Short answer
The answer in plain English
A wallet drainer is a malicious website or app that tricks you into approving a transaction or signature that lets an attacker move your crypto. It usually does not break the blockchain. Instead, it abuses a permission that the wallet owner was persuaded to grant.
Why it matters
What to understand
Connecting a wallet usually lets a website see your public address. Approving a token is different: it can give a smart contract permission to spend it. That permission may remain active after you leave the site. Check the domain and transaction carefully, limit approvals, reject signatures you do not understand, and review existing allowances after anything suspicious.
Visual guide
How the pieces fit together
The theft often begins with permission
A wallet drainer does not always break cryptography or “hack the blockchain.” A common pattern is social and procedural: a fake mint, airdrop, support page, or urgent security warning persuades someone to approve a transaction or sign a message whose consequences are wider than they appear.
The wallet then uses the owner’s key to create a valid signature. If the permission is valid and the contract follows it, the network has no way to know that the person was misled.
Connect is not the same as approve
Connecting a wallet usually lets a site see the selected public address and request interactions. By itself, that is not the same as granting a contract the right to spend tokens.
An ERC-20 approval is more consequential. The token standard defines an approve mechanism that sets how much a spender may transfer on the owner’s behalf. Many legitimate decentralized applications need this to swap, lend, or deposit tokens. The danger is not the existence of approvals; it is granting a permission you do not understand, to the wrong contract, for an unnecessarily large amount.
Why disconnecting may not help
Wallet interfaces often include a list of connected sites. Removing a site from that list can stop a convenient front-end connection, but an on-chain token allowance is separate. Ethereum’s own revocation guide warns that disconnecting a wallet does not remove permissions already granted to a contract.
Allowances can remain until they are used, replaced, or revoked. That persistence is useful for repeated legitimate interactions—and dangerous when the spender is malicious or later compromised.
Signatures can carry intent
Not every dangerous request looks like an ordinary token approval transaction. Some systems use signed typed data or permit-style messages so a later transaction can present the user’s authorization. “No gas” therefore does not mean “no consequence.” The meaningful question is what authority the signature conveys.
Wallet warnings help, but they cannot always translate complex contract behavior into plain language. A hardware wallet also cannot rescue a bad decision after its screen confirms the exact malicious transaction or signature; it protects key custody, not judgment.
The permission can be narrower than the interface suggests
A signature is not one universal kind of consent. It can authorize a direct transfer, set an allowance for a particular token contract, approve an operator for a collection of NFTs, or confirm structured data that another party will submit later. The visible button may simply say “Claim” while the actual request describes one of those very different actions.
That makes the wallet’s decoded details more important than the website’s label. Check which address receives authority, which asset is covered, whether the amount is limited, and whether the request has a deadline. If the wallet cannot explain the action, declining it is not a technical failure. It is the point at which the proposed permission has not earned approval.
A safer pause before signing
Before approving:
- Open the project from a trusted bookmark or independently verified source—not a message link or promoted search result.
- Check the network, contract, token, spender, and amount shown by the wallet.
- Prefer a limited allowance when the application supports it.
- Reject requests that are unexpected, rushed, or impossible to explain in one sentence.
- Keep valuable long-term holdings separate from wallets used for unfamiliar applications.
After a suspicious interaction, stop signing new prompts. Review allowances using a reputable explorer or revocation tool, revoke unnecessary access, and consider moving remaining assets to a clean wallet if qualified incident guidance recommends it. Never share a seed phrase with a “support” contact.
Revocation is useful but not a rewind button. It can remove an allowance that remains available; it cannot recover assets already transferred or cancel every kind of signed instruction after another party has acted on it. Moving funds may also require signing, so a rushed cleanup performed through an unknown link can create a second opportunity for theft.
Use the official wallet or network documentation to identify the correct tools, type addresses independently, and test unfamiliar recovery steps with a low-value account. If substantial assets or a business wallet are involved, preserve transaction hashes and obtain qualified incident help rather than following unsolicited direct messages.
The lesson is not “never approve.” An approval is authority. Treat it with the same care as the assets it can move.