Wallet drainers

The page wants a signature, not your password

A drainer is a site that asks a wallet to approve a spender, sign a permit, or confirm a transaction that moves tokens. The page may look like a mint, a claim, a job task, wallet support, or a captcha with a connect button. You do not type a seed phrase. You press confirm in a wallet you trust, and that confirmation is the theft. This page will not describe how those contracts are written. Recognizing the ask is the useful part.

Connecting a wallet usually reveals your address and lets the site request signatures later. The connection itself is not the transfer. The next prompt is. If you connected and nothing has been signed, you are not yet drained. Disconnect the site before you wander into a second button. If a prompt is already on screen and you do not know what it does, reject it. You can always be asked again. You cannot always unsign.

Approvals, permits, and set-approval-for-all

An ERC-20 approval lets another address move that token up to an amount you set. Wallets and sites often offer unlimited, because it avoids a second approval later. Unlimited means later is whenever they want, until you revoke. The spender is the party who receives the right. If you do not recognise the spender, you are giving a stranger a withdrawal slip. Read the token and the spender. A familiar token with an unfamiliar spender is still a stranger.

A permit is a signature, often EIP-2612 typed data, that authorises the allowance without a separate on-chain approval transaction. It can look like 'sign a message' rather than 'send a transaction', and people treat messages as harmless. A message that sets a spender and an amount is not a guestbook. NFT collections use a different call, setApprovalForAll, which lets an operator move every token in that collection. A marketplace you use may ask for this. A site you opened from a direct message should not get it. Solana does not use these Ethereum calls. A Solana drain is still a transaction you sign, sometimes a token delegate. The wallet preview is the object to read, not the chain's vocabulary.

What the prompt is supposed to show

A usable wallet shows the kind of request, the token, the amount or 'unlimited', and some form of the counterparty. Some wallets also simulate the balance change. A simulation is a preview, not a promise, and this site has not certified any wallet's simulator. If the preview shows tokens leaving and you meant to claim tokens arriving, reject it. If the preview is a hash and a note that says 'trust this site', you do not have a preview. Reject it.

A hardware wallet moves the same request onto a device screen when the software passes the fields through. It does not know that the website is a copy. It will sign a perfect approval of a thief if you confirm the thief's address. Read the device. A blank screen, or a screen you were told to click without reading, is the moment the hardware stopped helping. The URL still has to be checked on the computer. The device does not display the website's domain.

How people arrive there

The usual doors are a search ad, a reply under a real project, a QR code, and a token that appeared in the wallet with a website in its name. The fake-airdrop page is that last door. Address poisoning is the door that waits in your history. A support impersonator is the door that asks you to 'reconnect' so they can fix a stuck withdrawal. None of these parties need a signature to give you something that is already yours. A real exchange withdrawal is a form on the exchange, reached from your bookmark, and it does not ask your wallet to approve a spender.

Job tasks and 'complete this mint to get paid' are the same signature wearing a payroll costume. A countdown is there to stop you reading the spender. There is no prize that expires in four minutes and also requires unlimited access to your USDC. If the asset matters, the offer can wait until you have read the host and the prompt in daylight.

If you already signed

Disconnect the site in the wallet. If you approved a token, revoke that approval using a revocation page you reached by typing the host yourself, not by a link in the same message that scammed you. This site does not operate a revoker and does not audit the public ones. A well-known public revoker is still a website. Read its host before you connect. Revoking is itself a transaction. It costs a network fee. It does not pull back tokens that already moved.

Move what remains to a new wallet with a new recovery phrase if the old wallet signed something you do not understand, and immediately if you typed the phrase anywhere. The old phrase is burned if it left your paper. An approval that is still live can empty the old address even after you think you are done, which is why the revoke and the move are both worth doing. Do not pay a stranger who offers to recover the coins. Confirmed transfers do not have a chargeback. The token checker can tell you about a contract you pasted. It cannot undo a signature, and it does not want your phrase.

Revoke, then decide whether the address is finished

An allowance sits on the token contract until it is replaced or the tokens are gone. Disconnecting the site in the wallet's connected-sites list stops that site from asking again in that browser. It does not set the allowance back to zero. The revoke is a transaction to the token, from a page whose host you typed. If you cannot find a revoker you are willing to trust, moving the remaining tokens to a fresh address also leaves the old allowance behind, because the allowance points at the old address. The fresh address has no allowance until you create one. The old address is empty only if you moved everything the spender could have taken.

Write down the transaction ids of the revoke and the move. They are how you later show what you did. They are not a refund ticket. Store them with your notes, not in a reply to the scammer. A block explorer you opened yourself will show those ids. A link the scammer sends will not be the one you want. Type the explorer's host.

Do the move in this order when the amount matters. Revoke the allowances you can identify, or skip straight to the new wallet if you do not trust yourself to find them all. Send a test to the new address, from the old one, to an address you displayed on the new wallet and compared in full. Then send the rest. Do not pause on a claim page that appeared while you were moving. That page is how a second signature lands during the cleanup. If the seed was typed into any form, skip the revoke as your only step. The keys are copied. A new phrase is the cleanup. The old address is abandoned.

Network fees are due on the revoke and on the move. A wallet with no native coin cannot pay them. You may have to bring a small amount of the chain's fee token in from an exchange, to the old address, which is safe only if you do it without signing anything else along the way. This is fiddly on purpose. A helper in your inbox who offers to pay the gas if you share the phrase is taking what is left.

Questions

Is a limited approval safe? Safer than unlimited, because the spender can only take the amount you set. It is still a transfer right. Set it for a spender you meant, for an amount you meant, on a host you checked. A limited approval to a thief still pays the thief, up to the limit.

I only signed a message. Am I fine? Not if the message was a permit or another authorisation. Open the wallet's activity and the token's approvals from a page you typed. If an allowance appeared, revoke it. If nothing appeared and no tokens moved, you may have signed something harmless, and you still disconnect the site.

Will a hardware wallet save me next time? It saves you when you read it and reject a bad prompt. It does not save you when you confirm. It does not save a phrase you typed into the drainer's 'restore' form. That form is not a signature. It is the keys.

Can the checker detect a drainer site? No. It scores a token contract. The drainer is a hostname and a signature. Check the host. Read the prompt. Use the checker only when you have a contract address and you have not been asked to connect.