What Is a Crypto Drainer? How Wallet-Draining Scams Work

A crypto drainer is malicious software, usually delivered through a fake website or app, designed to trick a user into signing a single transaction or message that grants the attacker permission to transfer the wallet's assets — after which the attacker's script sweeps out tokens, NFTs, and sometimes native currency automatically, often within seconds.

Drainers have become one of the dominant scam categories in crypto because they scale efficiently: a single well-built drainer kit can be deployed across hundreds of fake sites and pointed at any wallet that connects. Unlike a rug pull, which targets people who invest in a specific fraudulent token, a drainer can hit anyone who connects a wallet to the wrong site, regardless of what they were trying to do.

How a drainer actually works

Drainers don't hack a wallet directly — private keys and seed phrases stay secure on the user's device the entire time. Instead, they exploit the fact that interacting with any smart contract or dApp requires signing something, and most wallet interfaces don't make the consequences of a signature obvious to non-technical users.

A typical drainer attack follows this pattern:

1. Lure. The victim is directed to a convincing fake site — often via a phishing link, a compromised social media account, a fake "airdrop claim," or a cloned NFT minting page.
2. Connect. The victim connects their wallet, which by itself is usually harmless — it only shares the public address.
3. Sign. The site prompts a signature request disguised as something routine: "verify wallet," "claim reward," or a transaction that looks like a normal mint. In reality, the request is often a permit signature (an off-chain approval mechanism used by many ERC-20 tokens) or a setApprovalForAll request for NFTs — both of which grant broad transfer rights without needing a second on-chain transaction.
4. Drain. The attacker's backend detects the signed approval and immediately submits the actual transfer transaction, moving valuable tokens and NFTs out of the wallet, often within seconds and often automated to prioritize the highest-value assets first.

Because the signature itself doesn't cost gas and doesn't look like a fund transfer, many victims don't realize what they've authorized until the drain has already happened.

Drainer-as-a-service

Much of this activity is now run through drainer-as-a-service operations: developers build and maintain a drainer kit — the phishing site templates, the smart contracts, the backend that detects and executes drains — and rent it out to affiliates for a cut of stolen funds, commonly reported in the 20–30% range. This division of labor means the person running a specific scam site may have little technical skill of their own; they're a distributor for a kit built and maintained by someone else, which has made drainer attacks far more common and harder to trace to a single source. This mirrors the broader professionalization of scam infrastructure discussed in our common DeFi scams overview.

Why drainers are so effective

Wallet interfaces historically showed signature requests as walls of unreadable hexadecimal data, or with generic descriptions that don't clearly convey "this grants unlimited transfer rights over your USDC." Newer wallets have improved simulation and readable-request features, but many users still click through prompts quickly, especially under the time pressure a fake "limited time" claim creates. Combine that with the fact that a single signature — not a series of obviously suspicious actions — is enough to trigger a full drain, and the attack requires very little from the victim to succeed.

Drainer attack vs. traditional hack

Attribute	Wallet drainer	Traditional exchange hack
Target	Individual wallet, via signature	Centralized platform's hot/cold storage
Victim action required	Sign one malicious message/transaction	None — victim's funds held by platform
Speed	Often seconds after signing	Varies
Root cause	Social engineering + approval mechanics	Platform security failure

Protecting yourself

Never sign a request you don't fully understand — if a wallet prompt's purpose isn't clear, stop and research it before continuing, rather than approving out of habit. Use a wallet that simulates transactions and explains signature requests in plain language before you approve. Bookmark real dApp URLs rather than clicking links from search ads, DMs, or unsolicited messages (see our guide on identifying fake crypto websites). Regularly review and revoke standing token approvals using an approval-checking tool, since a drainer that only gets a limited approval rather than unlimited access does much less damage. Our deeper walkthrough on how wallet drainer scams steal funds traces a real attack flow step by step, and general DeFi wallet security practices cut across nearly every scam type in this category.

Bottom line

A drainer succeeds because of a signature, not a hack — your private keys never need to be exposed. That means the entire attack is preventable by reading and understanding what you're signing, using tools that decode requests in plain language, and keeping token approvals minimal and current. Treat every unexpected signature prompt as a potential drain attempt until you've verified otherwise.