Wallet drainer
A wallet drainer is a phishing kit that gets a crypto user to sign a transaction or message which lets the attacker move the victim's tokens and NFTs.
How it works
The victim lands on a fake mint, airdrop or exchange page and is asked to connect a wallet. The kit reads the balances, picks the most valuable assets and prepares the request that will move them: an unlimited token approval, an NFT operator approval, an off-chain Permit/Permit2 signature or a plain transfer.
Nothing is stolen until the victim signs. After that the attacker submits the transaction and the assets leave the wallet; a confirmed transaction cannot be reversed. Most drainers are rented as a service and pay the operator a share of every theft.
Example from the PhishDestroy database
- x0protocol.ink: Wallet-drainer domain, first detected 2026-10-21.
- app.phantomlocal.com: Wallet-drainer domain, first detected 2026-10-19.
- solanatools.io: Wallet-drainer domain, first detected 2026-10-19.
How to protect yourself
- Read every signature request: the spender address, the token and the amount. An unlimited approval or a Permit for a wallet you have never used is a red flag.
- Keep long-term funds in a separate wallet that never connects to new sites, and review approvals regularly (revoke the ones you do not need).