Crypto Drainers: How Phishing Sites Steal Funds

Crypto drainers turn one careless signature into an empty wallet. Learn how phishing sites trick you into approving transfers, the red flags, and what to do.

What is a crypto drainer?

A crypto drainer is a phishing website paired with code that asks your wallet for permissions, then uses them to move your assets to criminals. The FBI described the pattern in a 2023 warning: people who followed spoofed links “unknowingly connect their cryptocurrency wallets to a drainer smart contract, resulting in the transfer of cryptocurrency and NFTs to wallets operated by criminals.”

Drainers don’t need your recovery phrase or password. They need one signature, which is why they catch careful people too. Phishing and spoofing remain among the most frequently reported crimes in the FBI’s 2025 figures, and in crypto the payoff from a single click can be an entire wallet.

The lure usually arrives through one of these routes:

• Hijacked or lookalike project accounts. The FBI notes criminals take over real developer accounts or create almost identical ones, then announce a “surprise” mint with “limited supply.”
• Fake claim pages. An airdrop you didn’t expect, with a link to “check eligibility.” Our guide to fake crypto airdrops covers these in depth.
• Search ads and lookalike domains. A sponsored result or an address with one extra character.
• Direct messages. A “moderator” sends a link to fix an error, verify a wallet or join a private sale.

Which wallet requests can empty your wallet?

Not every prompt is dangerous. The risk depends on what the request actually authorizes:

Two rows deserve special attention. The ERC-2612 standard lets a token holder change an allowance “using a signed message,” and “the caller of the permit function can be any address.” You sign, and the drainer submits it; no gas prompt ever appears on your side. The NFT standard describes approval for all as letting a third-party operator “manage all” of the owner’s assets in that collection, which includes transferring them.

The math of an unlimited approval

The amount you approve decides how much you can lose if the spender turns out to be malicious.

Example: Your wallet holds $4,000 in a dollar stablecoin, and a site needs $250 of it for a swap. An exact approval of $250 limits what that spender can ever take to $250, or 6.25% of your balance. An unlimited approval exposes the full $4,000, plus anything you deposit later, until you revoke it.

The same logic applies to where you keep funds. If you hold $12,000 in total but connect to new sites only with a separate wallet holding $300, the worst a drainer can do there is 2.5% of your holdings. Our guides to hot wallets vs cold wallets and browser extension wallet safety explain how to set that up.

Red flags before you sign anything

A few situations should stop you on sight:

• The request doesn’t match the action. Claiming a free airdrop shouldn’t require an allowance on your other tokens or approval for all of your NFTs.
• A “gasless” signature for something valuable. No gas can mean a permit, not a harmless message.
• Text you can’t read. If the wallet shows raw data or hex instead of a readable summary, you are being asked to sign blind.
• A wallet warning. Many wallets flag known malicious sites or unusual approvals; don’t click past the warning.
• Countdowns and scarcity. “Mint closes in 5 minutes” exists to stop you from checking the address.
• Any request for your recovery phrase. No legitimate site ever needs it. Never share your recovery phrase with anyone.

Common mistakes that let drainers in

• Trusting a link because a real account posted it. The FBI notes criminals take over genuine developer accounts, so a link from the right handle can still be malicious. Confirm big announcements on the project’s own website.
• Assuming a hardware wallet makes any signature safe. A hardware wallet protects your keys, but an approval you confirm on the device is still valid. Read what the device screen says before you press the button.
• Leaving old unlimited approvals in place. An allowance you granted a year ago stays active until you revoke it, even if that site is later compromised.
• Reaching familiar sites through search. A sponsored result can sit above the real one. Bookmark the sites you use and open them from your bookmarks.

What to do if you signed a drainer request

1. Stop and disconnect. Close the site and don’t sign anything else it shows.
2. Move what’s left. Transfer remaining assets to a wallet whose recovery phrase has never been typed into any website or device you don’t trust. If you entered your phrase anywhere, the old wallet is permanently compromised; follow our steps for a compromised crypto wallet.
3. Revoke approvals. Review and revoke token approvals on every network you used. Revoking stops future transfers but won’t return what’s gone, which is why moving assets comes first.
4. Record the evidence. Save the site address, the spender or operator address shown in the prompt or your transaction history, and the hashes of any theft transactions.
5. Report it. In the US, file with the FBI at ic3.gov and the FTC at ReportFraud.ftc.gov. In England, Wales and Northern Ireland, use Report Fraud at reportfraud.police.uk; in Scotland, call Police Scotland on 101; elsewhere, contact local police.
6. Ignore recovery offers. Anyone who contacts you promising to reverse the theft for a fee is running a second scam.

The bottom line

A drainer doesn’t break your wallet; it borrows your signature. Treat connecting as harmless and every approval, permit and approval-for-all request as a decision about who can move your money. Keep new-site activity in a small separate wallet, and for the broader warning signs, see how to spot a crypto scam.

This content is for education only and is not financial, investment, tax or legal advice. Crypto assets are volatile and you can lose money. Examples use hypothetical numbers. See our disclaimer and editorial policy.