Wallet drainer

A drainer is a script that runs on a fake or compromised website. When the victim connects a wallet, it reads the balances and prepares the requests most likely to capture the valuable assets: token approvals, off-chain permit signatures, NFT approvals for an entire collection or a plain transfer disguised as a mint or claim. Once the user signs, the attacker moves the funds within seconds.

Drainers are often sold as a service. The developer supplies the kit, hosting tips and updates that evade wallet warnings, while affiliates bring the traffic through fake airdrops, hacked social media accounts or malicious ads, and the stolen funds are split between them by percentage. Several well-known drainer brands have stolen hundreds of millions of dollars before shutting down.

Because the victim signs the transaction, nothing is technically hacked, and recovering funds is rare. Wallet transaction previews, simulation tools and keeping valuable assets in a separate wallet that never connects to new sites greatly reduce the risk.