A wallet drainer is a phishing kit, sold as a service with a revenue share to whoever distributes it. It does not break cryptography and it does not steal your keys. It gets you to authorise a transfer, and then it takes everything the authorisation allows.
That distinction matters because it explains why a hardware wallet does not save you here. The device signs faithfully. The problem is what you told it to sign.
What you are actually signing
Wallet prompts look interchangeable. They are not:
A transfer. Moves a specific amount to a specific address, now. The most honest prompt there is, and the least used by drainers.
An approval (approve). Grants a smart contract permission to move a token on your behalf. Two details do the damage: the amount is very often unlimited, and the permission does not expire. A contract you approved eighteen months ago for one swap can still move that token today. If the contract is malicious, or is upgraded to become so, it does.
An NFT collection approval (setApprovalForAll). The same idea across an entire collection at once, which is why NFT drains tend to be total rather than partial.
An off-chain signature (permit, permit2, and similar). The drainer’s favourite. It grants the same spending rights as an approval, but it is a message rather than a transaction: no gas, no confirmation delay, and nothing on the chain until the attacker chooses to use it. To the victim it looks like the harmless “sign this message to verify your wallet” step used by legitimate sites, and there is no pending transaction to reconsider. Signatures like this can also be held and executed later, so a wallet can look fine for days.
A genuine sign-in message is plain readable text naming the site and a nonce. If a “verification” prompt contains token addresses, spender addresses or amounts, it is not a sign-in.
How it reaches you
- Paid ads above real search results for well-known applications — a persistent, industrialised channel.
- Cloned domains one character off the real one, often served through links in comments and replies.
- Compromised official accounts. Project Discord servers and social accounts get taken over specifically to post a “surprise mint” link. The account is real; the link is not.
- Airdrop claim pages, especially for tokens you do genuinely qualify for.
- Support impersonation. Nobody legitimate opens a direct message to you about a wallet problem.
- QR codes and “connect wallet to check eligibility” pages.
Defences, in order of effect
- Separate the vault from the daily wallet. Long-term holdings live in a wallet that has never connected to any application. Nothing else on this list comes close to this in value.
- Reach applications through your own bookmarks — never through search, ads, direct messages or replies.
- Read the simulation. Wallets increasingly preview what a signature will do and flag known drainer contracts. If it warns, stop. Not one of those warnings is worth overriding to claim an airdrop.
- Treat unlimited approvals as a decision. Set a spending cap where the interface allows it, even though it costs a little more in fees over time.
- Revoke stale approvals periodically using a reputable revocation tool, reached from a bookmark. Anything you no longer use should not still have permission.
- Assume any unexpected request is hostile. Urgency — an expiring claim, a compromised-wallet warning, a limited mint — is the payload, not the context.
If you have already signed
Order matters, because sweeper bots monitor compromised addresses continuously.
- Move the remaining assets out first, to a wallet from a fresh seed — not another account derived from the same phrase if the phrase itself may be exposed. Revoking first wastes the minutes that count.
- Then revoke the approvals on the compromised address.
- Retire the address. Anything sent to it later, including future airdrops, is at risk of being swept.
- Do not engage with recovery services that appear afterwards. They are the second wave.
Related: setting up a hardware wallet and what DeFi is, including which parts of it require approvals at all.
Nothing here is financial advice. Signed approvals are irreversible — see our risk disclaimer.