Wallet drainers: how they work and how to protect yourself

A wallet drainer is a phishing kit sold to scammers as a service. The scammer brings the traffic (a fake airdrop post, a hacked Discord, a search ad); the kit provides a convincing copy of a real dApp and the code that empties the visitor's wallet. The developer takes a cut of everything stolen, often 20–30%.

Drainers don't need your seed phrase. They need one signature. This guide shows what that signature looks like, how to spot a drainer before you sign, and what to do if it's too late.

How a drain happens, step by step

1. The lure. A post promises a claim, a mint, a refund or a "wallet validation". It's often posted from a real, hacked account, so the source looks trustworthy.
2. Connect wallet. The page asks you to connect. Connecting alone doesn't move funds, but it lets the kit read your balances and pick what to steal first.
3. The ask. The kit sorts your assets by value and asks for the signature that unlocks the biggest one: a token approval, an NFT setApprovalForAll, a Permit2 or EIP-2612 permit, a marketplace listing for 0 ETH, or on Solana a transaction that transfers tokens or reassigns token-account ownership.
4. The sweep. As soon as the signature lands, a bot moves the assets, usually within seconds, and swaps them so they're harder to trace.

The signatures drainers ask for

• approve / increaseAllowance with an unlimited amount to an unknown address.
• setApprovalForAll on your NFT collection: one click gives away every NFT in it.
• Permit signatures. A gas-free "Sign message" with typed data that mentions Permit, a spender and a deadline. It looks like a login, but it's an approval.
• Fake marketplace orders. A Seaport or Blur order selling your NFT for nothing.
• Solana transactions with extra instructions bundled in, such as a token transfer or a SetAuthority that changes who owns your token account.
• EIP-7702 delegations (since Ethereum's 2025 Pectra upgrade): a signature that lets a smart contract act as your account. Only ever sign these in your wallet's own settings, never on a website.

Red flags before you sign

• Urgency and free money. "Claim in the next 30 minutes", "you're eligible for 2,400 tokens".
• The domain isn't quite right. Read it from right to left; the real domain is the last two parts. Run any link through the phishing link checker.
• A "sign in" that costs nothing but mentions a spender. Real sign-ins (Sign-In with Ethereum) don't contain token addresses or amounts.
• Your wallet shows a warning or a failed simulation. Rabby, Phantom and MetaMask's security alerts simulate the transaction and flag known drainers. Don't override them.
• Support DMs. Real teams don't DM first. Anyone offering help in DMs is a scammer.

Set up your wallets so a mistake costs less

• Two wallets minimum. A "hot" wallet for mints, airdrops and new dApps with only what you need that day, and a vault wallet (ideally a hardware wallet) that only ever interacts with a few protocols you trust.
• Keep approvals short. Approve exact amounts, and review and revoke old token approvals regularly.
• Bookmark the dApps you use and open them from bookmarks, never from chat links or ads.
• Install a phishing blocker. GuardSmith Shield checks every site you open against the MetaMask and ScamSniffer lists locally and warns before you connect.

If you've been drained

Act in this order. Minutes matter, because drainers often keep watching a wallet and take new deposits.

1. Stop using the wallet. Don't send more funds to it, even to pay for gas, unless you're sure what will happen to them.
2. Create a new wallet with a new seed phrase on a device you trust, and move anything that's left. If the attacker has your seed phrase, assume everything in that wallet, on every chain, is exposed.
3. Revoke approvals for anything still in the old wallet using the approval checker. If you can't afford the gas, ask a friend to send a small amount and revoke immediately.
4. Write down the facts: transaction hashes, the scam domain, the drainer address, screenshots of the post that lured you.
5. Report it: to the wallet provider, to the platform where the link was posted, and to ScamSniffer or the MetaMask phishing list (the domain gets blocked for everyone). Report to your local police or cybercrime unit too; it's often needed for exchanges to act.
6. Ignore recovery offers. "Fund recovery" services and "blockchain investigators" who contact you are almost always a second scam.

Moderating a crypto Discord? Protect your members

Most drains start with a link in chat. In your server, turn on link filtering and anti-raid, lock down who can post in announcement channels, and warn members that the team never DMs first. GuardSmith does this with AutoMod rules for invite and scam links, a numbered case log and anti-raid lockdowns.