Wallet Drainer

Definition: A wallet drainer is a malicious website, script, contract, or coordinated phishing service designed to take cryptocurrency or NFTs from a user’s wallet. Most campaigns do not break the blockchain or remotely open a wallet. They try to make the owner reveal a recovery secret or approve or sign a request that gives an attacker permission to move assets.

How a Wallet Drainer Works

A campaign may use a fake claim page, impersonated social account, sponsored link, compromised website, or unsolicited NFT as a lure. Connecting a wallet usually reveals a public address and lets a site request actions; the connection alone is not the same as an on-chain asset permission. The risk rises when a user enters a recovery phrase or confirms a transaction, token approval, NFT operator authorization, or off-chain signature they do not understand.

After an authorization is granted, the attacker may use the permission in a later transaction. A page may also request an immediate transfer or signature that enables one. In some campaigns, a drainer toolkit automates the phishing page and transaction flow, while different operators handle the lures. The exact implementation varies, so “wallet drainer” names a class of theft campaigns rather than one specific contract or product.

Common Routes to Asset Loss

• Token allowance: A user may approve a malicious spender, or an old approval may become risky after a contract is compromised. This is one form of token approval exploit. A spender can only use the permission’s scope and the relevant token contract’s behavior.
• Misleading signature: A request presented as a login, claim, listing, or routine confirmation may actually authorize a token permit or NFT order. Some valid off-chain signatures can be submitted later, so a request may not produce an immediate transaction in the wallet history.
• NFT operator approval: A user may be tricked into granting a contract permission to manage one NFT or a wider collection. The request’s scope matters; a legitimate marketplace also needs permissions to list or transfer assets the user chooses to sell.
• Recovery-secret theft: A fake support page or wallet form may ask the user to type a recovery phrase. Anyone who gets that secret can control the wallet without relying on an approval from the original device.

Receiving or viewing an unsolicited NFT does not by itself grant a stranger permission to transfer other assets. The common risk is that its image or metadata points to a fraudulent site, where the visitor is asked to disclose a secret or sign a harmful request. Likewise, a wallet connection is different from an approval: disconnecting the site does not revoke an on-chain allowance that was already granted.

Reducing Risk and Responding

• Reach projects through a known bookmark or independently verified official site. Do not use unexpected claim links in messages, ads, comments, or NFT descriptions.
• Never enter a recovery phrase into a website, support chat, form, or unsolicited app. Legitimate support does not need the phrase.
• Read the network, recipient, token, amount, spender, and permission scope shown by the wallet. If the request is unclear, unexpected, or broader than the action requires, do not sign it.
• Review and revoke unwanted approvals through the correct network’s official explorer or another carefully verified tool. Revocation requires a separate transaction and cannot reverse a transfer that already happened.
• If you exposed a recovery phrase or private key, revoking approvals alone is not enough; treat that wallet as compromised and protect remaining assets from a newly generated wallet. Be wary of strangers who promise to recover stolen funds.

Transaction previews, wallet warnings, and clearer signing standards can help people recognize a request, but support differs by wallet and application. They do not guarantee that every malicious site or authorization will be detected. The best check remains understanding the specific action before approving it; a hardware wallet adds a signing step but cannot turn a harmful request into a safe one. See crypto phishing for the broader deception tactics often used to attract victims.

Social Media Sentiment

• r/CryptoScams: One help thread listed by Reddit as about three months old when checked on October 22, 2026, describes a user unsure how a MetaMask wallet was drained. A few replies discuss possible existing approvals and whether the wallet should still be used, but the thread does not establish the cause or show how common this experience is. Read the discussion.

Last updated: 2026-10

Related Terms

• Token Approval Exploit
• Crypto Phishing
• Hardware Wallet Security

See Also

• Why Calling It a “Wallet” May Have Been Crypto’s Biggest Mistake
• The Drift Protocol Hack Wasn’t a Hack. It Was a Six-Month Con.
• Why Smart Contract Audits Fail: What Post-Mortems Reveal About the Limits of Security Reviews
• Swap crypto with ChangeNOW

Sources

• NFT Airdrop Scams — MetaMask explains how unsolicited NFT metadata can lure users to phishing pages that request a recovery secret or malicious transaction.
• Signature Phishing — MetaMask documents how deceptive off-chain signatures can authorize token permissions or NFT listings and later be used to take assets.
• ERC-20: Token Standard — The specification defines the allowance and transfer functions that some drainer campaigns try to misuse.
• ERC-721: Non-Fungible Token Standard — The NFT standard describes token approvals and collection-wide operator permissions that users should distinguish when reviewing a request.
• How to revoke smart contract access to your crypto funds — Ethereum.org explains that allowance revocation is a separate network transaction and cannot undo a transfer already completed.