Wallet drainers: how one signature empties your wallet

A hyped collection is minting right now. Your feed is full of it, a counter on the page says 812 of 1000 are already gone, and the allowlist closes in four minutes. You connect your wallet, the site says "just approve the mint step," and you click confirm without reading the popup. That signature did not mint anything. It handed an attacker's contract permission to move every token in your wallet, and moments later a sweeper contract does exactly that. No password was stolen. No seed phrase was leaked. You approved your own robbery in one click.

That is a wallet drainer, and the reason you keep seeing these attacks is that they are no longer built by skilled individuals. They are a product. Someone writes the drain smart contract and the pixel-perfect fake pages, then rents the whole kit to less-skilled criminals for a cut of everything stolen. Turnkey, industrial, and everywhere.

In 2024 alone, wallet drainers stole an estimated $494 million from crypto users, a 67% jump over the year before, according to Web3 anti-scam firm Scam Sniffer (BleepingComputer). This post explains how the machine works, why "looking carefully" is not enough, and the setup that actually stops it.

TL;DR

• Wallet drainers are malicious phishing pages plus a drain contract that empties your wallet when you sign a single approval — no password or seed phrase required.
• They run as drainer-as-a-service: the kit's authors rent it to affiliates who drive victims to it, keeping 70–80% of each theft and handing the operators a 20–30% cut. Named kits include Inferno, Pink, and Angel.
• Inferno Drainer alone took over $80M from ~137,000 victims across roughly a year, using more than 16,000 fake domains impersonating 100+ brands (Group-IB).
• Drainers stole around $494M in 2024 overall, up 67% year over year (Scam Sniffer via BleepingComputer).
• Defense is structural, not visual: use a domain-reputation + transaction-simulation extension, connect a burner wallet for any claim or mint, and revoke old approvals at revoke.cash.

What are wallet drainers and drainer-as-a-service?

Wallet drainers are ready-made phishing kits that steal crypto by tricking you into signing a malicious transaction approval, and drainer-as-a-service is the business model that rents those kits out. Together they turned wallet theft from a bespoke craft into a franchise.

Break the kit into its two halves. First, the fake front end: a convincing clone of a mint page, an airdrop claim, a token-swap site, or a "connect to verify" portal. Second, the drain contract: a smart contract deployed by the attacker that, once you grant it permission, can move your tokens out. The affiliate's only job is to get you onto the page and get you to sign. Everything after that is automated.

The economics are why this scaled. In a drainer-as-a-service arrangement, the people who wrote the kit do not phish anyone directly. They rent it to affiliates who supply the traffic — hacked social accounts, fake ads, poisoned Discord links — and the two sides split the loot. In Inferno Drainer's operation, affiliates kept 80% of each theft and the operators took 20% (The Record); other kits advertise cuts in the 20–30% range. This is the same franchise logic that made ransomware-as-a-service explode, applied to DeFi. It is why the same drain contract shows up behind thousands of different-looking scam pages.

Crucially, none of this is a "hack." A drainer never asks for your seed phrase and never guesses a key. It is phishing in the purest sense: it gets you to perform one legitimate-looking action that happens to be catastrophic.

How much have wallet drainers actually stolen?

The numbers are large and growing. Across 2024, wallet drainers stole roughly $494 million from victims — a 67% increase over 2023 — per Scam Sniffer's year-end report (BleepingComputer). That figure counts only drainer-style phishing, not exchange hacks or protocol exploits, which makes it a startling amount for an attack that requires no code-breaking at all.

The flagship kit is Inferno Drainer, the most prominent drainer of 2023. Group-IB traced it to more than $80 million stolen from about 137,000 victims over roughly a year of operation, spread across over 16,000 unique phishing domains that impersonated more than 100 crypto brands (Group-IB). Inferno announced a shutdown, then resumed — a reminder that killing a service is not killing the model. Other named kits like Pink Drainer and Angel Drainer filled the gaps immediately, because the demand from affiliates never went away.

The takeaway from the scale is not "avoid Inferno." It is that you cannot out-recognize an industrial clone. When 16,000 domains all lead to the same drain contract, and each page is a perfect copy of a real one, spotting the fake by eye is a losing game. Your defense has to sit somewhere other than your own vigilance.

Why can't I just spot a drainer by looking carefully?

You cannot reliably spot a drainer by looking because the pages are professionally cloned and the malicious part is a signature request you were never trained to read. The attacker controls exactly what you see; the only honest signal is what you are actually being asked to sign, and that arrives disguised as a routine step.

Consider the mint example. The wallet popup says setApprovalForAll to an unfamiliar operator address — which means "let this contract move every token in this collection, indefinitely." The page frames it as "the mint step." A real mint never needs blanket, standing control over your existing tokens, but you have to know that to catch it, and the urgency counter is engineered to stop you from thinking. The same trick appears as a permit signature, an approve for an unlimited amount, or a raw hash your wallet cannot even decode.

This is the family that also includes approval phishing, where the malicious signature is an ERC-20 approval rather than an NFT one — same weak point, the un-read signature. It differs from address poisoning, where you are tricked into sending funds to a lookalike address rather than signing anything. What unites all three is that "be careful" fails against them, because the attack is built to survive careful people who are moving fast.

How do I protect myself from wallet drainers?

The defenses that work are structural — they put a barrier in the way that does not depend on you correctly reading a popup under pressure. Stack these three.

1. Install a domain-reputation and transaction-simulation extension. Tools like Blockaid and Scam Sniffer flag known drainer domains before you connect, and simulation-based wallets like Rabby show you what a signature will actually do to your balances before you approve — turning an opaque setApprovalForAll into a plain-English "this will let a stranger move all your NFTs." This shifts detection off your tired eyes and onto software that knows the drain contracts by heart.

2. Use a burner wallet for every claim and mint. Keep your real holdings in a "vault" wallet that never touches unvetted sites, and do all your minting, airdrop-claiming, and experimenting from a separate burner wallet that holds almost nothing. If a drainer wins, it drains a wallet with a few dollars of gas in it, not your life savings. This one habit turns a catastrophe into a shrug, and it is the reason experienced users never connect their main wallet to a hyped mint.

3. Revoke old approvals regularly. Every approval you have ever signed is a standing permission that lives until you cancel it. Visit revoke.cash periodically and revoke approvals you no longer use, especially unlimited ones. If you have already signed something you regret, revoking it cuts the drain contract's access before the sweeper fires — sometimes in time to matter.

Underneath all three is the same principle that governs self-custody: because there is no bank to reverse the transaction, you have to build the safety rails yourself, in advance. The Wallet Drainer drill puts you on a live-looking mint page with the counter ticking so you can practice reaching for your bookmark and your burner instead of your vault — before it counts.

Related questions

Do wallet drainers steal my seed phrase or password? No. A wallet drainer never asks for your seed phrase or private key and never guesses a password. It works entirely by getting you to sign a malicious approval or transaction with your own wallet. That is why standard "never share your seed phrase" advice does not save you here — you did not share anything, you authorized a contract to move your funds. The defense is to control what you connect to and what you sign, not just to guard your secrets.

What is drainer-as-a-service? It is the rental business model behind most modern wallet-draining scams. The people who build the phishing kit and drain contract lease them to affiliates, who bring the victims and split the proceeds — typically the affiliate keeps 70–80% and the kit operator takes 20–30%. Inferno Drainer ran exactly this way, with affiliates keeping 80% of each theft. This model is why the same underlying drain contract appears behind thousands of unrelated-looking scam sites.

How do I know if I have already signed a drainer approval? Check your active approvals at revoke.cash, which lists every contract you have granted permission to and how much. Look for approvals to unfamiliar addresses, unlimited allowances, or setApprovalForAll grants over collections you value. If you find one you do not recognize, revoke it immediately — that cancels the standing permission before it can be used. Doing this as a routine, not just after a scare, is part of good wallet hygiene.

Is a hardware wallet enough to stop wallet drainers? It helps but does not fully protect you, because a drainer relies on you approving the malicious signature — and a hardware wallet will happily sign whatever you confirm. Its value is that it shows the transaction details on a screen malware cannot alter, giving you a real chance to read what you are signing. Pair it with transaction-simulation tooling and the burner-wallet habit; the hardware device is one layer, not the whole defense.

How big is the wallet drainer problem? Large and growing. Scam Sniffer estimated drainers stole around $494 million in 2024, up 67% from the prior year, and that counts phishing drains alone. Inferno Drainer by itself took over $80 million from roughly 137,000 victims. It is one of the dominant patterns in how Web3 users actually get hacked and sits right alongside the other patterns in our roundup of common crypto scams.