Crypto Safety Tips › Wallet Drainers Explained
The short answer: A wallet drainer is a scam website or contract built to empty your wallet once you connect and sign something. You protect yourself by only connecting to sites you've checked, reading every request before you sign, rejecting anything you don't understand, and keeping serious money in a separate wallet that never connects to new sites.
How does a wallet drainer work?
You land on a site that looks like a real mint, airdrop claim or marketplace, often from a search ad, a DM or a hacked official account. It asks you to connect your wallet, then to sign something. That signature quietly gives the scammer permission to move your tokens or NFTs, and an automated script empties the wallet within seconds.
What kinds of requests should worry me?
- SetApprovalForAll, which lets a contract move every NFT in a collection.
- Unlimited token allowances, which let a contract spend all of a token, forever.
- "Permit" signatures, free off-chain messages that can approve spending without an on-chain transaction. No gas fee doesn't mean harmless.
- Blind signing of messages you can't read.
How do drainers find me?
Through fake mint and airdrop sites, lookalike domains, sponsored search results, "claim your reward" NFTs sent to your wallet, DMs from fake support staff, and hacked Discord servers and X accounts posting surprise "mint now" links.
How do I avoid them?
- Use bookmarks for sites you use, and check the whole URL before connecting.
- Use a separate wallet with small amounts for mints and new sites.
- Read every request. If you don't understand it, reject it.
- Be most suspicious when something is urgent, free or exciting.
- Review and revoke old approvals regularly.
What if I signed something bad?
Act fast. Revoke the approval if you can, and move anything left in the wallet to a brand-new wallet. Report it to Action Fraud (or Police Scotland on 101). Beware anyone who then offers to recover your funds: that is the second scam.
Quick questions
Can connecting my wallet to a site drain it?
Connecting on its own shares your address. The danger is what you sign next. Still, only connect to sites you have checked yourself.
Are free signatures safe?
Not always. Permit signatures cost no gas but can approve someone else to spend your tokens.
How do I check what I have approved?
Use a token approval checker on a block explorer, or a tool like revoke.cash, to see and revoke approvals.
In NFT Wars, a drainer can catch you on the road. In real life there is no pill to pick: once you sign, it's gone.
Keep learning
General safety information, not financial or legal advice. HooTang Clan has no token, and nothing on this page is a reason to buy anything. Report fraud to Action Fraud, or Police Scotland on 101.