Short answer
A wallet drainer is phishing code on a fake site that asks the visitor to connect a wallet and sign a request, usually a token approval or permit, which lets the attacker move the tokens. Drainers are sold as a service to scammers who host them on lookalike sites. ScamSniffer counted USD 494 million lost to drainers in 2024 and USD 83.85 million in 2025.
Who this is for: Crypto teams, moderators and users who need to recognise drainer sites.
How a drainer works
- Bait. A link to a fake claim, mint or support page spreads through X replies, Telegram and Discord DMs, ads or airdropped tokens.
- Copy. The page copies a real project, usually on a lookalike domain.
- Connect. The visitor connects a wallet. The drainer reads the balances and picks the most valuable assets.
- Sign. It asks for a signature that looks routine. ScamSniffer names "Increase Allowance", "Approve" and "ERC20 Permit" as the most abused types in 2023, and Permit as the main token method in 2024.
- Drain. With the approval, the attacker moves the tokens, often within seconds.
Because a permit is an off-chain signature, the victim pays no gas and may not see a transaction until the tokens are gone.
Losses by year
| Year | Losses | Victims |
|---|---|---|
| 2023 | About USD 295 million | About 324,000 |
| 2024 | About USD 494 million | About 332,000 addresses |
| 2025 | USD 83.85 million (down 83%) | 106,106 (down 68%) |
Losses fell in 2025, but ScamSniffer reports new methods, including malicious EIP-7702 signatures after Ethereum's Pectra upgrade.
Drainers as a service
Most drainer sites are not built by the people who run them. Developers rent out the kit and take a share of each theft. Group-IB found that Inferno Drainer used more than 16,000 unique domains imitating over 100 crypto brands and stole at least USD 80 million between November 2022 and November 2023, with a 20% cut for the developers. This is why the same fake page appears for many projects: only the logo and text change.
How projects and users defend
- Find the copy early. Monitor new domains and certificates for your name; most drainer sites need a lookalike domain.
- Get it blocked in wallets. Report to MetaMask's list, Blockaid and ScamSniffer; see report phishing to wallets.
- Take it down. Report to the registrar and host; see take down a phishing site.
- Publish your real links. An official links page lets users check before they connect.
- Users: read what you sign, revoke old approvals, and keep large balances in a wallet that never connects to new sites.
Sources
Frequently asked questions
Can a drainer take funds without a signature?
A typical drainer needs the user to approve a transaction or sign a message. That is why the fake site imitates a trusted project: the signature looks routine.
How do wallets warn about drainers?
Wallets check sites and transactions against blocklists and simulation services such as Blockaid, MetaMask's eth-phishing-detect and ScamSniffer, and show a warning before signing.