Crypto Wallet Drainers: How They Work and What They Do

Last updated: November 6, 2026

Crypto wallet drainers steal digital assets by tricking people into approving a transaction, signing a message or handing over wallet credentials. Unlike a password theft, the attacker may not need to break into an account: the wallet owner can authorize access themselves without understanding what a request permits.

How crypto wallet drainers work step by step

Chainalysis described drainers as Web3 phishing tools that get users to connect wallets and approve transaction requests. A typical attack follows a pattern, although the exact request and assets at risk can differ.

1. The attacker creates a lure. A fake mint, airdrop, token claim or other Web3 offer can lead a person to a fraudulent site. The page may imitate a familiar service, but a wallet connection does not prove that the site is legitimate.
2. The site prompts a wallet action. It may ask the visitor to connect a wallet, approve token spending, sign a message or authorize a wallet delegation. These actions are not interchangeable. A connection shares limited wallet information, while an approval or signature may grant authority to act.
3. The user accepts a request. The person may be asked to confirm a transaction or signature, or to provide wallet credentials. If they do so without understanding what the request authorizes, the attacker can gain a route to the assets covered by that permission. Some malicious requests are designed to look like ordinary deposits or NFT listings.
4. The attacker uses the permission. Depending on the request, the attacker may transfer approved tokens, use a signed message later, or act through delegated smart-contract code. The theft may happen after the user has closed the page.

MetaMask explains that signature phishing can involve an off-chain message disguised as an action such as depositing tokens or listing an NFT. The signed message is not necessarily sent to the blockchain when collected, but an attacker may use it later. MetaMask’s explanation of signature phishing describes why a signature prompt deserves the same care as a transaction prompt.

Common drainer methods at a glance

A February 2026 SEAL incident-response playbook identifies several ways drainers can obtain authority. The key difference is what the wallet owner is being asked to authorize.

These are not the only possible lures, and a legitimate-looking interface does not make a request safe.

Common mistakes and risks

Crypto wallet drainers exploit approvals that stay active

One common misunderstanding is that disconnecting a wallet from a website cancels permissions previously granted to a contract. It doesn’t. Ethereum.org stated on October 16, 2026, that token permissions have no expiration date and may remain usable years after approval. Its guide to revoking token access explains that disconnecting and revoking are separate actions.

Another mistake is treating every signature as harmless because it does not show a familiar transaction fee or appear on-chain immediately. MetaMask’s guidance says an off-chain signature can still be used by an attacker later. Read the wallet prompt and be cautious when a site asks for an action unrelated to what you expected to do.

Crypto wallet drainers can lead to irreversible asset loss, and revoking an allowance cannot undo a transfer that has already happened. The attack can also involve phishing for a seed phrase or private key, smart-contract permissions, or a wallet delegation. Wallet and contract risks vary by network and request. A reputable wallet interface does not establish that a connected site is safe.

The scale is difficult to measure. A 2025 study examining Ethereum drainer-as-a-service activity from March 1, 2023, to April 1, 2025, identified 76,582 victim accounts and attributed $23.1 million in earnings to operators and $111.9 million to affiliates. The researchers cautioned that their dataset could miss accounts outside the network they identified. These figures are research estimates, not a count of every crypto wallet drainer loss.

SEAL reported on February 9, 2026, that ScamSniffer estimated drainers and other phishing scams caused nearly $1 billion in losses over several years, with estimated losses of $84 million in 2025. The categories include phishing scams beyond drainers, so the figures should not be read as a drainer-only total.

Crypto wallet drainers FAQ

Can a wallet be drained just by connecting it to a website?

A wallet connection alone is different from signing a message or approving token spending. The risk rises if the site then persuades the user to authorize a malicious request. Check each prompt rather than assuming that the connection itself explains every permission.

Does disconnecting a wallet stop a drainer?

Disconnecting ends the site’s wallet connection, but it does not revoke a token allowance already granted. Ethereum.org says permissions can remain active without an expiration date. Review and revoke unwanted allowances separately, while remembering that revocation does not recover assets already transferred.

What should I do if I signed a suspicious request?

Identify what the request authorized and which wallet and network it involved. If it granted token access, check the relevant permissions and revoke access you do not recognize. If a seed phrase or private key was exposed, treat that as a separate, serious compromise. Avoid sharing credentials with anyone claiming they can recover funds. Recovery cannot be assured once assets have moved.

Sources

• Signature phishing (support.metamask.io)
• How to revoke smart contract access to your crypto funds (ethereum.org)
• Understanding Crypto Drainers (www.chainalysis.com)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.