DeFi Market
A wallet drainer is a piece of scam software, usually rented out as a kit, that empties a crypto wallet after its owner signs one request on a fake website. It doesn't need your password or your seed phrase. It needs your signature on an approval or a "Permit" message that hands a stranger the right to move your tokens. Scam Sniffer counted $83.85 million taken this way in 2025. If a site you reached from a link asks you to sign something you can't read, close the tab.
What is a wallet drainer?
Think of it as a burglary kit sold by subscription. Someone writes the code once: a fake website template, the scripts that talk to your wallet, and the back end that sweeps tokens to the thief the moment you sign. Then they rent it to other criminals, who bring the victims. Check Point Research described this drainer-as-a-service model in 2023, with the kit's authors taking a percentage of each theft. It reported that one kit, Inferno Drainer, had helped steal more than $80 million before its operators claimed to shut it down.
They didn't stay shut. In May 2025 Check Point published "Inferno Drainer Reloaded", which estimated that more than 30,000 people had lost over $9 million to the same kit in the previous six months. The lure was clever. People clicking a Discord link on a real project's website landed on a fake copy of Collab.Land, a verification bot that really does ask for a wallet signature. Because they expected a signature, they signed.
That's the whole trick in one example. A drainer doesn't break your wallet. It gets you to use your wallet against yourself.
How a crypto wallet drainer works, step by step
Every drainer runs the same four moves. The website changes. The order doesn't.
1. The lure. You get to the site through a link: a post from a hacked or cloned project account, a search ad, a Discord message, a "you've been airdropped" token. The FBI warned in an August 2023 public service announcement that criminals pose as NFT developers, announce a "surprise" mint with "limited supply," and send people to a spoofed site. Victims who connect, it said, end up sending their crypto and NFTs to criminal wallets through a drainer smart contract.
2. The connection. You click "Connect wallet." This part, on its own, shares your public address and nothing else. But it lets the kit look up what you hold, so it can ask for the most valuable thing first.
3. The signature. Your wallet pops up a request. It might be dressed as "sign in," "claim," "verify" or "mint." What it really says is that a contract or address you've never heard of may spend your tokens.
4. The sweep. The kit uses that permission straight away and moves the tokens to the thief, often splitting the haul so the renter and the kit's author each get their cut.
The requests a drainer asks you to sign
Most drainer losses come from a handful of request types. Learn what they look like and you'll recognize most drainers on sight.
| Request | What your wallet may show | What it actually does |
|---|---|---|
| Token approval (approve) | "Allow this site to access your USDT," often with an unlimited amount | Lets a contract move that token from your wallet whenever it wants |
| NFT approval (setApprovalForAll) | "Give permission to access all of your NFTs" in a collection | Lets a contract take every NFT in that collection, now or later |
| Permit signature | A text message to sign with fields like spender, value, nonce, deadline. No gas fee | An off-chain approval. The thief submits it later and pays the gas |
| Permit2 signature | "PermitSingle" or "PermitBatch" with a spender and an expiry | Grants spending rights through a shared approval contract, sometimes for several tokens at once |
| Blind or unreadable signature | A long string of letters and numbers, or a warning that the request can't be decoded | Could be anything, including a transaction you can't see |
| Account delegation (EIP-7702) | A request to "upgrade" or delegate your account | Can hand your account's behavior to code the attacker wrote |
| Seed phrase box | A form asking you to "validate" or "sync" with your 12 or 24 words | Gives away the whole wallet. No signature needed after that |
Permit and Permit2 deserve the most attention, because they feel harmless. There's no fee, and nothing seems to happen. Scam Sniffer's 2025 phishing report, published in January 2026, found these two signature types behind 38% of the losses in its large cases. The single biggest theft of the year, $6.5 million in September, came through one Permit signature. The same report noted malicious signatures built on EIP-7702, the account feature that arrived with Ethereum's Pectra upgrade, showing up soon after it went live.
The bottom row isn't a signature at all, but drainer sites ask for it too. The FBI warned in June 2025 about fake NFT airdrops sent to Hedera wallet users, with links to sites that asked for seed phrases. If you've typed yours anywhere, read what to do when your seed phrase is compromised, because the fix is different.
What the 2025 drainer numbers say
The headline number fell. Scam Sniffer's count of drainer phishing losses dropped from about $494 million in 2024 to $83.85 million in 2025, and victims fell from roughly 332,000 to 106,106. Better warnings and transaction previews in wallets are a likely part of the reason.
Read that with three limits in mind. First, Scam Sniffer calls its figure a lower bound. It only counts thefts it can tie to known drainer activity. Second, it covers Ethereum and similar chains only, and leaves out exchange hacks and direct key theft. Third, losses tracked the market. The worst quarter, the third, at $31 million, matched the year's strongest rally in ether. When token values rise, each signature is worth more to steal.
Fewer victims also doesn't mean the problem is gone. The losses that remain cluster in a few big cases, and the biggest ran through Permit signatures.
How to spot a drainer request before you sign
This takes about 30 seconds per request. It's the cheapest security habit in crypto.
- Ask how you got here. If the link came from a DM, an ad, a reply under a post or a token that appeared in your wallet, stop. Type the project's address yourself or use your own bookmark. Our guide on how to check if a crypto website is legit covers domain age and lookalike names.
- Match the request to the action. Logging in should never need a spender, a value or a deadline. A mint shouldn't need access to your stablecoins. If the request asks for more than the button promised, that's the tell.
- Read the spender and the amount. An unknown address with a huge number, or the word "unlimited," means permission to take everything of that token. A deadline years away means the permission waits for them.
- Treat "gasless" as a warning, not a perk. A free signature can still move real money. Permit drains cost the victim nothing until the tokens leave.
- Don't sign what you can't read. If your wallet shows raw code or says it can't decode the request, reject it. A real site can wait while you check.
- Use a separate wallet for anything new. Keep savings in a wallet that never connects to mints or claims, and use a second one holding only what you can afford to lose. If the second one gets drained, the damage stops there.
⚠ Red flag
A hardware wallet doesn't stop a drainer. It keeps your keys off your computer, but if you press the button to approve a malicious request, the approval is just as valid. The device only protects you if you read what it shows before you confirm.
Prefer to watch? How a wallet drainer works, in under a minute.
Drainers aren't the only way wallets get emptied
People use "drained" for several different crimes. They need different fixes, so it helps to know which one you're looking at.
- A drainer needs your signature on a fake site. Usually it takes specific tokens or NFTs, and your chain's own coin, like ETH, is often left behind.
- A seed phrase or key leak needs no signature. Everything goes, across every chain the wallet uses.
- Address poisoning needs no signature either. You send the money yourself, to a lookalike address copied from your own history.
- Fake support talks you into one of the above. Real wallet makers don't DM you first.
If you've already signed something, our guide to checking and revoking token approvals shows how to find and cancel the permission. Be aware that a Permit signature the thief hasn't used yet can stay valid until its deadline, which is why moving what's left often comes first. Our guide to whether to revoke or move first walks through that choice. Then report it at ic3.gov.
Rob's take
I've held Bitcoin since 2011, and back then the scary thing was losing your keys. Now the keys are often fine and the owner gets talked into signing them away. What bothers me about drainers is that they're a franchise. The person who built the kit never meets a victim. They rent it to people who are good at fake hype, and the kit does the rest. So the defense can't be "spot the bad guy." It has to be "read what you sign," every time, even on sites you trust.
Not sure whether a site, a message or an offer is a scam? Our is this a scam? quiz takes a minute, and the Scams hub has every guide in one place.
Want the pre-connect checks on one page? Get our free Is This Site Legit? one-page check when you join the Sunday Briefing.
One more number to hold onto. The biggest single drainer theft of 2025 took $6.5 million, and the victim didn't pay a cent in fees to lose it. The whole transfer of control was one free signature.
Wallet drainer FAQ
What is a wallet drainer in crypto?
A wallet drainer is scam software, usually sold or rented as a kit, that steals crypto after you sign a request on a fake website. The request gives a stranger permission to move your tokens or NFTs. The kit then sweeps them to the thief's wallet, often within seconds.
Can a wallet drainer steal crypto just from connecting my wallet?
Connecting alone shares your public address and balances, not control. The theft happens when you sign an approval, a Permit message or a transaction, or type in your seed phrase. Disconnect from any site you don't trust anyway, and don't sign anything it asks for.
What is a Permit signature scam?
A Permit signature is an off-chain message that approves someone to spend your tokens, with no gas fee to sign. Scam sites dress it up as a login or a claim. Scam Sniffer found Permit and Permit2 signatures behind 38% of large-case drainer losses in 2025.
Does a hardware wallet protect me from drainers?
Only partly. A hardware wallet keeps your keys away from malware, but it will still sign a malicious approval if you confirm it. Read the spender, the amount and the action on the device screen before you press approve.
How much do wallet drainers steal?
Scam Sniffer counted $83.85 million stolen from 106,106 victims in 2025, down from about $494 million in 2024. It calls that a lower bound covering Ethereum-style chains only. Check Point Research separately tied more than 30,000 victims to one kit, Inferno Drainer, in six months.
Can I get my crypto back from a wallet drainer?
Usually not, because blockchain transfers can't be reversed. Report it at ic3.gov with the addresses and transaction IDs, since seized funds are matched to reports. Ignore anyone who contacts you offering to recover it for a fee.
New to all this? Our free course Scam-Proof in 7 Days walks you through the checks one short lesson at a time.