Quick answer: what is a crypto wallet drainer?
A crypto wallet drainer is malicious infrastructure designed to trick a wallet user into authorising transactions, permissions or signatures that let an attacker steal assets. The victim may believe they are minting an NFT, claiming an airdrop, connecting to a genuine dapp, verifying a wallet or completing another normal action.
Wallet drainers are dangerous because the attacker does not always need your seed phrase or private key. If you sign the wrong approval or transaction, you may grant the malicious contract enough authority to move certain assets from the wallet.
The most important defence is to treat every wallet prompt as a financial instruction. Check the website, contract, network, permissions and expected outcome before approving anything.
On this page
How wallet drainers differ from seed phrase theft
Two common crypto theft routes are often confused:
- Credential theft: the attacker obtains a seed phrase or private key and directly controls the wallet.
- Malicious authorisation: the user keeps their private key secret but signs an approval, permit or transaction that creates unwanted access.
A wallet drainer can use the second route. This is why “I never shared my seed phrase” does not automatically mean every asset is safe.
For protection of recovery credentials themselves, read our Seed Phrase Security and Private Keys guides in this security pillar.
How a wallet drainer attack normally starts
The technical mechanism may be sophisticated, but the first contact is often ordinary social engineering. A user sees something valuable or urgent and clicks before checking.
Common entry points include:
- fake airdrop or token claim pages;
- impersonated project websites;
- fake NFT mint pages;
- compromised social-media accounts posting links;
- search adverts that imitate a legitimate protocol;
- fake support messages;
- Discord or Telegram direct messages;
- QR codes leading to phishing domains.
The NCSC’s phishing guidance warns that modern scams can convincingly impersonate trusted organisations and pressure users into acting quickly. Crypto drainers use exactly that behavioural weakness.
Connecting a wallet is not the same as giving away your funds
Simply connecting a wallet usually exposes the public address to the dapp and allows the site to request actions. That is different from granting token allowances or signing transactions that can affect assets.
However, connecting to a malicious site is still risky because it puts you in the attacker’s interface. The next prompt may be designed to look routine while requesting something much more powerful.
MetaMask distinguishes between disconnecting a dapp and revoking a token approval. Disconnecting stops the dapp connection; revoking an approval removes an on-chain allowance that may let a contract move tokens.
What are token approvals?
Many decentralised applications need permission to spend a token on your behalf. For example, a decentralised exchange may need an allowance so its smart contract can move the token you are swapping.
That mechanism is legitimate, but malicious sites can abuse it. MetaMask’s token approval guidance notes that users should understand what an approval grants and that malicious approvals can become an attack route.
Why unlimited approvals matter
An approval may allow a contract to spend a specific amount or a very large maximum amount. The wider the permission, the greater the potential exposure if the spender is malicious or later compromised.
Where a wallet lets you customise spending limits, consider whether the application genuinely needs unlimited access.
Signatures can also be dangerous
Not every dangerous prompt looks like a normal token transfer. Modern crypto applications use signed messages and permit-style authorisations for many purposes.
Some signatures simply prove that you control an address. Others can authorise token movement, orders or permissions. The exact effect depends on what is being signed.
The rule is not “never sign messages.” It is “do not sign a message you do not understand merely because a website tells you it is harmless.”
Transaction simulation and wallet warnings
Modern wallets increasingly display security alerts and transaction simulations. MetaMask’s current security alerts documentation says its systems can flag known phishing domains, suspicious contract behaviour, impersonation signals and transaction patterns associated with malicious campaigns.
These tools are useful, but they are not guarantees. A new malicious site may not have been identified yet, and a warning system can miss something. Treat alerts as an extra layer rather than permission to stop checking.
Typical wallet drainer red flags
Urgency
The page claims the mint, airdrop or claim expires in minutes and encourages you to skip normal checks.
Unexpected wallet prompts
You expected to connect or view information, but the wallet suddenly asks for token approval, permit or asset transfer.
Very broad spending permission
A small transaction asks for unlimited access to a valuable token balance.
Look-alike domain
The site name is one character away from the real protocol or uses an unusual domain extension.
Direct-message support
An unsolicited person offers to fix a wallet problem and sends a link.
Security warnings
Your wallet or browser identifies the website, token or transaction as suspicious or malicious.
How to check a site before connecting
- Navigate from a trusted bookmark or the project’s verified official channels.
- Read the full domain carefully, not just the logo and page design.
- Check whether the project has announced the action you are trying to perform.
- Be cautious with sponsored search results and links posted in replies.
- If your wallet shows a security warning, stop and investigate instead of forcing the transaction through.
MetaMask specifically recommends not connecting to sites that trigger its deceptive-site warning. The UK’s National Cyber Security Centre also provides a service for reporting suspicious websites.
How to read the wallet prompt
Before confirming, compare what the website promised with what the wallet is actually requesting.
- Which network are you on?
- Which account is signing?
- Is this a connection, message signature, token approval or transaction?
- Which token is involved?
- Which contract or spender is receiving permission?
- Is the spending amount limited or effectively unlimited?
- Does the estimated asset change match what you intended?
If the prompt does not match the action you thought you were performing, cancel it.
Use separate wallets for different risk levels
One practical way to reduce damage is not to use the same wallet for everything. A long-term storage wallet does not need to connect to every experimental dapp.
You might separate:
- long-term storage;
- routine DeFi activity;
- high-risk mints or experimental protocols.
Separation is not magic security, but it limits how much is exposed if one active wallet makes a bad approval.
Hardware wallets do not make malicious approvals safe
A hardware wallet is excellent at protecting raw private keys from extraction, but it will still sign a transaction that you deliberately approve on the device. If the requested transaction is malicious, secure key storage cannot change the meaning of that transaction.
Use the hardware display to verify details and combine it with careful domain and contract checks.
What to do after signing a suspicious approval
If you realise you may have approved a malicious spender, act quickly.
- Stop interacting with the site.
- Use a trusted approval-management tool or block explorer to inspect active allowances.
- Revoke the suspicious approval where possible.
- Move valuable assets to a fresh secure wallet if you believe the wallet or signing environment may be compromised.
- Check the device for malware or malicious browser extensions if the incident involved suspicious software.
Our dedicated Revoke Token Approvals article in this pillar covers the permission-removal process in more detail.
What if the wallet has already been drained?
Blockchain transactions generally cannot simply be cancelled after confirmation. If assets remain, focus on preventing further loss rather than repeatedly interacting with the malicious site.
MetaMask’s compromised-wallet guidance recommends moving remaining assets to a secure wallet and discontinuing use of a wallet whose recovery credentials are compromised. If the incident was caused only by a specific token approval, revoking that approval may stop further use of that permission, but you should investigate the wider cause before assuming the wallet is safe.
Wallet drainer prevention checklist
- I navigate to dapps from trusted sources or bookmarks.
- I check the full domain before connecting.
- I do not trust unsolicited support links.
- I read every wallet prompt before signing.
- I check token, spender and allowance amounts.
- I avoid granting unlimited approvals when they are unnecessary.
- I take wallet security warnings seriously.
- I keep long-term storage separate from high-risk dapp activity.
- I periodically review token approvals.
- I know how to respond if I sign something suspicious.
Frequently asked questions
Can a wallet drainer steal funds without my seed phrase?
Yes. A malicious approval, permit or transaction can create authority to move certain assets even when the raw recovery phrase remains secret.
Does disconnecting a website revoke its token permissions?
No. Disconnecting the wallet interface and revoking an on-chain allowance are different actions. Check approvals separately.
Can a hardware wallet stop a drainer?
It can protect private keys from extraction, but it cannot make a malicious transaction safe if you approve that transaction yourself.
Should I revoke every token approval?
Not necessarily. Legitimate dapps need approvals to work. The goal is to remove permissions you no longer need, do not recognise or do not trust.
Is every new dapp dangerous?
No, but newer or unfamiliar sites require more verification because reputation and security history may be limited.
Final thoughts
Wallet drainers exploit the gap between what a user thinks they are doing and what the wallet is actually authorising. The strongest habit is to slow that moment down.
Verify the site, understand the permission, read the wallet prompt and keep high-value assets away from unnecessary risk. For broader protection, also read our Crypto Security Guide and crypto scam and phishing guide.
This article is educational. Security alerts and third-party tools reduce risk but cannot guarantee that a transaction or application is safe.
Related Crypto Security Guides
Continue through the Simply Blockchain security library with the guides most relevant to this topic.
