Last updated: October 17, 2026
A wallet drainer is a malicious website or script that tricks you into connecting your wallet and signing a transaction or token approval, which then lets the attacker move your tokens out — often everything at once. Drainers hide behind fake airdrops, mint pages, phishing ads and cloned dApps, mostly on Ethereum, BNB Chain, Solana and other smart-contract chains. The safest swaps never ask you to connect a wallet at all: a no-KYC instant exchange only needs you to send a deposit, as in ETH → XMR.
- 1 signature can empty a wallet
- 0 wallet connections in an instant swap
- Unlimited approvals are the main risk
- Revoke old approvals regularly
How wallet drainers work
- Lure: a fake airdrop, "claim your reward", a sponsored search ad or a cloned DeFi site.
- Connect: you connect your wallet — this alone is usually harmless.
- Sign: the site asks you to sign something that looks routine: an "approve", "permit", "setApprovalForAll" or an off-chain signature message.
- Drain: that signature authorizes the attacker's contract to transfer your tokens or NFTs, immediately or later.
Dangerous signatures at a glance
| What you're asked to sign | What it can do |
|---|---|
Token approve with unlimited amount | Lets a contract spend all of that token, any time |
permit / Permit2 off-chain signature | Same as an approval, without an on-chain transaction you'd notice |
setApprovalForAll | Gives control of all your NFTs in a collection |
| Blind / unreadable message signing | Can hide any of the above |
| Solana transaction with many instructions | Can transfer several tokens in one go |
How to protect your wallet (step by step)
- Don't connect your main wallet to unknown sites. Use a separate "burner" wallet with small funds for new dApps.
- Read every signature request. If you can't tell what it does, reject it.
- Avoid unlimited approvals; set exact amounts when the wallet allows it.
- Revoke old approvals with a token-approval checker for your chain.
- Use a hardware wallet and check the details on its screen — self-custody done right (see not your keys, not your coins).
- Ignore "free airdrop" DMs and sponsored search ads — type URLs yourself or use bookmarks. See how to spot a fake exchange.
Swapping without connecting a wallet
DEXs and bridges require connecting your wallet and signing approvals — which is exactly what drainers abuse (more in swap vs bridge). An instant exchange works differently: you send coins to a deposit address and receive the new coin to an address you paste. There is nothing to approve, so no contract ever gets spending rights over your wallet. Compare exchanges by their no-KYC track record and double-check addresses (address poisoning).
What to do if you've been drained
- Move remaining assets to a brand-new wallet with a new seed immediately.
- Revoke all approvals on the compromised wallet.
- Assume the seed is safe only if you never typed it anywhere — if you did, the whole wallet is compromised.
- Report it to the platform where you found the link and, for stablecoins, to the issuer — frozen funds are occasionally recovered.
- Beware "recovery services" that ask for fees up front — a common follow-up scam.
Frequently asked questions
What is a crypto wallet drainer?
A malicious website or script that tricks you into signing a transaction or approval that lets attackers transfer your tokens out of your wallet.
Can connecting a wallet drain it?
Connecting alone usually only shares your address. The danger is the signature or approval you're asked for next — reject anything you don't fully understand.
How do I revoke token approvals?
Use a token-approval checker for your chain, connect the wallet, review the list of contracts with spending rights and revoke the ones you don't need.
Are instant swaps safe from drainers?
Yes, in that sense: an instant swap only needs you to send a deposit — there are no approvals or signatures that grant spending rights over your wallet.
Does Monero have wallet drainers?
Monero has no smart-contract approvals, so drainers of this kind don't apply. The main risks are phishing for your seed and malware.
Swap without connecting your wallet: ETH → XMR, ETH → BTC or all no-KYC pairs. No account, no ID, no logs.