Web3 Frontend
Wallet Drainer Scams Explained: How Crypto Phishing Kits Work
The mechanics behind the phishing kits responsible for the majority of individual crypto wallet losses.
LOZULA Senior Security Research Team
2026-03-03
7 min read
Key Takeaways for Security Teams
- A wallet drain is a signature exploit, not a private key theft, prevention is about what you sign.
- Unlimited token approvals are the single biggest amplifier of drainer damage.
- Revoking old approvals periodically closes a door that many users forget is even open.
Wallet drainers are phishing kits that trick users into signing a malicious transaction or off-chain message, most commonly an ERC-20 approval or a Permit signature, that grants the attacker the ability to move funds without needing the private key itself.
How a Drain Actually Happens
The attacker never needs the private key. They only need a signature.
- •Victim connects their wallet to a convincing but fake dApp interface
- •The site requests a token approval or an EIP-712 Permit signature framed as a routine action
- •Once signed, the attacker can transfer approved tokens directly, no further victim action needed
Warning Signs and Defenses
Most drainer sites rely on urgency and unfamiliar signature requests to succeed.
- •Always read what a wallet popup is actually asking you to sign, not just click through it
- •Be suspicious of unlimited token approvals, legitimate dApps rarely need them
- •Periodically revoke unused token approvals using an on-chain approval checker
- •Treat unsolicited airdrops and "claim your tokens" links as a red flag by default