Wallet Drainer
A wallet drainer is a malicious smart-contract or phishing toolkit designed to trick users into signing transactions or approvals that immediately (or later) transfer all valuable assets out of their wallet to the attacker’s address.
✦ Key Insight
Drainers are one of the most common and effective attack vectors against self-custodial traders. They exploit token approvals, signature requests, or fake “claim” buttons, often emptying wallets in seconds. Awareness and prevention are essential for anyone interacting with dApps.
✕ Common Misconceptions
Signing without reading the transaction details; approving unlimited amounts on unfamiliar sites; ignoring wallet security warnings; using the same hot wallet for experimental dApps and large holdings.
Detailed Explanation
How It Works: Attackers create fake websites or inject malicious code into compromised dApps. Victims connect their wallet and are prompted to sign an unlimited approval or a direct transfer. Once signed, the drainer contract sweeps tokens, NFTs, and sometimes ETH via transferFrom or similar calls.
FAQs:
Can hardware wallets stop drainers?
They help by requiring physical confirmation, but users must still verify details.
Is there recovery?
Rarely, once transferred, funds are usually gone.
Best defense?
Verify URLs, use hardware wallets, and revoke approvals regularly.
In Practice
Dig Deeper
Phishing
Phishing is a scam where attackers trick users into revealing private information or signing harmful transactions.
Token Approval
A token approval is an on-chain permission that a wallet owner grants to a smart contract, allowing that contract to transfer a specified (or unlimited) amount of a particular token (usually ERC-20) from the owner’s address.
Allowance
An allowance is the specific quantity of tokens that a wallet has authorized a particular smart-contract address (spender) to transfer on its behalf, as recorded in the token contract’s state.
Revoke
To revoke is the act of resetting a token allowance to zero (or a lower amount) via an on-chain transaction, permanently removing a smart contract’s permission to transfer the specified tokens from your wallet.
Ad
Get a $100K funded account
See current qualification terms and payout conditions.
Sponsored