A crypto wallet drainer is a malicious smart contract, usually hidden behind a fake website, that empties your wallet the moment you approve it. Victims rarely feel hacked: they clicked a link, connected their wallet, and signed what looked like a routine approval for a mint, a claim, or a verification step. Minutes later their tokens are gone. Drainers do not break cryptography; they abuse the approval system that legitimate apps use every day, which is why they are so effective.

The typical drainer attack starts with a lure. It might be a fake airdrop claim, a phishing site impersonating a popular project, a compromised social account posting a mint link, or a direct message promising a reward. The site looks professional, often copied pixel for pixel from the real project, and it asks you to connect your wallet. That connection alone is harmless. The damage happens at the signing step, when the site requests an approval, usually unlimited, for a token in your wallet, or operator approval for your NFTs. The wallet pop-up shows a contract address and a permission, not a warning, and many users approve without reading it.

Once the approval is signed, the drainer contract can transfer the approved tokens immediately, and it usually does so within minutes, before the victim notices or can revoke. Because the transfer was authorised by a valid signature, it looks like a normal transaction on the blockchain, and there is no way to reverse it. Drainers often sweep multiple tokens and NFTs in one pass, prioritising the most valuable assets first. Some drainers also request approvals for several tokens in sequence, disguised as separate steps of the same fake process.

The defence against drainers is almost entirely about approval discipline. Read every signing request before approving, especially the spender address and whether the allowance is unlimited: a mint or claim should never need unlimited access to all your tokens. Use a separate hot wallet with small balances for claims, mints, and new sites, and keep your main holdings in a wallet that never connects to anything unfamiliar. Never follow links from direct messages or social comments to connect your wallet; type the official site address yourself or use a bookmark. And if a site pressures you with a countdown or claims your assets will be lost unless you act now, close it: urgency is the drainer's favourite tool.

If you suspect you signed a drainer approval, act fast but in order. First, revoke the approval through a checker like Revoke.cash or a block explorer, if the funds are still there. Second, move remaining assets to a fresh wallet on a clean device, because the same site may have harvested more permissions than you realise. Third, scan your device for malware and remove any extensions the fake site asked you to install. Speed helps here, but only if each step is done correctly: a panicked transfer to a mistyped address loses funds just as surely as the drainer does.

Drainers succeed because approvals feel routine, and routine is exactly what attackers exploit. Treat every approval as a decision about who can move your money, keep experiment funds separated from savings, and make reading the spender address a habit you never skip. The approval system is not broken; it just trusts you to use it carefully.

Checking an approval before signing takes less than a minute once you know what to look for. First, read the spender address: is it the contract of the project you intended to use, or an unknown address? Second, check the allowance: is it limited to the amount your action needs, or unlimited? Third, ask whether the action matches the request: a simple token claim should not need operator approval over your NFTs, and a verification step should not need access to your tokens at all. If any answer looks wrong, reject the signature and leave the site; a legitimate project will never punish you for declining. When in doubt, use a fresh burner wallet with a tiny balance for the first interaction, and only connect your main wallet after the project has earned your trust.