Phishing and wallet drainers

Nobody guessed your password. You were shown a convincing page and asked to sign something.

BeginnerAbout 9 minutesReviewed November 5, 2026

The short answer

A wallet drainer is a phishing kit. A fake website, usually reached through an ad, a hacked social account or a fake airdrop, asks you to connect your wallet and sign a request. That signature quietly gives the attacker permission to move your tokens, and a bot empties the wallet within seconds. Connecting alone doesn't move funds; the danger is what you sign next.

The rule that never changes

Legitimate support will never ask for your seed phrase (recovery phrase) or private key. Not an exchange, a wallet maker, a lawyer, the police or the FBI. Anyone who asks for it, or asks you to type it into a website, is trying to steal from you.

How a drainer attack works, step by step

The lure. A sponsored search result for your wallet or exchange, a post from a project's hacked X or Discord account, an email "from MetaMask," a DM about an airdrop or giveaway, or a token that appears in your wallet with a website in its name.
The copy. The link opens a near-perfect copy of a real site on a lookalike address: an extra word, a swapped letter, a different ending such as .app instead of .org.
"Connect wallet." This shares your public address and lets the site read your balances. It moves nothing, but now the drainer knows exactly what you hold.
The signature. The site asks you to "claim," "verify," "sign in" or "mint." The request is really one of the permissions in the table below.
The sweep. As soon as the permission is on-chain, an automated script transfers your most valuable tokens and NFTs to the attacker, often within the same minute. The kit's operators typically take a cut and the affiliate who ran the fake site keeps the rest.

What you might be signing

What the wallet shows	What it really allows
`approve` or `increaseAllowance`, often with a huge or "unlimited" amount	A contract may move that token from your wallet later, without asking again.
`setApprovalForAll`	A contract may move every NFT in a collection you own.
A "Permit" or "Permit2" message (EIP-712 typed data) with no network fee	An off-chain signature that becomes an approval when the attacker submits it. Because it's free and looks like a login, it's the most abused trick. Scam Sniffer found Permit-type signatures behind 38% of the money lost in 2025 phishing cases over $1 million.
A batch or account-upgrade request (EIP-7702) on Ethereum since the May 2025 Pectra upgrade	Can bundle several transfers or hand control of your account's behaviour to a contract in a single signature.
A plain "send" of your coins	Exactly what it says. Approvals can't take native coins such as ETH, so drainers ask for a direct transfer of those, or for your seed phrase.

Similar tricks exist on Solana and other networks, where the request is usually one transaction that moves tokens directly. Wallets increasingly simulate a request and warn "assets will leave your wallet." Treat that warning as a hard stop.

How big the problem is

The security firm Scam Sniffer counted $83.85 million stolen from 106,106 people by wallet-signature phishing in 2025, down from $494 million and 332,000 victims in 2024. The largest single 2025 loss, $6.5 million in September, came from one Permit signature. The drop is real but the kits are still active, and these totals exclude bigger thefts such as the $1.5 billion Bybit hack. The FBI's IC3 logged more complaints about phishing and spoofing than any other crime in 2025: 191,561.

Warning signs

You arrived from an ad, a DM, a reply under a post, or a link in a Discord or Telegram announcement.
Urgency: a mint that "ends in 10 minutes," a claim that "expires today," a "security upgrade" you must sign now.
A free "sign in" or "verify" message that contains the words permit, spender, value or deadline.
Any approval for a token the action doesn't need, or for an unlimited amount.
Your wallet's simulation shows tokens leaving, or it flags the site as dangerous.
The site asks for your seed phrase to "sync," "validate" or "restore." Always a theft.

How to check and revoke token approvals

Old approvals are a standing risk: if a contract you once approved is later hacked, or was malicious all along, it can still move those tokens. Review them every few months.

Open an approval checker by typing its address. Two widely used ones are revoke.cash and Etherscan's Token Approval Checker. Fake "revoke" sites exist, so never follow a link someone sends you.
Paste your wallet address to look. Viewing approvals doesn't require connecting anything.
Check each network you use. Approvals are separate on Ethereum, Base, Arbitrum, BNB Chain and so on.
Look for unlimited amounts and spenders you don't recognize or no longer use, including NFT "approval for all."
Revoke. Connect the wallet that gave the approval and confirm the revoke. It is an ordinary transaction, so it costs a small network fee.

What revoking can't do

Revoking stops future use of a permission. It doesn't bring back tokens already taken, and it may not cancel a Permit signature the attacker hasn't submitted yet. If you signed something suspicious, the safe move is to send everything that's left to a brand-new wallet.

How to protect yourself

Reach sites through bookmarks you saved yourself, never through search ads.
Keep savings in one wallet that never connects to new sites, and use a separate "hot" wallet holding only what you need for minting, claiming or trading.
Use a hardware wallet and read the request on its screen. Avoid "blind signing" requests the device can't decode.
Set a custom spending cap instead of accepting unlimited approvals.
Run through the before-you-connect checklist the first time you use any new site.

If it happened to you

Move what's left now. Create a new wallet with a new seed phrase on a device you trust and send any remaining assets to it, most valuable first. Don't wait to see what happens.
Revoke the approval you gave, using the steps above, but don't rely on it instead of moving funds.
Write everything down before anything gets deleted: wallet addresses, transaction IDs (hashes), website addresses, usernames, phone numbers, screenshots of chats, dates and amounts.
Report it to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. Reports are free. If funds land at a regulated exchange, law enforcement can sometimes freeze them, and speed matters. A local police report gives you a reference number for your bank or insurer.
Contact the exchange you sent from, and the receiving exchange if the blockchain shows one, through its official website or app (never a number or link from a search ad or a stranger). Ask them to flag the addresses and the transactions.
Expect a second scam. Victims are targeted again by fake "recovery" firms, fake lawyers and fake FBI agents. Real law enforcement never charges a fee. Read crypto recovery scams.

Need the steps in order? Use the emergency checklist for a compromised wallet or account.

Frequently asked questions

Can a website steal my crypto just because I connected my wallet?

Connecting alone shares your address and balances but can't move funds. Theft happens when you then sign an approval, a permit or a transfer. Still, disconnect sites you don't use.

What is a wallet drainer?

A ready-made phishing kit that criminals rent out. It builds fake sites, works out which of your tokens are most valuable, asks for the right signature and moves the funds automatically.

What is a permit signature?

An off-chain message, defined in standards such as EIP-2612 and Uniswap's Permit2, that authorizes someone to spend your tokens. It costs no fee to sign, which is why scammers disguise it as a login.

Does revoking an approval cost money?

Yes, a small network fee, because revoking is an on-chain transaction. Looking at your approvals is free.

I clicked a phishing link but didn't sign anything. Am I safe?

Probably, if you signed nothing and typed no seed phrase. Close the page, don't download anything it offered, and check your approvals to be sure.

Where to next

ChecklistBefore connecting a wallet RelatedAddress poisoning EmergencyMy wallet is compromised

Sources

Written for beginners and checked against the sources listed. Last reviewed November 5, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.