What Is a Crypto Wallet Drainer and How Do They Work

You click a link in a Discord server. The site looks like the NFT mint you've been waiting for. You connect your wallet, click the mint button, and MetaMask pops up asking you to approve a transaction. It looks normal — an approval, like the ones you've seen before. You click Confirm.

Within seconds, every token in your wallet is gone. You just used a wallet drainer — a smart contract built specifically to empty wallets the moment it gets approval.

The mechanics: how a drainer actually drains

Token approvals are a legitimate part of DeFi — you approve Uniswap to move your tokens during a swap, for example. Drainers exploit this same system.

The attack flow looks like this:

• 1.You visit a phishing site — a fake mint, a fake airdrop claim, a compromised project link
• 2.The site asks you to connect your wallet — standard behavior, not suspicious yet
• 3.A transaction pops up requesting approval for a contract address you don't recognize
• 4.The approval amount is set to the maximum possible — all of your tokens, not just what the site needs
• 5.Once you confirm, the drainer contract immediately calls transferFrom() to sweep your balance
• 6.The transaction completes in the same block — by the time you see it on Etherscan, it's done

The variants you need to know about

Basic ERC-20 drainers are the most common, but the ecosystem has expanded:

• •NFT drainers — use setApprovalForAll to take your entire NFT collection in one transaction, then sell or move it
• •Permit signature drainers — exploit EIP-2612's off-chain signing to get approval without an on-chain transaction first. You sign what looks like a harmless message, not a transaction
• •Seaport order drainers — craft a valid OpenSea-compatible order that trades your valuable NFTs for nothing
• •Multi-token drainers — scan your wallet first, then construct a single transaction that drains all approved tokens at once

What the transaction looks like before you sign

The warning signs are in the approval details — but only if you look:

• •The spender address is a contract you've never interacted with before
• •The approved amount is set to the maximum uint256 value (looks like a huge number)
• •The transaction has no apparent purpose — you're "approving" without a corresponding action
• •Paste the spender address into Etherscan — drainer contracts often have no verified source code and show multiple victim wallets in their transaction history

What actually prevents drainer attacks

• ✓Read every approval before signing — the spender address, the amount, and whether you know what this contract does
• ✓Never click links in Discord, Twitter DMs, or Telegram to reach a site you want to transact on — type the URL directly
• ✓Check that the site URL matches exactly what you expect — one character off is a phishing site
• ✓Approve limited amounts instead of unlimited when protocols allow it
• ✓Maintain a separate "hot" wallet for DeFi with only what you're actively using — not your main holdings

Frequently asked questions