Wallet Drainers & Approval Scams: How to Stay Safe

A wallet drainer is a scam that tricks you into signing a transaction or token approval that lets an attacker take your crypto — no seed phrase required. Instead of stealing your keys, it gets you to hand over permission, often through a fake website, airdrop, or 'connect wallet' prompt. These attacks are among the most common ways self-custody users lose funds today.

This guide explains how drainers and approval scams work, how to spot them, and how to revoke dangerous permissions. It's security education, not financial advice.

How wallet drainers work

Wallet drainers work by getting you to approve a malicious transaction, not by stealing your seed phrase. You land on a convincing site — a fake airdrop, a lookalike app, a 'claim' or 'validate' page — connect your wallet, and click a button that actually signs a transfer or grants token access. The wallet does exactly what you told it to; the theft is your own signature turned against you.

Because they exploit permission rather than keys, drainers work even on hardware wallets: if you physically approve a malicious transaction, the device signs it. That's why 'I use a hardware wallet' isn't a complete defense. Understanding what you're signing is the only reliable protection, and it's a habit you can learn.

Token approvals — the hidden risk

A token approval lets an app move a specific token on your behalf, and scammers abuse it by requesting unlimited approvals you never revisit. You grant it to interact with a service, forget about it, and the permission stays live indefinitely — so a malicious or later-compromised contract can drain that token whenever it likes, long after you've moved on.

The fix is to grant only the approvals you actually need and to revoke old ones periodically using a reputable approval-checker tool. Treat every approval request as a question: 'what exactly am I allowing, for which token, and up to how much?' If the amount is 'unlimited' and you don't need it to be, that's a flag.

Signature phishing

Some scams skip approvals and ask you to sign a message that authorizes transfers behind the scenes. A pop-up asks you to 'sign to log in' or 'verify ownership', and the signature actually permits a drainer to move assets. Legitimate sign-in signatures do exist, which is exactly what makes this technique effective and hard to spot.

Be suspicious of any signature request you didn't clearly initiate, especially on a site you reached from a link, ad, or direct message. If you can't explain in plain words what a signature or transaction does, don't sign it — a moment's hesitation is cheaper than a drained wallet.

How to spot and avoid drainer scams

Most drainer scams share tells: urgency, free money, and a request to connect and approve. Slow down when you see them, and verify the site independently before connecting a wallet that holds real funds.

• Fake airdrops and claims: 'you're eligible, connect to claim' — a classic bait that leads to a malicious approval.
• Lookalike sites: a domain one letter off from the real app; reach apps via your own bookmarks, not ads or search.
• Urgency: 'act now or lose it' pressure designed to stop you thinking it through.
• Unexpected approvals: a simple action suddenly asking for broad, unlimited token permissions.

A 'burner' wallet holding little, used for trying new apps, plus a separate wallet for savings, limits the damage if you ever slip. Compartmentalizing is one of the most effective habits in self-custody.

What to do if you've been drained

If you've approved a malicious transaction, move any remaining funds to a new, secure wallet immediately and revoke the attacker's token approvals. Speed matters, because live approvals can be reused to take more later. Don't waste time on 'recovery services' that appear in your DMs — they're a second scam preying on fresh victims, and no one can reverse an on-chain theft.

Then rebuild safely: a fresh wallet with a properly stored seed phrase, tighter habits around what you sign, and ideally a hardware wallet for savings. The best crypto wallets ranked on security and custody can help you choose, and seed-phrase security and scams covers the phrase-stealing attacks that drainers don't.

Red flags to memorize

Most drainer attacks announce themselves if you know the signals. Commit a short list to memory and you'll catch the majority before they cost you anything. The recurring flags are unsolicited contact, free-money offers, artificial urgency, and any request to connect a wallet or approve a transaction you didn't set out to make.

• Unsolicited DMs or emails about airdrops, support, or 'wallet issues' — real services don't reach out this way.
• 'Claim' or 'validate' pages that need you to connect and approve to receive something free.
• Urgency and countdowns engineered to rush you past your own judgment.
• Approvals that don't match the action — a simple task asking for unlimited token access.

Building safer habits

The strongest defense isn't a tool, it's a routine: reach apps through your own bookmarks rather than ads or search, keep a separate 'burner' wallet for experiments, and read every approval and signature before confirming. None of that is technical — it's just deliberate, and it defeats the whole category of approval scams.

Pair those habits with periodic approval reviews and a hardware wallet for savings, and you've closed the doors drainers rely on. For the phrase-stealing scams that work differently, see seed-phrase security and scams.

Why drainers keep working

Drainer scams persist because they exploit people, not code: they borrow trust from a familiar brand, manufacture urgency, and dangle free money, so that a normally-careful person clicks and signs before thinking. The underlying wallet and blockchain worked perfectly — the attacker simply got a valid signature from you, which is exactly what makes these scams so hard to reverse.

That's also why the defense is behavioral rather than technical. Slow down on anything unsolicited, verify sites independently, keep experiments in a burner wallet, and treat every signature as a decision rather than a formality. Combine that with a hardware wallet for savings and periodic approval reviews, and you remove nearly every opening a drainer relies on. Choose a solid base wallet from the best crypto wallets ranked on security and custody.