    4. If your recovery phrase may also have been exposed, revoking is not enough: migrate to a new wallet, since every address from that phrase is compromised.
    5. Record the transaction hash, the contract address and the domain before the page disappears.

    Everyday habits that block most attacks

    • Bookmark the sites you use and reach them only through those bookmarks.
    • Read every signing prompt to the end before approving, and reject anything you did not initiate.
    • Keep a hardware wallet for long-term holdings and a hot wallet for small, active balances.
    • Turn on app-based two-factor authentication on exchange accounts rather than SMS.
    • Keep your operating system, browser and wallet software current.
    • Never store a recovery phrase as a photo, note, screenshot or cloud document.

    Frequently Asked Questions

    Is signing a message dangerous if no funds move?

    It can be. Some signatures authorize future transfers or off-chain orders rather than moving funds immediately, which is why the content of the request matters more than the absence of an amount.

    Does a hardware wallet make phishing impossible?

    No. It protects the private key, but you can still approve a harmful transaction on the device. The device screen is there to be read, not just confirmed.

    Sources

    Spotted something out of date? See our corrections policy and fact-checking policy.

    Continue reading

    Educational information only. Nothing here is financial, legal or tax advice.