Crypto drainers: how one signature empties a wallet

Industry / situation. Updated 2026-09-13. About 5 minutes to read.

If you typed your recovery phrase into any website, revoking approvals will not help: move everything that remains to a brand new wallet with a new recovery phrase immediately.

A crypto drainer is a malicious website script that asks your wallet to sign something that looks routine. The signature quietly gives the attacker permission to move your tokens or NFTs. No password is stolen, because your signature is the permission.

Drainers sit alongside a much larger crypto fraud problem. The FBI recorded 11.37 billion dollars in cryptocurrency-related losses in 2025, and 4.35 billion of that came from people aged 60 and over. This guide explains how drainers work, how to check and revoke approvals, and what to do if your wallet has already been hit.

How a drainer attack unfolds

  1. The lure: a fake airdrop, a limited mint, a reply under a popular post from a hacked account, a sponsored search result, or a 'support agent' in your direct messages.
  2. The connection: you connect your wallet to the site. Connecting alone usually only shares your address, which lets the script see what you hold.
  3. The disguised request: the site asks you to 'verify ownership', 'claim rewards' or 'sync your wallet'.
  4. The permission: what you actually sign is a token approval with an unlimited allowance, a setApprovalForAll that covers a whole NFT collection, or an off-chain Permit or Permit2 signature that costs no gas and looks like a simple message.
  5. The drain: the script moves your most valuable assets first, often within seconds.
  6. The laundering: funds are swapped and bridged across chains within minutes, which makes freezing them difficult.

Prompts and phrases that give it away

  • 'Connect your wallet to check your airdrop eligibility.'
  • 'Your wallet needs to be validated or synchronised to avoid suspension.'
  • 'Enter your 12 or 24 word recovery phrase to restore access.' No legitimate site or support agent ever needs it.
  • A signing request that mentions Permit, setApprovalForAll, increaseAllowance, or a spender address you do not recognise.
  • A 'sign to continue' message on a site you reached through a link, with no transaction preview.
  • Your wallet showing a security warning that the request may be deceptive.
  • A support account that contacts you first. Real support teams do not open conversations in your direct messages.

Off-chain signatures are the trap most people miss. MetaMask warns that attackers obtain an off-chain signature and use it later to steal assets, so a request with no gas fee is not harmless.

Check and revoke approvals

  1. Use a device you trust and type the address of the tool yourself rather than following a link.
  2. Open a token approval checker. Etherscan, BscScan and Polygonscan each have one, and Revoke.cash covers many networks. You can review approvals by entering your public address before connecting anything.
  3. Look for unlimited allowances and collection-wide NFT approvals, especially for spender contracts you do not recognise or recently interacted with.
  4. Connect your wallet and revoke each suspicious approval. Every revocation is an on-chain transaction, so you pay a gas fee for each one.
  5. Repeat the check monthly for any wallet you use with decentralised apps.

If your wallet was drained or you entered your recovery phrase

  1. Create a new wallet with a new recovery phrase on a clean device, ideally a hardware wallet. Do not import the old phrase.
  2. Move any remaining assets from the compromised wallet to the new one. If the old phrase was exposed, anything sent there, including gas, can be taken by an automated sweeper.
  3. Record transaction hashes, the attacker's receiving addresses, the site address and screenshots.
  4. If funds went to a centralised exchange, contact that exchange's fraud team with the transaction hashes. Exchanges can sometimes freeze deposits.
  5. Report it. US: ic3.gov. Australia: ReportCyber at cyber.gov.au and Scamwatch. England, Wales and Northern Ireland: Report Fraud on 0300 123 2040, or Police Scotland on 101. Canada: the Canadian Anti-Fraud Centre on 1-888-495-8501.
  6. Ignore anyone who offers to recover the crypto for a fee. The FBI has warned about fictitious law firms targeting crypto scam victims with exactly this pitch.

Habits that stop most drainers

  • Keep savings in a hardware wallet or a wallet you never connect to new sites. Use a separate hot wallet with a small balance for mints and airdrops.
  • Reach projects through bookmarks, not links in replies, direct messages or search ads.
  • Read the signing screen. If you cannot tell what a request allows, reject it.
  • Turn on your wallet's security alerts and keep the wallet app updated.
  • Never type your recovery phrase into a website, a form, or a chat, and never store it as a photo.

Protect a relative who is new to crypto

Older relatives are more likely to meet crypto through a scam than through an exchange. In Australia, cryptocurrency was the payment method behind the largest share of losses reported to Scamwatch in 2025, 121.3 million dollars. The usual path is an online contact who suggests an investment platform or asks for payment at a crypto ATM.

Agree a simple rule: nobody legitimate asks you to pay a bill, a fine or a fee in crypto, and nobody legitimate needs a recovery phrase. If a relative holds crypto, help them set up a hardware wallet and write the phrase on paper kept somewhere safe.

Frequently asked questions

Can someone drain my wallet just because I connected it to a site?

Usually not. Connecting shares your address. The theft happens when you sign an approval, a permit, or a transaction the site presents, or when you enter your recovery phrase.

Will revoking an approval get my tokens back?

No. Revoking only stops future transfers using that approval. Tokens already moved are gone unless an exchange or law enforcement can freeze them.

Is a hardware wallet enough to stop drainers?

It helps a lot, because signing needs the physical device and it can show clearer details. It does not stop you approving a malicious request, so you still need to read what you sign.

Can police reverse a crypto transaction?

Blockchain transactions cannot be reversed. Police and exchanges can sometimes trace and freeze funds that land on an exchange, which is why reporting quickly with transaction hashes matters.

Someone on social media says they can recover my stolen crypto. Should I pay?

No. Crypto recovery offers that require an upfront fee are scams. Report the theft to law enforcement and the exchange instead.

Tools that help

Related guides

Sources