Inside the Crypto Wallet Drainer: How One Signature Empties a Wallet

A crypto wallet drainer does not need to break cryptography or steal a seed phrase. It persuades the wallet owner to authorise the theft, usually through a token approval or an off-chain signature that looks routine in the wallet pop-up.

This guide explains how drainer kits work on-chain, how they are packaged and sold, how fake trading tools deliver them, and which controls stop them.

You will learn the difference between approval-based and key-theft drainers, what to look for in a signing request, how to audit and revoke approvals, and how security teams supporting crypto users or developers can detect the delivery stage.

What a crypto wallet drainer is and why it works

A drainer is a phishing kit built around smart contract permissions. The victim connects a wallet to a malicious site, the kit enumerates the wallet’s balances, and it then requests whichever permission will move the most value.

Once the victim approves, the attacker’s contract or backend sweeps the assets, often within seconds.

The approach works because Ethereum-compatible tokens are designed to let third parties spend on your behalf. Decentralised exchanges, lending protocols and NFT marketplaces all depend on that delegation.

A drainer abuses the same mechanism, so from the blockchain’s point of view the transfer is fully authorised and cannot be reversed.

The scale in numbers

Scam Sniffer’s annual report counted $83.85 million in wallet-drainer phishing losses across 106,106 victims in 2025, down 83% from $494 million in 2024. The largest single 2025 theft, $6.5 million, came from one Permit signature.

Fewer dollars lost does not mean fewer attempts: the same data shows victim counts peaking at more than 15,000 a month in August and September 2025.

How malicious token approvals and signatures drain wallets

Most drainer losses trace back to a small set of permission types. Knowing what each one grants is the most useful skill a wallet user or analyst can have.

Permission type	What it grants	Why drainers favour it
approve / increaseAllowance	Lets a spender move up to a set amount of one ERC-20 token	Kits request unlimited allowances, which persist until revoked
setApprovalForAll	Lets an operator move every NFT in a collection	One click exposes an entire collection
Permit / Permit2 (EIP-2612, Uniswap Permit2)	Off-chain typed-data signature that authorises spending	No gas, no on-chain transaction shown; looks like a harmless “sign message”
EIP-7702 delegation	Points an externally owned account at contract code	Scam Sniffer recorded two batch cases totalling $2.54 million in August 2025
Direct transfer	Sends native coin or tokens immediately	Used when the victim holds mostly ETH or another native asset

MetaMask’s own guidance on what a token approval is makes the key point: an approval stays valid after you leave the site. A wallet can be emptied weeks later by a contract the owner has forgotten about.

Illustrative attack chain: a Permit2 drain

The following sequence is illustrative and simplified, but it reflects how approval phishing generally unfolds.

1. The victim lands on a cloned airdrop or “claim rewards” page from a social media reply or a hijacked Discord invite.
2. The page calls eth_requestAccounts, then queries balances through a public RPC or indexer to rank the most valuable tokens.
3. For a token that already has a Permit2 allowance, the kit requests an eth_signTypedData_v4 signature for a PermitBatch naming the attacker as spender with a far-future expiry.
4. The wallet shows a typed-data prompt. There is no gas fee, so many users treat it as a login.
5. The backend submits the signature to Permit2’s permitTransferFrom and moves the tokens to a short-lived collection address, then on to swaps and bridges.

In MITRE ATT&CK terms the delivery maps to Phishing (T1566) and User Execution (T1204); the signature itself has no clean ATT&CK equivalent because it is an authorised on-chain action rather than malware execution.

Drainer-as-a-service: how the kits are sold

Drainers are run like software businesses. Developers maintain the kit, the smart contracts and the cash-out pipeline, while affiliates bring traffic through phishing sites, fake airdrops and social media impersonation.

Check Point Research’s analysis of the Inferno Drainer resurgence (2025) found more than 30,000 victim wallets and at least $9 million stolen between September 2024 and March 2025, with operators keeping roughly 15-20% of each theft as commission.

The same research shows why blocklists struggle. Inferno stored configuration on Binance Smart Chain, wrapped traffic in multiple AES layers, rotated phishing domains every few days and deployed single-use contracts at pre-computed addresses.

Earlier coverage of crypto drainers in sophisticated phishing attacks describes similar affiliate tooling, and attackers have also hijacked legitimate websites to inject drainer scripts so that a trusted domain serves the wallet prompt.

Common lures

• Fake airdrops and token claims promoted in replies to real project accounts.
• Discord “verification” bots that imitate legitimate wallet-gating tools.
• Paid social ads promising easy profits, as in the case of a user who lost $9,000 after clicking an Instagram ad.
• Malicious “arbitrage” or MEV contracts that victims fund themselves, a variant covered in reporting on smart contracts weaponised to drain more than $900k.

Fake trading tools as a delivery channel

Prediction markets and copy-trading have created a second route that skips the wallet prompt entirely. Instead of asking for a signature, attackers distribute “trading bots” that read the private key from the user’s machine.

Researchers have documented fake tools impersonating major prediction platforms, and the lures often piggyback on real promotions, so a search for a Polymarket invite code or a bot tutorial can lead users to look-alike repositories.

Case example: a hijacked GitHub organisation

StepSecurity reported in March 2026 that a malicious Polymarket copy-trading bot was hosted inside a hijacked, verified GitHub organisation. The bot really connected to Polymarket’s APIs, but its dependencies included typosquatted npm packages.

A postinstall hook searched for .env files, Solana id.json keypairs and config files, posted them to endpoints disguised as Cloudflare services, and opened inbound SSH on the host.

This is the same pattern seen in the clipboard-hijacking malware campaign that swapped copied wallet addresses: the theft happens on the endpoint, not in the browser. It maps to ATT&CK Supply Chain Compromise (T1195.001) and Credentials In Files (T1552.001).

Developer-focused variants have also arrived as editor plug-ins, such as the Solidity Pro VS Code extension that stole wallets and SSH keys.

How to revoke approvals and audit wallet exposure

Every active allowance is standing risk. Reviewing and revoking them should be routine for anyone holding meaningful value in a hot wallet.

1. List allowances. Use a block explorer’s token approval checker or an approval-management tool for each chain you use. Note spender address, token and amount.
2. Revoke anything unlimited or unknown. Revoking sends an approve(spender, 0) transaction or the equivalent for NFTs, and costs gas.
3. Check Permit2 separately. Permit2 keeps its own allowance table, so a token can show “approved to Permit2” while the real exposure is the per-spender Permit2 allowance underneath.
4. Check EIP-7702 delegation. If an account shows delegated code you did not set, treat the account as compromised.
5. If a drain is in progress, move remaining assets to a fresh wallet generated on a clean device. Revoking does not help if the private key itself was stolen.

Revocation is preventive. Once tokens have moved, recovery depends on exchange freezes and law enforcement, so report quickly to the exchange receiving the funds and to the FBI’s IC3 or your national equivalent.

Detection and hardening for users and security teams

Individual users carry most of the risk, but organisations that hold treasury wallets, run Web3 products or employ smart contract developers can add controls at several layers.

For wallet holders

• Split funds: a hardware wallet for storage, a low-balance hot wallet for connecting to new sites.
• Read typed-data prompts. A Permit, PermitBatch or PermitSingle with an unfamiliar spender is a transfer authorisation, not a login.
• Enable transaction simulation or a wallet security extension that shows the expected balance change before signing.
• Keep the browser current; a wallet extension is only as safe as the browser hosting it, and patching Chrome remote-code-execution vulnerabilities promptly closes a direct path to extension storage.

For SOC and engineering teams

• Monitor treasury and hot wallets for new approvals, Permit2 allowances and EIP-7702 authorisations, and alert on any spender not on an allow-list.
• On developer endpoints, alert on npm or pip install scripts that read .env, id.json or keystore files, or that run sudo.
• Block execution of unvetted “trading bots” on machines that hold signing keys, and keep production keys in an HSM or MPC custody service.
• Map controls to NIST CSF 2.0: Protect (PR.AA identity and access, PR.PS platform security) and Detect (DE.CM continuous monitoring).

An illustrative endpoint hunting query (EDR pseudo-SQL) for the trading-bot pattern looks like this:

SELECT device, parent_process, process, command_line, file_path
FROM file_events
WHERE parent_process IN (‘node’,’npm’,’python’,’pip’)
  AND file_path MATCHES ‘(\.env$|id\.json$|keystore|\.ssh/)’
  AND process_tree CONTAINS ‘postinstall’

Key takeaways

• A crypto wallet drainer steals by obtaining a valid approval or signature, so the blockchain treats the theft as authorised.
• Permit and Permit2 signatures are the highest-risk prompts because they cost no gas and look like logins.
• Drainer-as-a-service splits work between kit developers and affiliates, and constant infrastructure rotation limits blocklists.
• Fake trading bots skip the wallet prompt and steal private keys straight from disk through malicious dependencies.
• Regularly revoking approvals and separating storage from hot wallets limits the damage of a single mistake.

FAQ

How does a crypto wallet drainer steal funds without my seed phrase?

It asks you to sign a token approval, a Permit signature or a transfer. That signature gives the attacker’s address permission to move your tokens, so no key or seed phrase is needed.

Does revoking token approvals get my crypto back?

No. Revoking only stops future transfers by that spender. Funds already moved can only be recovered if an exchange or issuer freezes them, which is why fast reporting matters.

Is it safe to sign a message that costs no gas?

Not automatically. Off-chain typed-data signatures such as Permit2 cost nothing to sign but can authorise transfers of your entire token balance.

How do I know if a trading bot on GitHub is malicious?

Check who committed the code, compare dependency names against the real packages, look for install scripts, and never run it on a machine that holds wallet keys. Stars and a polished README are easy to fake.

What should I do right after connecting to a drainer site?

Disconnect, review and revoke any new approvals, and move remaining assets to a new wallet created on a clean device if you entered a seed phrase or ran downloaded software.