Wallet drainers: how they empty wallets and how to stop them

What a drainer kit does

A drainer is not one contract or one scammer. It is usually a kit sold or rented to criminals: a fake site template, code that reads your wallet’s balances, signatures that request the right permissions, and scripts that submit theft transactions the moment you approve them. The operator does not need to understand the chain deeply because the kit handles the sequence.

That is why so many incidents look alike. The site offers an airdrop, migration or support action, your wallet connects, the page identifies valuable tokens and NFTs, and then it serves whichever request gives the fastest path to moving them.

The main ways wallets get emptied

• Approval abuse. The victim signs approve for an ERC-20 token or setApprovalForAll for an NFT collection. The attacker then calls transferFrom or transfers the NFTs away.
• Permit abuse. The victim signs a gasless permit or Permit2 message. The attacker submits it on-chain together with the theft.
• Direct transactions. The victim signs a transaction that sends ETH or tokens straight to the attacker, often disguised as a claim, bridge or swap.
• Delegation abuse. With EIP-7702, a victim can authorise code that then acts with the account’s authority. A malicious delegation is closer to handing the wallet over than to signing in.

The details differ by chain and wallet, but the important fact is that the drainer is using permissions you gave it. The blockchain usually sees an authorised action, not a hack that a network validator can reverse.

What to do in the first ten minutes

1. Stop interacting with the site. Do not click Retry, Revoke or Help on the same page.
2. From a trusted route, check token approvals and revoke any fresh approval you did not mean to give. Start with high-value tokens.
3. Check wallet health for suspicious delegation or broad approval exposure. If it flags an active delegation you did not intend, treat the wallet as compromised.
4. Move remaining assets to a clean wallet you already control. If you suspect the old wallet’s seed phrase may also have been exposed, create a completely new wallet with new backup words.
5. Save evidence now: URL, screenshots, raw signature request, transaction hashes, token contract addresses and chat messages.

What comes after the first ten minutes

Once the immediate risk is under control, work through what the wallet touched. Check each chain separately because approvals and delegations are chain-specific. NFTs, liquidity pool tokens and obscure airdropped tokens are easy to forget in the rush.

• Review browser extensions and remove ones you do not recognise.
• Disconnect the wallet from sites in the wallet’s connection list, although this does not cancel on-chain approvals already granted.
• Tell any exchange where the stolen funds may arrive, with the transaction hashes. Exchanges sometimes freeze accounts they control.
• Report the site to the wallet maker, search engine, hosting provider, Discord or Telegram server, and your national fraud reporting channel.

How to make drainers far less effective

• Keep a small hot wallet for testing new apps and a separate wallet for savings that never approves anything.
• Prefer exact token approvals over unlimited ones, and review them regularly.
• Read every request on the hardware wallet or wallet screen itself, not only on the page behind it.
• Use the signature decoder whenever the wallet prompt is not obvious.
• Be suspicious of “free claim” pages, support links in DMs and search adverts that sit above the result you expected.