Quick answer
What is a crypto wallet drainer?
A crypto wallet drainer is a phishing kit, usually rented as a service, that shows a fake site or a hijacked real one, asks the visitor to connect a wallet and sign, and then moves the assets out. ScamSniffer counted $83.85M stolen from 106,106 victims in 2025. Wardmint registers the look-alike names a project can take before attackers do.
Wallet-drainer phishing losses on EVM chains, 2023 to 2025
| Year | Losses | Victims | Cases of $1M or more |
|---|---|---|---|
| 2023 | $295M | 324,000 | 13 |
| 2024 | $494M | 332,000 | 30 |
| 2025 | $83.85M | 106,106 | 11 |
Signature types that drainers ask for
| Signature type | What the victim actually allows | Reported in 2025 |
|---|---|---|
| approve | A named address may spend a set amount of one token | Listed as a common type |
| permit / Permit2 | The same allowance, granted by an off-chain signature with no on-chain transaction from the victim | 38% of losses in cases of $1M or more ($8.72M, 3 cases); the largest 2025 theft, $6.5M in September, used a Permit signature |
| setApprovalForAll | A named address may move every NFT in a collection | Listed as a common type |
| increaseApproval, Transfer | A larger allowance or a direct token transfer | Listed as types in use |
| EIP-7702 batch | Delegated account code that runs several actions at once | Appeared after the Pectra upgrade; 2 large cases in August, $2.54M |
How does a wallet drainer work?
It works in three steps: lure, connect, sign. The lure is a link in a message, an ad or a social profile that points to a page copying a real project. The page asks the visitor to connect a wallet, which reveals the address and the tokens it holds. The kit then builds one or more signature requests that look routine, such as a claim, a mint or a verification. Once the victim signs, the operator uses the approval or the transfer to take the assets, usually within moments.
ScamSniffer defines a wallet drainer as phishing infrastructure on malicious websites that induces users to sign harmful transactions, which allows fast extraction. The kit does not need a seed phrase. The user supplies the authority voluntarily, which is why the page that asks for it has to look credible, and why the domain it sits on matters so much.
Where do drainers get their domains?
They use look-alike domains registered for the campaign, and increasingly the project's own domain after a hijack. The look-alike route is the plain one: examplecoin-claim.xyz or examplecoin-airdrop.com, a copy of the project page, a connect button. Variants of this kind are described in what kinds of look-alike domains phishers register, and the airdrop pattern is covered in how fake airdrop claim sites and phishing domains work.
The hijack route skips the look-alike entirely. Blockaid attributed the five front-end compromises of 16 to 23 February 2026 to the AngelFerno drainer service, previously known as Inferno, with new SSL certificates issued the same day as the DNS change. The Block reported that about a dozen DeFi sites registered with Name.com were redirected on the evening of 30 October 2026 and loaded with Step Drainer, a malware-as-a-service toolkit, with about $138,000 traced to three EVM wallets. In both cases the visitor typed the real address.
How much do drainers steal, and is it falling?
ScamSniffer reports that drainer losses fell 83% in 2025, to $83.85M, while the broader scam picture grew. The 2025 total is a fraction of 2024's $494M, and victims fell 68%. The report counted 11 cases of $1M or more against 30 in 2024. It also found that Permit and Permit2 signatures made up 38% of the losses in large cases, and that the peak month was August 2025 with $12.17M and 15,230 victims.
A falling total does not mean a safe user base. Chainalysis, in its report of 13 January 2026, put crypto scams and fraud at no less than $14 billion received on-chain in 2025, with impersonation scams up more than 1,400% on 2024 and the average scam payment rising from $782 to $2,764. Drainers are one tool in that picture, and the Chainalysis text reports that scams using phishing kits were far more effective in dollar terms than ordinary ones. ScamSniffer's own caveat applies too: its figure counts phishing-website drainers only.
What can a project do to stop drainers using its name?
Take the obvious names, harden the real one and make reporting fast. According to Wardmint's survey of 12 November 2026, 40 of the 50 largest crypto projects had no registered -claim .com name and 39 of 50 had no registered -airdrop .com name in RDAP, so the exact words a claim lure needs were open to anyone. The full results, with the 171 of 578 variants (29.6%) that were free, are on the crypto project defensive domain audit 2026 page.
A project can act in four ways. Register its own variants and redirect them to the official site; the phisher set (.xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support) is $212.41 a year. Harden the registrar account and DNS using the domain security checklist for a crypto project. Find existing look-alikes with the free tools in how to find look-alike domains of your brand. And report any live one by following how to report a phishing domain. Wardmint sells registrations only, not monitoring or takedown, and it registers a project's own variants, never another brand's.
What can a user do before signing?
Read what the wallet says it will do, and treat any request you did not start as hostile. A connect request on a page reached from an ad or a message is the point to stop. Open the project from a bookmark or from its verified channels, check that the address is exactly the one the project announced, and read the signature prompt. A request to approve spending of a token, to approve a whole NFT collection or to sign a Permit for a claim is the pattern in the table above. Keep long-term holdings in a wallet that you do not use to connect to new sites.
Projects can help users by announcing a single official address before each event. A citable rule: a legitimate claim never needs a seed phrase, and a signature that grants an allowance is not a claim.
Wallet drainers: questions
Is a wallet drainer malware on my computer?
Not usually. The drainers in these reports run as scripts on a phishing website and act through the wallet you connect. The risk comes from the signature you give, not from software installed on your device.
Why does a drainer not need my seed phrase?
A signed approval or Permit gives the attacker the right to move your tokens without any key. The authority is granted by the signature, and it stays valid until revoked or used.
Did drainer losses really fall in 2025?
Yes, in ScamSniffer's data they fell 83% to $83.85M across 106,106 victims, from $494M in 2024. The report covers phishing-website drainers only and is a lower bound.
Can registering domains stop drainers?
It removes the names a drainer operator would try first, such as a project name with claim or airdrop added. It does not stop attacks on other words, subdomains on hosting platforms or a hijack of the real domain.
What should a project do after finding a drainer site?
Report the domain to its registrar and host, add it to the blocklists, warn users on every verified channel and record screenshots for any later dispute. The reporting order is in the Wardmint guide on reporting a phishing domain.
In summary
- A wallet drainer is a phishing kit that gets a signature and moves assets, with no seed phrase needed.
- ScamSniffer: $83.85M and 106,106 victims in 2025, against $494M and 332,000 in 2024.
- Permit and Permit2 made up 38% of losses in cases of $1M or more; the largest was $6.5M in September 2025.
- Drainers run on look-alike domains and on hijacked real domains (February and October 2026 reports).
- Chainalysis (13 January 2026): at least $14 billion in crypto scams received on-chain in 2025.
- 40 of 50 -claim .com and 39 of 50 -airdrop .com names of the top 50 projects were free on 12 November 2026.
- Wardmint sells registrations, not monitoring or takedown; nine phisher endings cost $212.41 a year.
Sources (4)
- Scam Sniffer 2025 crypto phishing losses fall 83% to $84 million — ScamSniffer, 3 January 2026 (read 2026-11-12)
- 2026 Crypto Scams report — Chainalysis, 13 January 2026 (read 2026-11-12)
- Frontend hijacking and the Web2 attack surface threatening Web3 protocols — Blockaid, 19 March 2026 (read 2026-11-12)
- Hackers hijack a dozen DeFi websites registered with Name.com — The Block, 31 October 2026 (read 2026-11-12)