Crypto Drainer

A crypto drainer (or wallet drainer) is a malicious toolkit that empties a victim's cryptocurrency wallet by tricking them into authorizing the theft themselves. Unlike malware that steals stored credentials, a drainer abuses the legitimate transaction-signing flow: the victim connects their wallet to what looks like a genuine service and approves a transaction whose real effect is to transfer or grant control of their assets to the attacker.

How it works

The lure is classic social engineering dressed in Web3 clothing. Victims are drawn to a fraudulent site through hijacked or impersonated social media accounts announcing an airdrop or NFT mint, malvertising on search results, SEO poisoning, or direct messages in Discord and Telegram communities. The site convincingly imitates a real project and asks the user to connect their wallet — a routine action in the crypto ecosystem — then presents a signature request.

That request is where the theft happens. The drainer script asks for something far broader than the victim believes they are approving: a token approval that grants the attacker's contract unlimited spending rights, a setApprovalForAll over an NFT collection, or a batched transaction that sweeps the wallet's most valuable assets in an optimized order. Modern drainers are sold as phishing-kit-style subscription services — drainer-as-a-service operators take a commission of stolen funds, ship regular updates to evade wallet security warnings, and let low-skill affiliates run the lures.

How to defend against it

For individuals: treat every wallet-connect and signature request as a payment authorization, read what is actually being approved, keep long-term holdings in a hardware wallet that displays transaction details on-device, and periodically revoke stale token approvals. Assume any unsolicited airdrop or urgent mint deadline is hostile until proven otherwise. For organizations, drainers matter beyond the crypto industry: corporate treasuries holding digital assets, executives with personal holdings, and employees active in crypto communities are all targets, and the same accounts are frequently softened up first through pig butchering-style relationship scams. Cover wallet-signing hygiene in awareness training the same way you cover invoice approval, and fold reports of drainer lures into the reporting culture of your broader human risk management program.