# Wallet drainer

A wallet drainer is a phishing kit that gets a crypto user to sign a transaction or message which lets the attacker move the victim's tokens and NFTs.

## How it works

The victim lands on a fake mint, airdrop or exchange page and is asked to connect a wallet. The kit reads the balances, picks the most valuable assets and prepares the request that will move them: an unlimited token approval, an NFT operator approval, an off-chain Permit/Permit2 signature or a plain transfer.

Nothing is stolen until the victim signs. After that the attacker submits the transaction and the assets leave the wallet; a confirmed transaction cannot be reversed. Most drainers are rented as a service and pay the operator a share of every theft.

## Example from the PhishDestroy database

- [x0protocol.ink](https://phishdestroy.io/domain/x0protocol.ink/): Wallet-drainer domain, first detected 2026-10-21.
- [app.phantomlocal.com](https://phishdestroy.io/domain/app.phantomlocal.com/): Wallet-drainer domain, first detected 2026-10-19.
- [solanatools.io](https://phishdestroy.io/domain/solanatools.io/): Wallet-drainer domain, first detected 2026-10-19.

## How to protect yourself

- Read every signature request: the spender address, the token and the amount. An unlimited approval or a Permit for a wallet you have never used is a red flag.
- Keep long-term funds in a separate wallet that never connects to new sites, and review approvals regularly (revoke the ones you do not need).

## Related tools

- [Signature Request Inspector](https://phishdestroy.io/developer-tools/sign-inspector)
- [Phishing Wallet Lookup](https://phishdestroy.io/developer-tools/phishing-wallet-lookup)
- [Scam Triage Wizard](https://phishdestroy.io/developer-tools/scam-triage-wizard)

## Related terms

- [Permit phishing](https://phishdestroy.io/glossary/permit-phishing/)
- [Permit2](https://phishdestroy.io/glossary/permit2/)
- [setApprovalForAll](https://phishdestroy.io/glossary/setapprovalforall/)
- [Ice phishing](https://phishdestroy.io/glossary/ice-phishing/)
- [Drainer-as-a-service](https://phishdestroy.io/glossary/drainer-as-a-service/)

## Further reading

- [Crypto Drainer Anatomy: $1.93B Stolen](https://phishdestroy.io/crypto-drainer-anatomy)
- [Crypto Drainer Networks Exposed](https://phishdestroy.io/crypto-drainer-networks)
- [Crypto Wallet Drained? Emergency Guide](https://phishdestroy.io/critical-action)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/wallet-drainer/