What Is a Wallet Drainer? How Crypto Draining Scams Work and How to Stay Safe

A wallet drainer is a malicious script, usually hidden behind a fake mint, airdrop or support page, that empties a crypto wallet by getting the owner to sign a permission rather than by stealing a seed phrase. It follows one playbook: bait you with urgency, ask you to connect so it can scan your balances, then fire a signature request dressed up as a claim or verification — typically an unlimited ERC-20 approval, an off-chain Permit or Permit2 message, or setApprovalForAll over an entire NFT collection. Your private key never leaves your device; you hand over authority instead, which the attacker can redeem hours or days later. The whole defence therefore sits at the signing step: check the domain character by character, read what the wallet actually displays, and reject unlimited spending amounts, setApprovalForAll requests and spender addresses you cannot identify. WATS is fully non-custodial — you hold the keys and WATS never holds one — so nothing can leave a WATS wallet on any of its eight chains without a request you personally approved — which is exactly the moment to slow down and read before you sign.

What a wallet drainer actually is (and what it is not)

A wallet drainer is a malicious script, usually embedded in a website, that tricks you into authorizing transactions or signatures that hand your assets to an attacker. The important part is what it is not: it is not a blockchain hack, not a flaw in your wallet software, and in most cases it never sees your seed phrase. A drainer works entirely through the wallet's normal signing flow — it just gets you to approve something you did not understand.

Most drainers today are sold as ready-made kits, so the person running the fake site does not need technical skill. The kit detects which chain and tokens you hold, picks the most valuable target, and generates a tailored request. That is also what separates drainers from tricks like address poisoning, which manipulates what you copy rather than what you sign.

The anatomy of a draining attack: bait, connect, sign

Nearly every draining attack follows the same three steps. First comes the bait: a limited mint, an airdrop claim, a fake support page — anything with urgency. Second, the site asks you to connect your wallet. Connecting alone does not move funds, but it reveals your address, letting the drainer scan your balances and choose its attack. Third comes the sign step: the site fires one or more requests dressed up as a claim, verification, or mint. The moment you approve the wrong one, the drainer either moves assets directly or gains standing permission to move them later.

The signatures drainers want most

Drainers rarely ask for a plain transfer, because a transfer to a stranger looks suspicious. Instead they target permissions. An unlimited ERC-20 approval lets the attacker's contract spend a token from your address indefinitely. A Permit or Permit2 signature does the same thing with an off-chain message that costs the victim no gas and can be quietly redeemed later. And setApprovalForAll grants control over an entire NFT collection in a single click. How these mechanisms work legitimately — and why they exist at all — is covered in our guide to token approvals and Permit. On Solana, the equivalent tricks involve token delegate assignments or even account ownership changes bundled into an innocent-looking transaction.

Common delivery channels

The drainer itself is just a payload; the real work is getting you to the page. As of 2026, the most common routes are fake mint and airdrop sites that clone a real project's branding, hijacked social accounts of projects or founders posting a "surprise claim" link, poisoned search ads that place a lookalike domain above the real one, and fake support agents in Discord or X replies who send a "verification" link after you post about a problem. All of them share one trait: the link comes to you with a reason to hurry.

Why one bad signature can empty a wallet without your seed phrase

People assume their funds are safe as long as the seed phrase stays private. Approvals break that assumption. When you sign an approval or a Permit message, your key never leaves your device — but you delegate authority over specific assets to a contract address. If that address belongs to an attacker, they can drain the approved tokens at any time, from anywhere, without any further action from you. This is also why draining can happen hours or days after the visit: the attacker redeems the stored permission when it suits them.

Red flags to check before you connect or sign

A few habits defeat most drainers. Check the domain character by character — lookalike domains are the industry standard for bait sites. Treat any unsolicited link with a deadline as hostile until proven otherwise. Before approving, read what the wallet actually displays: an unlimited spending amount, a setApprovalForAll request, or a spender address you cannot identify are all reasons to reject. Be especially wary of requests to sign raw hexadecimal data you cannot read. If your wallet offers transaction simulation or a human-readable preview, use it every time — a claim page that "needs" a token approval is asking for something a claim does not require.

What to do if you signed something malicious

Act on the assumption that the permission will be used — and let what you signed decide the order of operations. If it was an off-chain Permit or Permit2 message that has not been redeemed yet, there is no on-chain allowance to revoke, and pre-emptively zeroing the token allowance does not protect you: the attacker's later redemption simply writes a fresh allowance over it (Permit2 revocations likewise live on the Permit2 contract, not the token). For a signed-but-unredeemed Permit, the reliable first step is moving the covered assets to a fresh wallet with a newly generated key. For on-chain approvals and setApprovalForAll, revocation does work: use a reputable revocation tool or your wallet's approval manager to set the malicious spender back to zero for every affected token and collection, then relocate anything high-value. If you only signed permissions, your seed phrase is still secret and the old wallet is usable once cleaned up — but if you ever typed your seed phrase into a website, the wallet is permanently compromised and everything must move immediately.

How WATS fits in

The WATS Hot Wallet is built around the same principle this whole article rests on: the signature is the security boundary. WATS is fully non-custodial — you hold your keys, and WATS never holds a key — so nothing leaves your wallet without a request you approved yourself, and there is no third party who could co-sign on your behalf or reverse an approval afterwards. One WATS wallet covers Ethereum, Arbitrum, Optimism, Base, Polygon, BNB Chain, Solana and TON, so the habit of reading a request before approving it stays identical across all eight chains instead of changing app by app.

Fees also work differently from most wallets, and it matters here for a mundane reason. Network fees can be paid in a single token, ATS, instead of each chain's native gas token — using ERC-4337 account abstraction on EVM chains and LayerZero OFT to move omnichain, with collected ATS burned from a 100M supply toward a 30M floor. That is not a discount; it changes which token pays the fee, not the underlying cost. What it does change day to day is that you are not scrambling to top up a native gas token mid-flow on an unfamiliar chain — and that kind of scrambling is exactly the hurried state drainers are built to exploit.

Two limits, stated plainly, because a security article should not oversell: WATS does not ship an approval-revocation tool of its own, so for approvals you have already granted, use a reputable third-party revoker. And the WATS NFC Metal Card stores no private keys — it tap-authenticates to keys that live inside the WATS apps — so it protects device access, not you from a signature you chose to approve.

Bottom line

A wallet drainer does not break cryptography. It borrows your consent, then spends it later. Every defence in this article collapses into one habit: know what you are signing before you sign it, and treat unlimited approvals, setApprovalForAll and unreadable hex as a stop signal rather than a formality. The concrete step is to hold your keys somewhere you sign from deliberately — install WATS from the download page, write down the seed phrase it generates offline and never type it into a website, and read every approval request WATS shows you across Ethereum, Arbitrum, Optimism, Base, Polygon, BNB Chain, Solana and TON. That prompt is where the money is actually won or lost.