Wallet Drainer
A wallet drainer is a malicious smart-contract or phishing toolkit designed to trick users into signing transactions or approvals that immediately (or later) transfer all valuable assets out of their wallet to the attacker’s address.
✦ Key Insight
Drainers are one of the most common and effective attack vectors against self-custodial traders. They exploit token approvals, signature requests, or fake “claim” buttons, often emptying wallets in seconds. Awareness and prevention are essential for anyone interacting with dApps.
✕ Common Misconceptions
Signing without reading the transaction details; approving unlimited amounts on unfamiliar sites; ignoring wallet security warnings; using the same hot wallet for experimental dApps and large holdings.
Detailed Explanation
How It Works: Attackers create fake websites or inject malicious code into compromised dApps. Victims connect their wallet and are prompted to sign an unlimited approval or a direct transfer. Once signed, the drainer contract sweeps tokens, NFTs, and sometimes ETH via transferFrom or similar calls.
FAQs:
Can hardware wallets stop drainers?
They help by requiring physical confirmation, but users must still verify details.
Is there recovery?
Rarely, once transferred, funds are usually gone.
Best defense?
Verify URLs, use hardware wallets, and revoke approvals regularly.
In Practice
Dig Deeper
Phishing
Phishing is a scam where attackers trick users into revealing private information or signing harmful transactions.
Token Approval
A token approval is an on-chain permission that a wallet owner grants to a smart contract, allowing that contract to transfer a specified (or unlimited) amount of a particular token (usually ERC-20) from the owner’s address.
Revoke
To revoke a token approval is to remove or reduce a previously granted spending allowance for a smart contract or address.