Crypto Drainer

What Is a Crypto Drainer?

A crypto drainer is a malicious smart contract engineered to empty a victim's wallet with a single user interaction: signing a transaction. Unlike traditional malware that installs itself on your system, a drainer needs nothing more than your signature on a blockchain transaction. Once you sign, the drainer's backend immediately submits calls to transferFrom() on your tokens, moving your entire balance to an attacker-controlled address — often within the same block.

The drain is irreversible. Blockchain transactions cannot be undone. Within seconds of signing, all your ERC-20 tokens and NFTs can be gone. This is why drainers are considered the most dangerous form of Web3 attack.

Drainer-as-a-Service

Modern drainers are sold on dark web markets and Telegram channels as commercial products — "Drainer-as-a-Service" (DaaS). Developers sell a complete package: the malicious smart contract, a ready-made phishing website template, and a backend that automatically processes stolen funds. Buyers pay either a flat fee or a 20–30% cut of stolen assets. This has lowered the technical barrier to launching a drainer attack to near zero — an attacker needs no programming knowledge.

Well-known DaaS products have included Angel Drainer, Inferno Drainer, and Monkey Drainer, each responsible for tens of millions of dollars in losses before being shut down — only to be replaced by successors.

The Technical Flow of a Drainer Attack

The attack follows a consistent sequence:

• The victim receives a phishing link via Discord DM, Twitter/X reply, Telegram, or a compromised project's official channels.
• The phishing site mimics a legitimate DeFi protocol, NFT collection mint, or airdrop claim page. Domain age is typically days or hours old.
• The site prompts the victim to connect their wallet and sign a transaction. This may be an approve() call for an unlimited token amount, a setApprovalForAll() for all NFTs, or a Permit signature (EIP-2612) that grants approval off-chain.
• The drainer backend monitors the mempool or a webhook. The instant the transaction is confirmed (or immediately using the off-chain Permit signature), it calls transferFrom() to sweep all approved tokens to the attacker's address.
• Funds are quickly routed through mixers or cross-chain bridges to obscure the trail.

The Permit Exploit

The most dangerous drainer variant exploits the EIP-2612 Permit standard. A Permit allows a user to sign an off-chain message (not a blockchain transaction) that grants approval. This looks identical to a normal "message signing" request in MetaMask — with no gas fee and no on-chain footprint until the attacker submits it.

Most wallets display Permit requests as raw hex data or a simplified "sign this message" dialog, without clearly showing what is being approved and for how much. This is why Permit-based drains catch even experienced users off guard.

How to Recognise a Draining Site Before Signing

Several signals indicate a draining site:

• The domain was registered recently (check via whois — drainer sites rarely survive more than days before being reported).
• The URL contains subtle misspellings of legitimate projects (e.g., "uniswop.io" vs "uniswap.org").
• The site claims an urgent, time-limited airdrop or "exclusive mint" promoted via unexpected messages.
• MetaMask or your wallet shows an approve call to an unknown contract address, or a Permit message with a large allowance.
• The Rabby Wallet browser extension flags the transaction with a warning about the approval amount.

What to Do Immediately After a Drainer Attack

Speed matters. If you realise you've signed a drainer transaction, act in this order:

• Do not reconnect to the phishing site or attempt to "undo" anything there.
• Go to revoke.cash and revoke all active token approvals from your wallet immediately.
• Check your remaining assets on Etherscan and identify what was drained and which contract received it.
• Transfer any remaining funds to a completely new wallet address.
• Record all transaction hashes involved in the attack.
• Contact a blockchain forensics firm within the first 24 hours — funds are often traceable to centralised exchanges where account freezes can be requested.

Frequently Asked Questions

Related Terms

Useful Resources