A wallet drainer is malicious code hidden on a phishing website. It does not steal your private keys directly. Instead, it tricks you into signing a transaction or approval that hands an attacker permission to move your tokens and NFTs.
How a drainer works
You land on a site that looks exactly like a service you trust. Your wallet pops up asking for a signature. The request looks routine, so you approve it. In that moment you may have granted the attacker access to your entire token balance or NFT collection.
The signatures that empty wallets
- setApprovalForAll — a single signature that grants access to your entire NFT collection.
- Unlimited token approvals — permission to spend far more than the transaction suggests.
- Permit and Permit2 — gasless approvals that act like a spend permission but never appear in your transaction history.
- Blind eth_sign — signing arbitrary data that legitimate sites almost never request.
How to protect yourself
Always verify the domain before connecting your wallet. Read every signature request and reject anything you do not understand. Never enter your seed phrase on a website. Use a security tool that blocks known phishing sites and explains dangerous signatures in plain language before you approve them.