Technique

Crypto Wallet Drain

Also known as: Crypto Drainer, Wallet Drainer, Crypto Wallet Drainer

MONETIZATION

Attackers use malicious smart contracts, phishing sites, or compromised browser extensions to trick victims into signing transactions that transfer cryptocurrency or grant token-spending approval to attacker-controlled wallets. Drainer toolkits automate asset discovery and generate obfuscated transa…

Common attack flows

How it fits in a scam

This technique shows up duringMONETIZATION

Before

After

This is often where the scam ends.

Defense

How to defend against this

How to spot it

  • Unexpected transaction approval request when visiting a website or clicking a link
  • Prompted to connect wallet to an unfamiliar or recently-created website
  • Transaction details are vague or obfuscated when asked to sign
  • Unsolicited airdrop
  • NFT mint
  • or token reward requiring wallet connection
  • Browser extension requesting elevated permissions to interact with wallet
  • Wallet balance drops unexpectedly after approving a transaction
  • Token approval grants to unknown smart contract addresses visible in wallet history

Tools you can use

Steps you can take

Seen in the wild

Where we’ve seen it

Commonly targets

Further reading