Wallet drainer

Malicious code, usually embedded in a fake site or app, that tricks a connected wallet into signing a transaction which transfers its assets to an attacker instead of doing what the user believes they are authorising.

Definition

A wallet drainer does not break anything. It persuades. The site looks like the protocol you meant to use, the button says what you expected it to say, and the transaction you approve is the one the attacker wrote rather than the one you thought you were confirming.

Because you signed it, the transfer is valid on-chain and cannot be reversed.

Why it works

Signature prompts are hard to read. A request to approve a token, delegate control, or authorise a transfer looks broadly similar to the routine approvals a DEX legitimately asks for, and wallets show the raw intent rather than a plain-language summary of the consequence.

Drainers are also sold as kits, so the same well-tested interface appears behind many different fake sites. The polish is not evidence of legitimacy.

How people arrive at one

Sponsored search results above the real one. Links in replies, direct messages and group chats, often attached to an offer of a referral bonus or an airdrop. Fake support accounts responding to a public question about a problem. Bookmarked links that were wrong from the start.

Almost none of it involves a compromised protocol. The protocol is fine; the route to it was not.

What actually reduces the risk

Reaching the site through a bookmark you created from a verified source rather than through search or a link someone sent you. Reading the transaction before signing, and treating an approval you do not understand as a reason to stop. Keeping large balances in a hardware wallet, so a compromised session cannot approve what a physical device has not confirmed. And revoking old token approvals periodically.

Where you will run into it

Around anything with an incentive attached: referral codes, airdrop claims, new listings, and urgent-sounding security warnings that ask you to migrate or verify funds.