Wallet Drainer Phishing: How It Works, Warning Signs & What To Do

Malicious websites that trick users into signing transactions that drain their cryptocurrency wallets.

Wallet drainer phishing involves malicious websites that mimic legitimate cryptocurrency platforms and trick users into signing blockchain transactions that transfer ownership or drain funds. These attacks often use 'drainer-as-a-service' kits where developers provide the malicious code and take a percentage of stolen funds while affiliates operate the phishing sites. Common techniques include fake airdrops, compromised official social media accounts, malicious ads, and typosquatting domains. The signature requests appear legitimate but actually transfer NFT ownership, grant unlimited token approvals, or drain wallets. ScamSniffer reported about $494 million lost to wallet drainers in 2024 across 332,000 victim addresses.

How It Works

  1. 1Scammer creates fake website mimicking legitimate crypto platform
  2. 2Distributes link via hacked official X/Discord accounts, paid ads, or phishing emails
  3. 3Victim clicks link thinking it's legitimate airdrop or project
  4. 4Connects their MetaMask, WalletConnect, or other Web3 wallet
  5. 5Site prompts wallet signature request that appears routine
  6. 6Signature actually transfers NFT ownership, grants unlimited approvals, or executes drain
  7. 7Funds or NFTs are immediately transferred to attacker's wallet
  8. 8Site may disappear or victim notices emptied wallet later

Warning Signs (Red Flags)

  • Website URL has slight misspelling or wrong domain extension
  • Link comes from compromised official social media account
  • Unexpected airdrop or reward you didn't register for
  • Wallet signature request with unusual permissions or large token amounts
  • Site pressures immediate action with countdown timers
  • Domain was recently registered (check WHOIS)
  • Website uses free hosting or has unprofessional appearance
  • Google search for the site shows scam warnings or no results

What To Do If Targeted

  • If you signed a malicious transaction, immediately move any remaining assets to a new wallet
  • Revoke token approvals using tools like Revoke.cash or Etherscan
  • Report the phishing site to your wallet provider and the legitimate project
  • Report to the platform where you found the link (Google, Twitter, Discord)
  • Report to FBI IC3 at https://www.ic3.gov
  • Report to FTC at https://reportfraud.ftc.gov
  • Share the scam domain in crypto communities to warn others
  • Consider the compromised wallet permanently unsafe and migrate to new wallet

Real Cases

Maker DAO Vault Drain via Drainer Phishing

Alleged
📅 August 20, 2024💰 Approximately 55.47 million DAI (~$55 million)

A cryptocurrency whale lost approximately $55.4 million in DAI to a phishing attack after signing a malicious transaction. Per security firms CertiK and Blocksec, the attacker used the victim's externally owned account to transfer ownership of their Maker vault's DSProxy to an attacker-controlled address, then drained the vault. CertiK attributed the attack to the Inferno Drainer kit. The signature request appeared legitimate but changed vault ownership. ScamSniffer data shows this was the largest single wallet drainer theft of 2024, using a 'setOwner' phishing signature targeting proxy ownership modification.

View Official Source

Frequently Asked Questions

How can I verify if a website is legitimate before connecting my wallet?

Check the exact URL spelling and domain extension. Search for the official website independently rather than clicking links. Verify the domain is mentioned on the project's verified social media accounts. Check WHOIS to see when domain was registered (newly registered domains are suspicious). Look for SSL certificate. Search for scam warnings about the domain. When in doubt, don't connect—you can always research more thoroughly later.

What should I review before signing a wallet transaction?

Read the signature request carefully—it should clearly state what you're signing. Be extremely cautious of requests that grant unlimited token approvals, transfer ownership, or show large amounts. Reject requests with vague language or that don't match what you intended to do. Use wallet security features like simulation that show transaction outcome before signing. If something feels wrong, reject it—you can always try again after verifying the site is legitimate.

Can I recover funds drained by a malicious signature?

Recovery is extremely unlikely because blockchain transactions are irreversible and attackers immediately move funds through multiple wallets and mixers. Report to law enforcement, but expect low chance of recovery. Focus on protecting remaining assets: immediately transfer them to a new wallet and revoke any token approvals on the compromised wallet. Consider that wallet permanently unsafe and never use its seed phrase again.

See a Scam? Report It

Report suspected scams to law enforcement to help protect others and aid investigations.

Report a ScamFBI IC3FTC ReportFraud