Drainer (Crypto Scam)

How It Works

A drainer operates through a phishing website that prompts the victim to connect their wallet and sign one or more transactions. These transactions appear harmless — often disguised as a token claim, NFT mint, or wallet verification — but actually contain calls to approve(), setApprovalForAll(), permit(), or direct transfer() functions that grant the attacker control over the victim's assets.

Modern drainer kits are sophisticated software packages that automatically scan the victim's wallet, identify all valuable tokens and NFTs across multiple chains, and generate optimized drain transactions that extract maximum value. Some drainers use permit signatures (EIP-2612) that do not require an on-chain approval transaction, making them harder to detect — the victim signs an off-chain message that the attacker later submits to move tokens.

Drainer-as-a-service (DaaS) platforms provide ready-made phishing infrastructure, including website templates, smart contracts, and Telegram-based dashboards. The DaaS operator typically takes a 20-30% cut of stolen funds, making draining accessible to non-technical scammers.

Why It Matters

Drainers have become the dominant tool for crypto theft targeting individuals, responsible for hundreds of millions of dollars in losses annually. Their effectiveness stems from increasingly convincing phishing sites that are difficult to distinguish from legitimate protocols, combined with transaction prompts that most users do not fully understand.

Protection requires vigilance at multiple levels: bookmark legitimate DeFi sites and never follow links from messages, use wallet security tools that simulate transactions before signing, understand what approval transactions actually authorize, and consider using separate wallets for different purposes — keeping high-value assets in a wallet that rarely interacts with new contracts.

Real-World Example

A scammer creates a fake NFT airdrop site that looks identical to a popular NFT marketplace. Victims are directed to the site through Twitter ads and Discord DMs. When a victim clicks "Claim Airdrop," their wallet prompts a setApprovalForAll transaction for their NFT collection. If approved, the drainer's backend immediately sweeps all NFTs from the wallet, lists them for sale on legitimate marketplaces, and splits the proceeds between the scammer and the DaaS platform.