How Wallet Draining Attacks Work

A wallet drainer is a piece of software, sold and operated much like a commercial product, built for a single purpose: converting a moment of user confusion into an immediate, automated transfer of assets. Unlike older forms of crypto theft that required stealing a password or a seed phrase directly, a drainer typically works by getting the victim to sign something themselves, a transaction or a message, that looks routine but actually authorizes the attacker to take control of tokens or an entire wallet balance.

These kits are not built by isolated individuals. Groups operating under names like Inferno Drainer, Angel Drainer, Pink Drainer, and several others have run what security researchers describe as scam as a service operations, licensing their drainer software to affiliates in exchange for a cut of whatever is stolen. Inferno Drainer alone is estimated to have been responsible for more than eighty million dollars in losses across its period of activity, spoofing over a hundred different crypto brands to make its phishing pages convincing.

The three stage anatomy of a drainer attack

Stage one: the lure

Every drainer attack starts by getting the target to a malicious page. This is usually done through a fake airdrop announcement, a spoofed minting page for a popular NFT collection, a cloned exchange or wallet support page, or a paid advertisement placed to appear above the real project's website in search results. The page is frequently an exact visual copy of a legitimate site, often built using leaked or copied source code, so there is little to visually distinguish it from the real thing.

Stage two: the connection

Once on the page, the victim is prompted to connect their wallet, which by itself is not dangerous and does not transfer any funds. Drainer kits use scripts designed to mimic well known Web3 connection libraries, giving the interaction a sense of legitimacy and technical normalcy that lowers the victim's guard for what comes next.

Stage three: the signature

This is the moment the entire attack depends on. The site presents a transaction or message for the wallet to sign, framed as claiming a reward, verifying eligibility, or completing a routine step. In reality, the request is either a direct token transfer, an unlimited spending approval, or a signed permit message that authorizes the drainer's contract to move funds later without any further action from the victim. Drainer software is often built to scan the connected wallet first and prioritize whatever asset is most valuable and easiest to move, frequently ignoring balances below a small threshold to avoid tipping off a victim with a low value test transaction.

The technical mechanism behind a drainer contract

Most modern drainer kits are built around a single, reusable smart contract deployed by the operator, which many different phishing sites simply point to rather than each attacker writing custom code from scratch. The contract typically exposes a function that checks a connected wallet's token balances, existing approvals, and NFT holdings in one call, so the phishing page can decide instantly which single signature will extract the most value from that specific victim. Because the same underlying contract is reused across thousands of different phishing domains, security researchers who identify one drainer's contract address can sometimes flag every site that calls it, though operators regularly deploy fresh contract addresses specifically to stay ahead of that kind of blocklisting.

Multicall and batched approvals

A single confirmed signature within a drainer flow often triggers more than one action under the hood. Multicall functionality, a legitimate feature used throughout DeFi to bundle several operations into one transaction and save on network fees, is repurposed by drainer contracts to combine an approval, a transfer, and sometimes a swap into an asset that is easier to liquidate, all executed the moment the victim's single signature is broadcast. This is part of why a victim frequently discovers several different assets missing from a wallet after what felt like one interaction.

A realistic walkthrough of a drainer attack

• An account impersonating a real NFT project or well known influencer posts about a surprise airdrop, complete with a countdown timer, on a platform like X or Discord, linking to a claim page that closely mirrors the project's real branding.
• The victim clicks through, lands on the claim page, and connects their wallet, an action that by itself transfers nothing and feels routine since it mirrors dozens of legitimate airdrop claims the same person may have completed before.
• The page scans the connected wallet in the background and identifies a stablecoin balance and a valuable NFT as the two highest value assets available to move.
• A single wallet prompt appears, labeled simply as Claim Reward or Verify Eligibility rather than describing a token transfer, and the victim confirms it under the pressure of the visible countdown timer.
• Within seconds, the stablecoin balance and the NFT are both transferred out through the drainer's multicall function, and the funds begin moving through a series of intermediate wallets designed to complicate tracing before the victim has even refreshed the page to check their balance.

How a wallet drainer differs from classic account phishing

Classic phishing, of the kind long used against email and banking credentials, generally requires the victim to hand over a password or a one time code, which the attacker then manually uses to access an account. A wallet drainer skips that intermediate step entirely. There is no password to steal and no separate login for the attacker to use later, because the victim's own confirmed signature is the theft. This makes drainer attacks faster and more automated than traditional phishing, but it also means the defensive advice differs. Password hygiene and credential monitoring, useful against account phishing, do nothing to stop a drainer, since the wallet's owner is the one who technically authorized the transfer. The only effective defense is scrutinizing what a signature request actually says before confirming it.

Why these attacks are hard to reverse once confirmed

Blockchain transactions settle without any central authority able to reverse them once confirmed. A drainer's back end contract is typically built to move funds to a fresh destination address within seconds, and often through several hops immediately afterward, specifically to complicate any attempt to freeze or recover the assets before they reach an exchange or a mixing service. For more detail on the tooling used to obscure that movement, see our guide on how phishing steals cryptocurrency.

How malicious approvals fit into drainer attacks

Not every drainer attack empties a wallet immediately. A significant share instead obtain a standing spending approval, sometimes for an unlimited amount of a specific token, which the attacker can exercise at any point in the future, even weeks or months later, without needing the victim to do anything else. This is one of the reasons a wallet can appear untouched for a long stretch of time after a phishing interaction, only to be drained later once the attacker decides to act. The mechanics of this specific tactic are covered in depth in our guide on malicious token approvals.

Reducing exposure to drainer attacks

• Read the full content of any wallet signature request before confirming, not just the headline description the site provides, and be especially cautious of requests labeled simply as a signature rather than a clearly itemized transaction.
• Treat urgency as a warning sign. Countdown timers, limited claim windows, and phrases like final hours are common pressure tactics used to rush a victim past careful review.
• Use a wallet or browser extension that flags known malicious contracts and drainer infrastructure, and keep it updated, since drainer operators regularly rotate domains to stay ahead of blocklists.
• Keep a separate, low balance wallet for interacting with new or unfamiliar sites, minting pages, and airdrop claims, rather than connecting a primary wallet that holds meaningful funds.
• Periodically review and revoke standing token approvals using a reputable approval checking tool, even for sites that seemed legitimate at the time.

What changes once a drainer attack has already happened

Once a drainer contract has executed, the wallet's relationship to any asset it still holds changes immediately, even for tokens the drainer did not touch in the initial transaction. Any approval the drainer's contract obtained but has not yet exercised remains active and exploitable until it is manually revoked, so a wallet can be drained a second time from the same signature days or weeks after the first incident if that step is skipped. It is also worth checking whether the same signature granted access across more than one token standard, since some drainer flows request approval covering an entire NFT collection through a single setApprovalForAll call rather than one specific item, leaving every NFT from that collection in the wallet still exposed even if only one piece was taken initially.

When a drainer attack has already succeeded, the realistic path forward is documentation and tracing rather than reversal. Investigators, including firms like Coin Trace, can sometimes follow the movement of drained funds across wallets and exchanges to identify where they settled, which occasionally supports a recovery effort or a law enforcement referral, though no legitimate investigator can promise stolen funds will be returned in a given case.

Frequently asked questions

Sources and further reading

• Inferno Drainer Scam: Crypto Wallet Draining Malware Explained · Group-IB
• How a 'crypto drainer' tricked people into handing over $80 million · The Record
• Inferno Drainer Spoofs Over 100 Crypto Brands to Steal $80m+ · Infosecurity Magazine

Related reading