What Is an NFT Drainer Scam? How Wallet-Draining Approvals Work

An NFT drainer scam is an attack where a malicious website or bot tricks a user into signing a transaction or message that grants an attacker's contract permission to transfer NFTs or tokens out of their wallet, often emptying it within seconds of the signature being approved.

Drainers became a widespread crime-as-a-service industry, with off-the-shelf drainer kits sold to scammers who then run phishing sites impersonating legitimate NFT mints, airdrops, or marketplace pages. The technical mechanism relies on standard wallet signature flows, which is exactly what makes it dangerous: the victim isn't tricked by malware, they're tricked into authorizing something themselves.

How the attack actually works

Most NFT drainers exploit one of two signature types. The first is a direct approval, using functions like approve or setApprovalForAll on an NFT contract, which grants a specified address (the attacker's contract) permission to transfer some or all of the tokens in that collection from your wallet. The second, more insidious method uses off-chain signatures like Permit or Seaport order signatures, which don't show up as an on-chain transaction until the attacker actually executes the transfer, making them harder to notice in a wallet's activity history.

Because these are legitimate signature standards used throughout /glossary/smart-contract infrastructure and NFT marketplaces, wallets can't simply block them; instead, they must warn users about what a specific signature request actually grants.

Common bait used to lure victims

Drainer scams are typically distributed through fake mint announcements on social media, compromised Discord servers posting "surprise" mint links, fake customer support accounts responding to help requests, and cloned marketplace or project websites that look identical to the real thing but point wallet connections at a malicious contract.

Urgency is the common thread: "mint ends in 10 minutes," "limited whitelist spots," or "verify your wallet to avoid delisting" are all designed to make a victim sign quickly without reading what they're approving.

How to protect yourself

Defense	What it does
Read every signature prompt	Reveals whether you're granting a transfer approval, not just "connecting"
Use a wallet with simulation warnings	Flags suspicious approvals before you sign
Revoke unused approvals regularly	Closes off dormant permissions from old projects
Separate hot and cold wallets	Limits exposure if a hot wallet is drained
Verify links independently	Avoids clicking links from DMs or compromised accounts

Many modern wallets now include transaction simulation, which shows in plain language what a signature will actually do before you approve it, such as "this will allow this address to transfer all NFTs from this collection." Treat any warning like that as a hard stop unless you fully understand and intend the action.

What to do if you've been drained

If you discover a drainer has already used an approval to steal assets, immediately revoke any remaining approvals from that wallet using an approval-checking tool, move any remaining assets to a fresh, uncompromised wallet, and avoid interacting further with the same wallet, since attackers sometimes leave additional approvals in place for a second attempt.

For a broader look at prevention, see /blog/how-to-store-nfts-safely and /blog/common-defi-scams, which cover related phishing and social engineering patterns across DeFi more generally.

Bottom line

NFT drainer scams work because they exploit legitimate wallet signature mechanics rather than a technical bug, meaning the defense is behavioral: never sign a request you don't understand, treat urgency as a red flag, and periodically audit and revoke old approvals before they can be exploited.