Crypto Wallet Drainers Explained: How They Work and How to Stay Safe

A crypto wallet drainer is malicious software, usually hidden behind a fake website, that steals tokens by getting you to sign a harmful approval or transaction. It doesn’t need your seed phrase. You click “approve” or “sign” on a request that looks routine, and that signature gives it permission to move your tokens.

Drainers have taken hundreds of millions of dollars from ordinary users in recent years. This guide explains how they work, where they hide, why a hardware wallet doesn’t stop them on its own, how to revoke old approvals, and the habits that keep a single bad click from emptying your main wallet.

What is a crypto wallet drainer?

A wallet drainer is malicious software that steals crypto by tricking the owner into signing a harmful transaction. ScamSniffer, a firm that tracks Web3 phishing, describes drainers as malware that “steals crypto assets by inducing users to sign malicious transactions.”

The drainer usually sits behind a convincing website: an airdrop claim page, an NFT mint, a token “migration” or a fake version of a real app. You connect your wallet, a request pops up, you approve it, and the drainer moves whatever that approval covers.

How big is the problem?

According to ScamSniffer’s annual reports, which cover Ethereum and compatible blockchains:

Year	Reported phishing losses	Victim addresses
2024	About $494 million	About 332,000
2025	$83.85 million	106,106

ScamSniffer calls its figures a lower-bound estimate. They count only trackable drainer attacks through phishing websites, not exchange hacks or other exploits. The 2025 drop is welcome, but the largest single phishing theft that year was still $6.5 million, according to the same report.

How do drainer kits work?

Drainers are often sold or rented as ready-made kits. One group builds the software, and other criminals, often called affiliates, run the scam sites and share the proceeds.

Check Point Research reported in 2025 that one long-running kit, Inferno Drainer, had returned with new evasion techniques and hit more than 30,000 wallets in about six months, taking at least $9 million. Its operators supplied the tools; affiliates brought the victims.

ScamSniffer lists the main ways victims reach drainer sites:

• Hacked official accounts. Compromised project accounts on X or Discord post a link that looks genuine because it comes from the real account.
• Fake airdrops. Tokens or NFTs appear in your wallet, pointing you to a site to “claim” more.
• Paid ads. Scam sites buy ads on Google, X and Telegram that can appear above the real result.
• Email and direct messages.

What are you actually signing?

Most drainer losses come from approvals and signatures, not stolen keys. MetaMask’s support pages explain that a token approval (or allowance) lets an app move tokens from your wallet on your behalf. It is a normal part of using a decentralized exchange. The danger is that many approvals ask for unlimited access, and MetaMask warns that a fraudulent contract with that access can drain the tokens it covers.

ScamSniffer found that Permit signatures were the leading method in large-loss cases in both 2024 and 2025. A Permit is a signed message that grants spending approval. It can look like a harmless text box rather than a transaction, and it doesn’t need a network fee, which is part of why people sign it without a second thought. The 2025 report also flagged a newer pattern that bundles several malicious actions into a single signature.

Doesn’t a hardware wallet stop this?

No. A hardware wallet keeps your keys offline, but it signs whatever you approve. If the request on the screen is a malicious approval, the device signs it.

Ledger, a hardware wallet maker, calls this risk blind signing: approving a transaction without being able to verify its full details in a readable form. Ledger also says that once an account connects to a smart contract or app, it is no longer a cold wallet, which is why a separate low-balance account for app interactions makes sense. Bullrunners covers what a cold wallet does and doesn’t protect in What is a cold wallet?

What about XRP holders?

The approval tricks above are built for Ethereum-style blockchains, but XRP holders face related risks, and Bullrunners has covered three of them:

• Exposed keys. In September 2026, more than 11.7 million XRP was drained from D’CENT app wallets. That case was about exposed keys rather than approvals: every transaction was signed with the owner’s own key. See the D’CENT wallet drain.
• Delegated permissions. The XRP Ledger has a proposed upgrade, called permission delegation, that would let one account send certain transactions for another. As of mid-October 2026 it is not switched on: xrpl.org lists it as still open for validator voting. If it goes live, a scam site could ask you to sign a DelegateSet transaction that gives its account payment rights. See XRP Ledger upgrade scams.
• Lookalike addresses. Address poisoning isn’t a drainer, but it ends the same way: funds sent somewhere you didn’t intend. See address poisoning.

How to check and revoke approvals

Revoking an approval cuts off an app’s ability to move your tokens. It can’t return anything already taken. Wallet menus change, so labels may differ in the current version of your app.

1. Find your approvals. Use your wallet’s approval view if it has one, or the token approval checker on the block explorer for your network.
2. Look for anything you don’t recognize or no longer use, especially unlimited approvals.
3. Revoke them. Each revoke is an on-chain transaction, so MetaMask notes you pay a small network fee for each.
4. Repeat regularly. MetaMask suggests checking approvals as often as monthly.
5. Set spending caps when a wallet lets you limit an approval to the amount you actually need.

Only use revocation tools you reach by typing the address yourself or from your wallet’s official documentation. Fake “revoke” sites exist too.

Drainer safety checklist

1. If you can’t read it, don’t sign it. Reject any request whose action, recipient and amount you can’t understand.
2. Use a burner wallet: a separate, low-balance wallet for new apps, airdrops and mints.
3. Keep long-term holdings in a wallet that never connects to websites.
4. Ignore surprise tokens and NFTs. Don’t visit the site they point to.
5. Type addresses for apps you use, or use saved bookmarks. Don’t click ads or links in direct messages.
6. Be wary of urgency: “claim before midnight”, “your wallet is at risk”, “migrate now”.
7. Never enter your seed phrase on any website, whatever it claims to fix.
8. Revoke old approvals on a schedule.

If your wallet has been drained

Move anything left to a new wallet with a brand-new seed phrase, starting with a small test transaction, and stop using the old address. Revoke approvals on the old wallet if tokens remain. Report the theft to the FBI’s IC3 in the US, or your national police elsewhere, with the addresses and transaction IDs. Then expect fake “recovery” offers, which are a second scam. No legitimate service charges an upfront fee to get stolen crypto back.

What to watch next

Drainer methods follow new blockchain features. ScamSniffer’s 2025 report found that a feature added to Ethereum that year was being misused within months. When any network you use adds a new type of approval or delegation, expect scam sites to ask you to “enable” it. Check your approvals this week, and set up a separate wallet before you next try a new app.

Sources

• ScamSniffer: 2024 Web3 Phishing Attacks, Wallet Drainers Drain $494 Million
• ScamSniffer: 2025 Crypto Phishing Losses Fall 83% to $84 Million
• Check Point Research: Inferno Drainer Reloaded (2025)
• MetaMask Support: How to revoke smart contract allowances/token approvals
• Ledger Academy: Blind signing
• XRP Ledger: Known Amendments