HostDeFi › Guides › Wallet drainers
Wallet drainers: how one signature empties an account
No hack, no seed leak, no exploit. The defining feature of a drainer is that the victim's own wallet did everything correctly — it executed exactly what was signed. The scam is upstream of the click.
“Drained” has become the catch-all word for crypto theft, but the drainer proper is a specific machine: a phishing site wired to a drainer kit — commercial software, rented out for a revenue share, that inspects a connecting wallet and generates whatever transaction or signature request will extract the most from it. Understanding that machine matters, because every defense against it happens before the signature. Afterward, the chain sees only a valid transaction you authorized.
The delivery: how you arrive at the site
The kit is generic; the lure is fitted to you. Compromised or impersonated project accounts announcing a surprise mint or claim. Fake airdrop pages seeded through replies and DMs. Sponsored search results sitting above the real site for a project's own name. Hijacked links in old pinned messages. Urgency is the common ingredient — claim in the next hour, limited allocation, migration deadline — because urgency is what makes people sign things they didn't read.
The extraction: what you actually sign
Once a wallet connects, the kit reads what it holds and serves the highest-value request it can dress up as routine:
Direct transfers — a transaction that simply sends your assets out, presented as a "claim" or "verification" step, counting on you not decoding it.
Approvals and delegations — a signature granting the drainer's contract the standing right to move your tokens, on EVM chains classically via unlimited approvals or Permit-style signatures, on Solana via token delegate or account-authority manipulations. Nothing visibly leaves at signing time; the theft executes minutes or days later, which decouples the loss from the click that caused it.
Off-chain-looking signatures — "sign this message to verify your wallet" requests that are actually structured orders or permits a contract will happily execute. The wallet UI saying "message" rather than "transaction" is not, by itself, safety.
The one-sentence model: a drainer converts interface trust into authorization. Every layer of the scam — the familiar branding, the countdown, the "verify" framing — exists to move your eyes off the only thing that matters: the literal content of the request your wallet is about to sign.
Fell for a token instead of a site? Check it
Drainer pages often push a “claim token” too — a scan reads what it really is before you touch it.
Being a hard target
Navigate, never follow. Reach project sites from your own bookmarks or typed URLs — not from search ads, DMs, replies, or even a project's own compromised announcement. The lure is the attack.
Read the request, not the page. The signing prompt is the last honest thing you'll see. Simulate or decode what it does; if the wallet can't tell you clearly, that's a decline.
Segregate. A mint/claim wallet holding pocket money interacts with new sites; the vault holds the stack and touches nothing novel. Segregation converts "drained" from a catastrophe into a bad afternoon.
Kill urgency by policy. Any deadline pressure on a signing decision is treated as disqualifying — real projects survive you taking ten minutes.
Audit standing permissions. Periodically review and revoke old approvals and delegations, because the drainer you signed for last month may not have executed yet.
If it already happened
Move anything unsigned-for immediately to a fresh wallet — drainers often leave assets they'll return for. Revoke every approval on the compromised wallet, then treat it as burned. Document transactions for reporting, and expect the follow-up scam: "recovery services" monitor drained wallets and DM victims offering to retrieve funds for a fee. Nobody can claw back an executed transfer; the recovery pitch is the second act of the same play.
Verify anything before it touches your vault
Tokens, claim pages, “new versions” — read first, sign later or never.
Frequently asked
How do wallet drainers steal funds without my seed phrase?
They get you to authorize the theft: a transaction dressed as a claim, an approval or delegate signature that grants standing transfer rights, or a “verification” message that's really an executable order. Your wallet performs exactly what was signed.
Why did my wallet drain days after I visited a site?
Approval- and permit-based drains decouple signing from execution — you granted the right earlier, and the operator exercised it later. That delay is deliberate: it hides which click caused the loss.
Can drained crypto be recovered?
Executed transfers are final; no service can claw them back. “Recovery” offers that DM drained victims are the follow-up scam targeting the same people. Move remaining assets to a fresh wallet, revoke approvals, and report.
What's the single best defense against drainers?
Wallet segregation plus reading requests: interact with new sites only from a low-value wallet, and treat the signing prompt — not the web page — as the only truthful description of what's about to happen.