Security

What Is a Wallet Drainer, and How Can Beginners Avoid It?

A wallet drainer is a malicious site or script that tricks users into connecting a wallet, signing a message, granting approvals, or sending transactions that can lead to stolen assets. They often pose as airdrop, mint, whitelist, or verification pages.

BlockVar · Updated 2026-10-09
What Is a Wallet Drainer, and How Can Beginners Avoid It?

A wallet drainer is an off-the-shelf phishing kit. Scammers put it on a fake site, get you to connect your wallet, then present a request that looks routine: a token approval, an approval for a whole NFT collection, a Permit signature or a plain transfer. Once you confirm, a script moves out everything it can. It never needs your seed phrase; it relies on the confirmation you give it.

How a drainer works

  1. It lures you to a fake page: airdrop claim sites, fake mints, search ads impersonating a project, hacked project social accounts, "official links" dropped in group chats.
  2. It asks you to connect: connecting moves nothing, but lets the page see what you hold and pick the most valuable assets.
  3. It asks for a signature or transaction: unlimited token approvals, NFT collection approvals, and offchain Permit or Permit2 signatures. MetaMask warns that offchain signatures can be used whenever the collector chooses, and signing them leaves no onchain record at the time.
  4. It drains: with the permission in hand, the script moves assets to the attacker, immediately or later.

Signs of a phishing page

  • Pressure: "30 minutes left to claim", "only a few spots remain".
  • Requests to "verify", "sync" or "repair" your wallet. Real projects never need this.
  • A domain one or two letters off the real one, or a different ending.
  • A free claim that asks you to approve USDT, ETH or NFTs you already own.
  • Several signature prompts the moment the page loads.

What to read before you sign

  1. Which site is asking: does the domain in the wallet prompt match your bookmark? MetaMask advises stopping to check if the URL is not what you expected.
  2. Transaction or signature: transactions show gas; signatures cost nothing but can still hand over control of your assets.
  3. Who gets what: on "Approve", "Set approval for all", "Permit" or "Spending cap", make sure the spender is the protocol you meant to use and check whether the amount is unlimited.
  4. Your wallet's warnings: MetaMask's security alerts are on by default and flag suspicious sites and requests, but MetaMask says they cannot catch every threat and will not stop you from going ahead.

Everyday habits that lower the risk

  • Bookmark official sites and the dapps you use, and only enter through bookmarks. Skip links in DMs, chats and search ads.
  • Keep long-term holdings in one wallet and use a separate, lightly funded wallet for new projects, claims and mints.
  • Review and revoke approvals you no longer need; see how to check and revoke token approvals.
  • A hardware wallet protects your keys, but if you confirm a malicious approval on it, the assets still go. It guards against key theft, not against what you approve.

Already confirmed? Limit the damage

  1. Revoke the approval you just gave, starting with the most valuable assets.
  2. Move what is left to a safe wallet. If you are unsure what you signed, or you typed your seed phrase into the page, treat the wallet as compromised and move to a newly created one.
  3. Note the transaction hashes and the attacker's address, report them to any exchange the funds reach, and keep the evidence.

The full order of steps is in wallet drained? what to do first.

FAQ

I only connected and signed nothing. Am I at risk?

Connecting alone moves no funds. Confirm nothing further and disconnect the site in your wallet. Disconnecting does not undo earlier approvals, though; see does disconnecting remove approvals?

Can stolen crypto be recovered?

Onchain transfers cannot be reversed. When funds reach a centralised exchange, it can sometimes freeze them, so report quickly with the transaction hash. Anyone promising "technical recovery" for an upfront fee is usually a second scam.

Further reading

Sources