A wallet drainer is a smart contract that steals your tokens in a single transaction the moment you sign a malicious approval. You do not lose your seed phrase. You do not need to download malware. One wrong click on a phishing site is enough to lose everything in your wallet.
How a drainer works
The attack has three steps:
- You visit a phishing site that mimics a legitimate NFT mint, DeFi protocol, or airdrop claim.
- The site prompts you to connect your wallet and sign a transaction or message.
- You sign. The drainer contract executes, sweeping your tokens to the attacker’s address.
The theft takes one block - typically under 15 seconds on EVM chains. By the time you realize something is wrong, the funds are gone and moving through mixers.
Signature types that drain wallets
Not all signatures are equally dangerous. Understanding the difference protects you.
permit signatures are the most dangerous. ERC-2612 added a permit() function to popular tokens (USDC, DAI, WETH, and others). Signing a permit gives a contract approval to spend your tokens without an on-chain transaction. It looks like a free “sign a message” popup - no gas cost, no transaction visible in your wallet. But the permit can be submitted on-chain by the attacker afterward and sweep your entire balance.
setApprovalForAll is the NFT equivalent. Signing this message gives a contract permission to transfer any NFT in your wallet, not just one specific item. Legitimate NFT marketplaces use this, but the same signature type is what drainers request.
approve with unlimited amount is a standard ERC-20 approval for type(uint256).max. It gives one contract unlimited access to one token forever. If that contract is malicious or later gets exploited, everything in that token is at risk.
Malicious multicall bundles multiple operations into one transaction. You see one signature request; the transaction actually calls permit, transfers all your ETH, and calls setApprovalForAll simultaneously.
Where drainer attacks come from
Phishing sites
A compromised or typosquat domain is the most common delivery. Attackers register domains one character off from legitimate projects (uniswop.org, opensea.io spelled differently, free-nft-mint.io) and copy the site design exactly.
They drive traffic via:
- Paid search ads targeting the project name.
- Compromised Twitter accounts with large followings posting “exclusive mint” links.
- Discord DMs from accounts impersonating project staff.
- Telegram bots sending “you’ve been selected for an airdrop” messages.
Compromised legitimate sites
In 2024 and 2025, several legitimate DeFi front-ends had their DNS hijacked or their CDN-hosted JavaScript replaced. Visitors to the real domain got a drainer injected. This is harder to detect because the URL is correct.
Malicious dApp connections via WalletConnect
WalletConnect URI codes can be shared via QR or link. A fake “connect your wallet” prompt using a malicious WalletConnect URI sends your session to an attacker’s relay who can then propose transactions.
How to recognize a drainer attempt before you sign
Read the signature request. MetaMask, Rabby, and modern wallets decode signature requests and show what you are authorizing. For a permit, it shows: token, spender address, amount, and expiry. If the spender is an unknown contract and the amount is “unlimited,” do not sign.
Check the contract address. Before signing anything on a new site, look up the contract address the transaction is targeting. Etherscan labels known contracts. An unknown contract with no Etherscan label, deployed recently, with no source code verified, interacting with your wallet is a major red flag.
Match the site URL to the expected URL. Look at the actual domain in your browser, not the title bar of the page. Attackers use Unicode lookalike characters and subdomains to appear legitimate (app.uniswap-io.com vs app.uniswap.org).
Rabby wallet’s simulation. Rabby simulates transactions before you sign and shows the net change to your wallet. If a “free claim” results in your wallet losing tokens, the simulation exposes it.
Practices that actually reduce risk
Use a separate wallet for new interactions. Keep a hot wallet with only what you need for that session. Your main holdings stay in a cold wallet that you never connect to web apps.
Revoke approvals regularly. Use Web3defender’s approval scanner to audit what contracts have access to your tokens. Revoke anything you do not recognize or no longer use. An old approval from a protocol that was later exploited is a standing theft risk.
Never sign permits on sites you did not navigate to yourself. If a link took you there - from Discord, Telegram, a search ad - close the tab and navigate directly to the official URL.
Check approvals before any transaction on a new protocol. Before clicking “confirm,” verify what the transaction is actually doing. “Approve” plus “swap” in one transaction is normal. “Approve all,” “setApprovalForAll,” or any permit that you did not expect is not.
Hardware wallets reduce risk, they do not eliminate it. A Ledger or Trezor still signs whatever you tell it to sign. Approving a malicious permit on a hardware wallet drains you just as effectively as on a software wallet. The hardware wallet protects your seed phrase, not your judgment.
What to do immediately after a drainer hits
- Do not send more funds to the compromised wallet. Attackers sometimes watch drained wallets for refills.
- Revoke all remaining approvals immediately using Revoke.cash or Web3defender’s approvals tool.
- Transfer any remaining assets to a different wallet before the attacker’s sweep bot catches them.
- Document the attacker’s address and the malicious contract and report both to Etherscan, the relevant chain explorer, and the project being impersonated.
- File a report with your national cybercrime reporting body. Recovery is unlikely but reporting supports pattern analysis.
The money from a drainer attack is almost never recoverable once it has moved through a mixer.
FAQ
Can a drainer steal from a hardware wallet? Yes. Hardware wallets protect your private key. They do not protect you from signing a malicious transaction. If you approve a drainer contract on a Ledger, it drains you. Read every signature request before confirming.
What is the safest way to participate in new NFT mints? Use a dedicated minting wallet funded with only the ETH you need for that mint. Never mint from a wallet that holds significant assets. After the mint, move the NFT to cold storage before connecting anywhere else.
Do permit-type signatures expire?
They can. The deadline field in a permit signature sets an expiry. However, attackers set very long deadlines - often years. Even if you signed a permit and did not notice, the attacker can submit it at any time before the deadline.