Wallet drainers: how they work and how to protect yourself

How a drainer works

1. The lure. A fake airdrop, mint, "wallet verification" or hacked Discord or X account sends you to a convincing site.
2. The connection. You connect your wallet; the drainer reads your balances and picks the most valuable assets.
3. The signature. It asks you to sign something that looks routine: an approve or setApprovalForAll transaction, a Permit or Permit2 message, or a batched transaction.
4. The sweep. The attacker uses that permission to move your tokens, often within seconds, and launders them.

Most drainers are sold as a service: the developers supply the kit and take a share of the loot, while "affiliates" run the phishing campaigns.

Inferno, Angel, Pink and others

ScamSniffer's 2024 report put Angel, Pink and Inferno at the top of the market in the first half of 2024, with Inferno and Angel leading in the second half and newer kits such as Acedrainer appearing. Shutdowns rarely last: kits get renamed and resold.

Why Permit signatures are dangerous

A Permit (EIP-2612) or Uniswap Permit2 signature is an off-chain message, not a transaction. It costs no gas, so it doesn't feel like spending anything, but it authorises someone to move your tokens. The attacker later submits it on-chain.

• Permit was the most common phishing signature type in 2024, at 56.7% (ScamSniffer, Jan 2025).
• Permit and Permit2 made up 38% of losses in cases over $1M in 2025, and the year's largest single theft, $6.5M in September 2025, came from one Permit signature (ScamSniffer, Jan 2026).
• The largest single 2024 loss, $55.48M in DAI in August 2024, came from a signature that changed ownership of the victim's smart-wallet proxy (ScamSniffer, Jan 2025).

Red flags in a signing screen: the words Permit, approve, setApprovalForAll, increaseAllowance, an "unlimited" amount, a spender address you don't recognise, or a "sign in" message that contains token amounts and deadlines.

New in 2025–26: batched calls and account upgrades

Ethereum's Pectra upgrade (7 May 2025) introduced EIP-7702, which lets an address delegate to smart-contract code. Drainers use it to bundle many transfers into one signature. ScamSniffer recorded two August 2025 cases worth $2.54M in total (ScamSniffer, Jan 2026). Wintermute found that over 80% of early delegations pointed to copies of one sweeper contract (The Block, Jun 2025). Never approve an "upgrade to smart account" request that comes from a website.

How to protect yourself

• Go to apps yourself. Use bookmarks, not links from DMs, replies or ads. Hacked official accounts are common.
• Use a wallet that simulates transactions and warns about known drainer addresses. Rabby, MetaMask, Phantom and others show what will leave your wallet before you sign; read the result.
• Use a separate hot wallet for mints, airdrops and new apps, holding only what you need.
• Read the hardware wallet screen. A hardware wallet protects keys but signs what you approve. Ledger announced it would phase out blind signing in favour of Clear Signing after the December 2023 Connect Kit attack, in which a malicious library injected a drainer into dApps (Cointelegraph, Dec 2023).
• Grant exact amounts instead of unlimited approvals when an app allows it.
• Revoke old approvals regularly. See token approvals.

If your wallet was drained

1. Revoke every approval to unknown spenders immediately, using a trusted approval tool or your wallet's built-in manager. Do this even if the tokens are gone: the permission may cover future deposits.
2. If you typed your seed phrase anywhere, assume the whole wallet is compromised. Create a new wallet on a clean device and move what remains. Sweeper bots may grab incoming gas, so act quickly; do not pay "recovery" services.
3. Scan your computer for malware if you didn't knowingly sign anything.
4. Record the transaction hashes and report to police and to any exchange that received the funds.

Frequently asked questions