Most drainer victims have the same story: they clicked something that looked normal, signed a transaction that looked normal, and later that day (or week) their wallet was empty. There was no hack. No one cracked their private key. The wallet did exactly what they told it to do.
Understanding that single fact — that drainers use your permission, not your key — is what actually protects you going forward.
What a Wallet Drainer Actually Is
A "wallet drainer" is a pre-built kit — malicious smart contracts plus a phishing front-end — that scammers lease or buy from drainer-as-a-service operations. Groups like Inferno Drainer, Pink Drainer, and their successors account for the bulk of drainer-based theft. The operators take a cut; affiliates buy traffic and point victims at the dapp.
The kit doesn't "hack" anything. It presents a website that looks like a legitimate claim page, mint page, or token swap, and it tricks the user into signing one of a handful of standard Ethereum transactions — each of which, once signed, hands the attacker legal control of specific assets under ERC-20 or ERC-721 rules.
The Three Signatures Drainers Rely On
Almost every drainer falls into one of three transaction patterns. If you learn to recognize these in your wallet's signature prompt, you can stop every one of them.
1. approve() on an ERC-20 token
This is the classic. Every ERC-20 token has an approve(spender, amount) function. Signing it does not move your tokens — it grants spender the right to move up to amount of them out of your wallet at any time in the future.
Drainers ask for amount = 2^256 - 1, the maximum possible. Your wallet UI often displays this as "Unlimited." Once signed, the attacker calls transferFrom() and pulls every token out — minutes later, or days later when they think you've forgotten.
2. setApprovalForAll() on an NFT collection
The NFT equivalent. A single signature grants the spender permission to transfer every NFT you own from that collection — now or in the future. High-value NFT holders have lost entire collections to a single careless signature on a fake mint page.
3. Permit / Permit2 signatures
Permit signatures are gasless approvals: they're off-chain messages that act exactly like an on-chain approve() once presented to the chain. Because there's no gas prompt, wallets sometimes display them with less prominent warnings, and victims sign thinking it's a harmless login. It is not. A signed Permit is a cocked gun pointed at the named token balance.
owner, spender, value, nonce, and deadline — that's a Permit. Do not sign it unless you specifically understand what you're approving and why.
Why Hardware Wallets Don't Save You
A common misconception: "I use a Ledger, so drainers can't touch me." Hardware wallets protect the private key from being extracted. They don't stop you from using the key to sign an attacker's transaction.
If you press the button on your Ledger to confirm an approve() call to a drainer contract, the transaction is signed with the same authority as if you were doing it yourself. The hardware wallet was not compromised. The user was.
What a hardware wallet does give you is the chance to read the transaction on a second screen, outside the infected browser's influence. That chance is only useful if you actually read it. Most victims click confirm without looking.
The Delivery Vectors
Drainer front-ends reach users through a predictable set of channels:
- Google Ads — paid search results impersonating major dapps (Uniswap, PancakeSwap, Lido) at lookalike domains. Still a top vector despite years of reporting.
- Hijacked Discord and X accounts — compromised project accounts tweeting a "surprise airdrop" linking to a drainer.
- Fake airdrop emails — personalized drops to addresses scraped from public on-chain activity.
- Lookalike domains —
uniswap-claim.xyz,metamask-support.io, and so on. Punycode homograph attacks still work on mobile wallets. - Malicious PDF attachments and fake wallet update prompts delivered through Telegram or LinkedIn messages. See our breakdown of the malicious PDF crypto attack vector.
The common thread: urgency plus a one-click action. "Claim before it expires." "Verify your wallet." "Your account will be locked."
How to Audit What You've Already Approved
This is the single most valuable habit in crypto security, and almost no one does it. Any address you've ever used has an approval history you can inspect. Outstanding approvals are landmines — most users have dozens of them sitting open from dapps they used once and forgot.
Tools that show your outstanding approvals
- Revoke.cash — multi-chain, shows ERC-20 and NFT approvals, lets you revoke directly.
- Etherscan's Token Approvals page — free, chain-specific, precise. Works for any EVM chain that has its own Etherscan-family explorer.
- Your wallet's built-in approval manager — MetaMask Portfolio, Rabby, and Phantom all expose this natively now.
What to revoke first
- Any "Unlimited" approval to a contract you don't recognize. Recognition matters: a Uniswap router is fine. A random contract with no verified code is not.
- Any approval to a dapp you haven't used in 90+ days. Stale approvals are free optionality for an attacker if the approved contract is later exploited.
- All
setApprovalForAll()permissions on NFT collections. These should be revoked the moment you're done with the marketplace action that needed them.
How to Read a Transaction Before Signing
MetaMask, Rabby, and hardware wallet screens all show the transaction decoded before you confirm. Three things to check, every time:
- Function name. Is it
approve,setApprovalForAll,permit, ortransfer? If it's any of the first three, ask yourself whether you actually want this contract to have power over your tokens. - Spender address. Is it a contract you recognize? Paste it into Etherscan. Does it have verified source code? Is it labeled as a known protocol router? If it's unverified or anonymous, stop.
- Amount or token set. For
approve, is the amount "Unlimited" or a specific figure? For NFTs, does it cover a collection you own?
Wallets like Rabby and newer MetaMask builds now include simulation previews — they'll show you what the transaction is expected to do to your balances before you sign. Enable this. If the preview says "wallet will lose 100% of USDC balance," that's the warning you need.
What to Do If You've Already Signed
Speed matters — but the order matters more. Doing the wrong thing first can make the situation worse.
- Do not send gas money to the drained wallet. Drainer operators run sweeper bots that monitor compromised wallets — fresh ETH or BNB gets pulled out within seconds. Any new funds you send will be stolen too.
- Move any assets they haven't yet taken. If there are tokens they didn't get approval for (like an unrelated LP position, or a token with no active approval), move them from a different wallet paying the gas. A dedicated "rescue" service or a friend's wallet works for this.
- Revoke every outstanding approval on the compromised address, to shut down future draining of newly-deposited tokens.
- Retire the wallet. Once a seed phrase is tied to a drained address, treat it as burned. Generate a new wallet on fresh hardware, and never deposit to the old one again.
- Get transaction hashes for the drain and the hops that followed. This is what a forensic investigator needs if any portion of the stolen funds might be recoverable — especially if they land at a centralized exchange. See our guide on when stolen crypto can actually be recovered.
Long-Term Setup That Makes Drainers Irrelevant
No amount of vigilance beats structural defense. If you interact with dapps regularly, set up your wallet architecture so a single signing mistake can't empty your holdings.
- Hot wallet + vault wallet. Keep the bulk of your holdings in a cold wallet address that you never connect to any dapp, ever. Bridge a small working balance to a hot wallet for interaction. Losses are capped at the hot wallet's balance.
- Per-chain or per-purpose wallets. Separate wallets for DeFi, NFTs, and long-term holdings. An approval phishing hit on one doesn't touch the others.
- Hardware wallet for anything material. The hardware doesn't stop the signature — but it forces a deliberate physical confirmation, which is exactly the friction that breaks a careless click.
- Smart wallets / account abstraction. ERC-4337 wallets support session keys, spending limits, and transaction simulation as first-class features. For active DeFi users, this is the direction the tooling is moving.
The Bottom Line
Wallet drainers don't win because they're sophisticated. They win because a signature prompt is a UX surface that users have trained themselves to click through. The defense is unglamorous: read the transaction, audit your approvals monthly, and put your serious holdings behind an address that never signs anything.
If you've already been hit, move fast, don't send gas to the compromised address, and get tracing done while the funds are still on their first few hops. Once funds land at a centralized exchange with KYC, a proper forensic report is sometimes enough to trigger a freeze.