Wallet Drainer Explained 2026 — How They Steal $200M+ Per Year

What is a wallet drainer?

A drainer is a smart contract deployed by attackers, designed to: (1) trick the victim into signing a specific transaction; (2) use that signature to transfer the victim's tokens to the attacker. The drainer doesn't break encryption or steal seed phrases — it exploits standard token approval mechanisms.

Modern drainers (Inferno, Pink Drainer, Angel) are sold as 'malware-as-a-service' — anyone can rent a drainer contract, deploy a fake DApp, and start hunting. The drainer operator takes 20-30% of stolen funds; the affiliate keeps the rest.

How approval drainers actually work — step by step

1. Attacker deploys a malicious smart contract — the drainer — on Ethereum mainnet. The contract has standard token-transfer functions that look harmless to casual inspection.
2. Attacker creates a fake DApp — maybe cloned from Uniswap, OpenSea, or a project announcing an 'airdrop'.
3. Victim visits the fake DApp via a search ad, compromised Twitter post, or Telegram link.
4. Victim clicks 'connect wallet' (which gives the site read-only access to the address — that part is safe).
5. Victim clicks 'mint NFT' or 'claim airdrop'. MetaMask shows a signature request.
6. The signature request, when decoded, is actually an ERC-20 approve() call granting the drainer contract unlimited spending permission on a specific token (often USDC, USDT, or WETH).
7. Victim signs. The approval is now stored on-chain forever.
8. Hours, days, or weeks later, the drainer contract calls transferFrom() to move the approved tokens from the victim's wallet to the attacker's wallet. No further victim interaction needed.

Why approval drainers are so hard to spot

Standard MetaMask signature requests show raw hex data plus a token name and amount. To a non-technical user, an approval signature for $1,000,000 of USDC looks similar to a routine approval for swapping $50 of USDC.

The fake DApp also obscures intent: 'Click to claim free NFT' bears no surface connection to 'sign a token approval'. The attack flow is socially engineered to maximize signature without comprehension.

Permit2 drainers — the gasless variant

Permit2 is Uniswap's gasless approval system, designed to make trading cheaper. A single off-chain signature can authorize spending across many tokens. Drainers abuse this: a fake Uniswap interface gets you to sign a Permit2 signature that looks like a routine swap, but actually authorizes unlimited spending of every major token in your wallet.

Permit2 signatures are particularly dangerous because they don't show up in standard approval-list tools — they're off-chain until the attacker submits them. Defense requires extra vigilance: don't sign Permit2 messages on sites you haven't deeply verified.

EIP-7702 drainers — the 2025 frontier

EIP-7702 (live on Ethereum mainnet since 2025) allows externally-owned accounts (EOAs) to temporarily behave like smart-contract accounts. Used legitimately: better UX, batched transactions, gas sponsorship. Abused: attackers craft 7702 delegations that give a malicious contract control over your account for the duration of a single transaction — long enough to drain everything.

Defense: don't sign 7702 delegations on unfamiliar sites. Modern wallets (Rabby, MetaMask 12+) show explicit warnings for 7702 signatures. Treat them as high-risk by default.

The 5 rules that prevent drainer attacks

1. Bookmark every DApp. Always navigate to Uniswap, OpenSea, Aave via bookmark — never search ads or social links.
2. Use Rabby or wallet with transaction simulation. Rabby shows 'You will lose 1,000 USDC' before you sign. MetaMask shows hex. Switch to Rabby.
3. Revoke approvals quarterly. Visit etherscan.io/tokenapprovalchecker or revoke.cash. Remove any approval you don't actively need.
4. Read EVERY signature before approving. If you can't explain what the signature does in one sentence, don't sign.
5. Hardware wallet for >$5,000 holdings. Even drainer signatures get filtered through the device screen — you have one more chance to read what you're approving.

What to do if you've been drained

1. Immediately move remaining funds to a fresh wallet with a new seed phrase. The drained wallet is permanently compromised — any tokens with approvals to the drainer are at risk.
2. Revoke all outstanding approvals on the compromised wallet via revoke.cash. This costs gas but prevents additional draining.
3. Document the transaction hashes — these are needed for tax loss claims and law enforcement reports.
4. Report to IC3.gov (US), Action Fraud (UK), or your jurisdiction's equivalent. Slim chance of recovery but creates evidence.
5. Report the drainer contract address to Etherscan, MetaMask phishing list, and security firms (ScamSniffer, GoPlus).
6. Do not pay 'recovery services'. They are second-stage scams targeting drainer victims. Real recovery is via law enforcement, not paid services.

Why centralized exchanges don't have this problem

When you trade on Binance or Coinbase, you don't sign approval transactions for the exchange to move your funds — the exchange holds the keys to your custodied account. The trade-off: you trust the exchange not to lose or freeze your funds (counterparty risk), but you don't expose yourself to approval drainer attacks.

Self-custody (MetaMask, hardware wallet) is the answer to exchange counterparty risk. Approval-drainer awareness is the cost of self-custody. Both models have risks; understanding them lets you balance.