Drainer kits: what the victim sees, and what is actually running

Wallet drainers stopped being bespoke code years ago. They are sold as a service: the developer supplies the kit and the infrastructure, the operator supplies the traffic, and they split what comes out. That commercial shape explains every design decision in them, and those decisions are what you can learn to recognise.

What connecting actually does

Connecting a wallet to a site grants a read: your address, and from it your balances, your NFTs and your transaction history. It moves nothing and authorises nothing.

The drainer uses that read as reconnaissance. Within a second of connecting it has:

• Every token you hold and its market value.
• Your NFTs and their floor prices.
• Which of your assets already have approvals in place.

It then asks for one signature — the one worth the most. Not a menu, not a sequence. A kit that asks twice loses more victims than it gains.

The signature it will ask for

Ranked by how often they appear, and none of them is a transfer:

Permit / Permit2. An off-chain signature authorising a token allowance. No gas, no pending transaction, nothing in your history until it is used. This is the preferred one precisely because it does not look like a payment.

setApprovalForAll. For NFTs. One confirmation hands over an entire collection.

A batched call through a contract that performs several transfers in one confirmation, presented as "claim" or "verify".

eth_sign. A raw hash with no context. Rare now because wallets warn loudly, and a red flag on its own.

The common property: all of them keep working after you close the tab. A drainer that needed you to stay on the page would be a much smaller business.

Why the site looks right

The kits ship with the parts that are expensive to fake:

• Real branding and layout, cloned from the protocol being impersonated.
• A valid certificate, because certificates are free and take minutes.
• A working front end — the buttons do things, the balances shown are your real balances.
• A plausible reason to sign: an airdrop claim, a migration, a revocation, a "security check".

The last one is the cruellest variant. Sites that offer to revoke your approvals, aimed at people who have already learned to worry about approvals.

What is left to notice

Since the page cannot be trusted, the wallet dialog is the only surface that tells the truth. Four questions:

1. Am I signing a message or sending a transaction? No gas fee means a message — and messages can authorise transfers.
2. What does the decoded data say? Named fields mean typed data your wallet could read. A bare hash means it could not, and you should decline.
3. Who is the spender, and how much? An address you cannot identify, plus an unlimited amount, is the whole attack in two fields.
4. Does this match what I came to do? Claiming an airdrop does not require authorising your stablecoins.

The page is the attacker's. The wallet dialog is yours. Read the one you own.

How people arrive

Traffic is the operator's half of the business, and it is bought like any other:

• Search ads on the protocol's own name, above the real result.
• Compromised social accounts, including verified ones, posting a link.
• Discord and Telegram announcements from a hacked moderator account.
• Airdrop tokens deposited into your wallet whose name is a URL.

Every one of these arrives rather than being sought. As with any other fraud, unsolicited contact is the first signal — the difference here is that one confirmation is final.

After a drain

Move fast on the parts that are still under your control:

1. Move remaining assets to a fresh wallet from a fresh seed. The compromised address may hold approvals you cannot enumerate.
2. Revoke everything on the old address anyway, using a tool such as Revoke.cash.
3. Record the transaction hashes and report the address to the block explorer, which can label it.
4. Do not engage anyone offering recovery. Recovery services in this space are a second scam aimed at people who have just proved they can be reached.

What is a wallet drainer?

A wallet drainer is off-the-shelf software an operator embeds in a fake site, which reads your balances the moment you connect and then requests whichever single signature extracts the most value. It is sold as a service with a revenue split, which is why the design is so consistent across campaigns that otherwise look unrelated.

What does it ask you to sign?

The bottom row is the one people expect and the one drainers avoid, because a transfer looks like what it is.

Does connecting a wallet put you at risk?

No. Connecting grants a read of your address and balances, and authorises nothing. The wallet drainer uses that read as reconnaissance — ranking your holdings so the single request it makes is the most valuable one available.

That is why the defence is in the dialog rather than the connection: does it cost gas, can your wallet decode the fields, who is the spender, and does the amount match what you came to do. More in wallet security, web3 security and risk analysis.

How do people reach these sites?

Traffic is bought like any other, and every route arrives rather than being sought:

• Search advertising on the protocol's own name, placed above the real result.
• Compromised social accounts, including verified ones.
• Discord or Telegram announcements from a moderator account that changed hands.
• Airdropped tokens whose name is a web address.

Unsolicited contact is the first signal, exactly as with any other fraud. The difference is that one confirmation here is final, so the usual margin for recovering from a mistake does not exist. A drainer only needs one confirmation, so the whole defence sits in the seconds before it. Read the wallet dialog rather than the page, because the page belongs to the attacker and the dialog does not.

What to do in the first hour after a drain

Order matters more than completeness:

1. Move whatever remains to a wallet generated from a fresh seed on a device you trust.
2. Revoke every approval on the compromised address, since some may be unused and still live.
3. Record the transaction hashes and report the receiving address to the block explorer.
4. Assume the address is permanently unsafe and stop receiving to it.

Do not engage anyone who contacts you offering recovery. Victim details circulate, and a message arriving after a loss is the second operation working the same list as the first.