Wallet drainers
A wallet drainer is malicious code, usually served through a fake or compromised website, that asks a user to sign a transaction or permit which hands an attacker control of their assets. The user thinks they are minting, claiming or connecting. In fact they are approving the attacker to move their tokens, which can then be emptied at any time.
How drainers reach users
- Fake sites that copy a real project, promoted through ads, social media and phishing messages.
- Compromised real sites, where an attacker has taken over the domain, DNS, hosting or a third-party script.
- Compromised social accounts posting links to “claims” and “airdrops”.
- Malicious Discord and Telegram bots and messages.
What the user is asked to sign
- Token approvals granting unlimited allowance to the attacker’s contract.
- Permit signatures, which grant an allowance off-chain and cost the user no gas, so they feel harmless.
- NFT approvals for an entire collection.
- Direct transfers disguised as something else.
What dApp teams can do
- Protect the domain, DNS and hosting accounts as you would a treasury key.
- Minimise and pin third-party scripts, and use a content security policy.
- Request the smallest approval your contract needs.
- Get the front end tested, not just the contracts. See dApp and front end testing.
- Have a plan for warning users fast if your site is ever compromised.
Frequently asked questions
Can a drainer take funds without a signature?
Not on its own. Drainers rely on the user signing something. That is why the clarity of signing prompts, and the integrity of the site asking for the signature, matter so much.
How can users protect themselves?
Check the domain carefully, be suspicious of urgent claims and free mints, read what a signature request grants, revoke old approvals, and keep large holdings in a wallet that is never connected to unfamiliar sites.
Published Updated