← Crypto Scam Library · Risk checks · Research
By Verixia Research · reviewed 2026-08-05 · educational — not financial advice
A wallet drainer is a script that, once you sign a specific transaction or message, moves your tokens or NFTs out. It never needs your seed phrase. The whole attack is getting you to approve something whose real effect is hidden behind an innocent-looking prompt — 'claim airdrop', 'verify wallet', 'mint free NFT'.
The dangerous action is usually a token approval (granting a contract permission to spend your tokens) or a signature like Permit/Permit2 that authorizes spending off-chain. Malicious sites request an unlimited approval; the drainer contract then transfers your balance at its leisure. Some use setApprovalForAll to take entire NFT collections in one signature.
Because approvals persist, a signature you gave months ago can still be live exposure today.
A site pushing you to 'connect and verify' urgently; a wallet prompt requesting approval or signature for a site that shouldn't need it; a signature request you can't read; unlimited-amount approvals; anything arriving via DM, fake support, or a lookalike domain.
Read every signature and approval — reject anything you can't explain. Prefer exact-amount approvals over unlimited. Periodically review and revoke old approvals with a revoke tool. Bookmark real dapp URLs and never reach them through DMs or ads.