Crypto phishing and wallet drainers: approvals, signatures and address poisoning

A wallet drainer is a phishing tool that gets you to sign something, a transaction or a message, that gives an attacker permission to move your tokens. It does not need your seed phrase and it does not break any cryptography: it relies on you clicking "confirm" on a request you did not fully understand. Address poisoning is a related trick that plants lookalike addresses in your history so that you send funds to the attacker yourself. Both are stopped mainly by habits, not by software.

This guide focuses on the mechanics of these attacks on smart-contract networks such as Ethereum and other networks that work in a similar way. If you have not yet read the basics of holding your own keys, start with crypto wallets and custody and seed phrases and private keys. The broader scam landscape, including pig-butchering and recovery fraud, is in crypto scams and regulation.

Risk warning: crypto transactions generally cannot be reversed. If you sign a malicious approval or send funds to the wrong address, there is usually nobody who can return them. Crypto assets are highly volatile and you can lose all of the money you put in.

Why signing is the weak point

On a smart-contract network, your wallet does more than send coins. It signs instructions for programs (smart contracts) to run on your behalf: swap this token, deposit into that pool, mint this collectible. Each instruction can be harmless or devastating, and the wallet's confirmation screen is often the only place you get to tell the difference.

Attackers therefore aim not at the key, which is well protected, but at the moment of signing. They build a convincing reason for you to sign, put a malicious instruction behind the button, and rely on the fact that confirmation pop-ups show unfamiliar contract names, long hexadecimal strings and technical function names that most people approve without reading.

Three kinds of request matter most.

1. A direct transfer

The simplest drainer asks you to sign a transaction that sends your coins, or your most valuable tokens, straight to the attacker. It is usually disguised as "claim your airdrop" or "verify your wallet", with a fee or gas cost so that the transfer looks like a routine charge. Wallets show the destination and amount, so a careful reader can spot it; the attack works on people who do not read.

2. A token approval

Tokens on Ethereum and similar networks follow standards that let you grant another address, normally a smart contract, an allowance to spend your tokens. This is how decentralised exchanges work: you approve the exchange contract to take, say, your USDC, so that it can complete the swap. The approval is a separate transaction and it stays in force until you change it.

Many applications ask for an unlimited allowance to save you approving again next time. That is convenient and dangerous. If you approve a malicious contract, or a legitimate contract that is later exploited, the holder of that allowance can move tokens of that type from your wallet whenever it chooses, now or months later, up to the limit you set.

Collectibles (NFTs) have an equivalent permission, often shown as "set approval for all", which hands over control of every item in a collection at once.

3. An off-chain signature

Some token standards and widely used approval systems let you grant an allowance by signing a message rather than sending a transaction. These are often called permit signatures. Signing costs nothing and nothing appears on the blockchain at that moment, which makes it feel harmless. But the attacker can take your signature and submit it to the network later, creating the approval and then using it to transfer the tokens.

This is why "it only asked me to sign a message, I didn't pay any gas" is no reassurance. A signature request that mentions permit, spender, allowance, deadline, nonce or a token amount deserves the same scrutiny as a transaction.

For more on how these smart-contract applications work, see what is DeFi.

How people end up on a drainer site

The malicious request needs a convincing setting. The common routes:

• Lookalike domains. A website that copies a real wallet, exchange or application and sits on a domain that differs by one letter, uses a different ending, or swaps a letter for a visually similar character.
• Search adverts. Paid adverts placed above the real result for a popular application. Clicking the top result rather than typing the address is one of the most common paths to a fake site.
• Hijacked social accounts. A real project's social media account or community server is compromised and posts a "surprise mint" or "claim" link. The source looks trustworthy because it is the genuine account.
• Airdropped tokens and collectibles. Unknown tokens appear in your wallet with a name that is itself a web address, inviting you to visit it to "claim" or "sell". Interacting with them is the trap.
• Fake support. Replies to public complaints from accounts posing as help desks, which lead to a "wallet repair" or "sync" page.
• Urgency. Countdown timers, limited allocations and warnings that your wallet is "compromised" and must be "migrated" now.

Drainer kits are also sold or rented to criminals as a service, which is why so many fake sites look alike and why the techniques spread quickly.

Worked example: an unlimited approval

The figures are illustrative.

You hold 5,000 USDC in a wallet you use for decentralised applications. You visit what looks like a well-known swap site through a search advert and swap 500 USDC. The site asks you to approve its contract to spend your USDC, and the default amount in the request is unlimited. You click through. The swap does happen, so nothing seems wrong.

• Day 0: the approval is recorded. The site's contract can now move any amount of USDC from your wallet.
• Day 0, a few minutes later: the attacker uses the allowance to move your remaining 4,500 USDC. You notice and assume the damage is done.
• Day 20: you deposit a further 10,000 USDC into the same wallet, forgetting the approval. Within minutes, it is gone too.

Total loss: 14,500 USDC, from a single click. Had you set the approval to exactly 500 USDC, the attacker could have taken at most 500, and once that was used the allowance would have been zero. Had you also revoked the approval after the swap, as soon as you realised something was wrong, the day 20 deposit would have been safe.

The point is not that capped approvals make a malicious site safe, because a site that asks for a direct transfer will simply take what you sign for. It is that unlimited approvals turn one mistake into a permanent open door.

Address poisoning

Address poisoning works without any signature at all. It relies on the way people copy addresses.

Crypto addresses are long strings, so many people check only the first few and last few characters. Attackers use software to generate addresses that match the beginning and end of an address you regularly send to. They then send a tiny amount, or a zero-value token transfer, from that lookalike address to your wallet, so that it appears in your transaction history right next to the real one.

Worked example: a poisoned history

Illustrative addresses, shortened for readability:

• Your exchange deposit address: 0x7A3f...c91E2b
• The attacker's lookalike: 0x7A3f...c91E2b, with completely different characters in the middle

Last month you sent funds from your self-custody wallet to your exchange deposit address. Yesterday a transfer of zero tokens arrived from the lookalike. Today you want to send 3,000 USDC back to the exchange, so you open your history, see the familiar 0x7A3f...c91E2b at the top, copy it and send.

The funds go to the attacker. The transaction is valid, final and cannot be reversed.

The defences are simple:

• Never copy an address from your transaction history. Copy it from the source: the exchange's deposit page or the recipient directly.
• Use your wallet's address book for addresses you send to repeatedly, and label them.
• Check the whole address, or at least a block of characters from the middle as well as both ends.
• Send a small test amount for a large or first-time transfer and confirm it arrives. Our wallets guide shows the cost arithmetic.

A related threat is clipboard malware, which watches for crypto addresses on your clipboard and swaps them for the attacker's address as you paste. The same middle-of-the-address check catches it.

Protective habits that actually work

None of these is complicated. Together they stop the large majority of drainer and poisoning losses.

Separate your wallets by job

Use one wallet as a vault: it holds most of your coins, is ideally a hardware wallet, and never connects to new or experimental sites. Use a second wallet for everyday interactions with applications, holding only what you need for the task in hand. If the everyday wallet is drained, the loss is capped at what was in it. This is the single most effective habit for anyone who uses decentralised applications.

Reach sites deliberately

Type the address yourself or use a bookmark you saved from an official source. Do not click links in direct messages, emails, replies or adverts, and do not trust a link because it was posted by an account you follow; accounts get hacked.

Read every confirmation

Before you confirm, ask three questions:

1. What does this do? A transfer, an approval, a signature?
2. Who receives the permission or the funds? Is it the contract you expected?
3. How much? Is an approval capped at the amount you actually need?

If you cannot answer, reject it. Many wallets now show a simulation of what a transaction will change in your balances, and some warn about known malicious addresses. Treat these as helpful, not infallible.

Be wary of "sign to verify" and "sign to claim"

Legitimate log-in signatures exist, but they are plain-text messages that do not mention tokens, amounts or spenders. A "verification" signature that includes any of those is not a log-in.

Review and revoke approvals

Block explorers for the major networks, and several wallet apps, let you see every active token approval on your address and revoke them. Revoking is itself a transaction and costs a network fee (see crypto gas fees explained), so it is worth doing for large or unlimited approvals and for any application you no longer use. Be careful to use the explorer's real site, because fake "revoke" tools are a known phishing lure too.

Ignore tokens you did not ask for

Unknown tokens and collectibles that arrive unannounced are often bait. Hide them in your wallet and do not try to sell, swap or "claim" them.

What a hardware wallet does and does not do

A hardware wallet keeps the private key off your computer and requires a physical button press to sign. That protects you against malware that tries to steal the key or sign silently. It does not protect you against a malicious request that you approve on the device. Drainers are designed to be approved.

Where your device supports it, prefer modes that show the transaction in readable form on its own screen, and be cautious about any request that the device can only display as an unreadable string of data. If you cannot see what you are signing, you are trusting the website.

If you have signed something malicious

Speed matters, because attackers often act within minutes but sometimes wait.

1. Move unaffected assets. If the approval covers one token, move your other tokens to a fresh wallet. If you may have exposed your seed phrase, assume everything is compromised and move all assets to a wallet with a newly generated phrase.
2. Revoke the approval if the tokens are still there, using the explorer's genuine site.
3. Stop using the compromised wallet for anything valuable.
4. Record the details: transaction hashes, the website address, screenshots, the attacker's addresses.
5. Report it to the police and, in the EU, to your national financial regulator if a firm was involved. If funds reached an exchange, that exchange may be able to freeze them if contacted quickly through official channels.
6. Ignore anyone who offers to recover the funds for a fee. Recovery offers after a theft are overwhelmingly a second scam.

Common mistakes

• Clicking the top search result. Paid adverts for fake applications sit above the real ones.
• Accepting default unlimited approvals. Convenient, and it means one bad site can take everything of that token, now or later.
• Treating signatures as harmless. Permit-style signatures can create approvals that are used later.
• Copying addresses from history. This is exactly what address poisoning exploits.
• Checking only the first and last characters. Lookalike addresses are generated to match those.
• Keeping everything in one wallet. A single drained wallet should not be your whole holding.
• Interacting with unsolicited tokens. Their names often carry the link to the trap.
• Believing a hardware wallet makes any click safe. It signs what you approve.
• Paying a "recovery expert". It is almost always a further loss.

A note for CFD traders

If you trade crypto only through CFDs with a broker, you do not have a self-custody wallet to drain. Your exposure to phishing is through your broker account: fake log-in pages, fake broker apps and impersonated account managers. Use two-factor authentication, reach the broker by typing its address, and check that the firm is authorised on the regulator's register via our regulator registers page and our guide to how to check a broker licence. Watch for clone firms that copy a real broker's name. And remember that CFDs carry their own heavy risk: retail crypto CFD leverage in the EU is capped at 2:1 and most retail CFD accounts lose money.

Frequently asked questions

What is a wallet drainer?

A wallet drainer is a malicious website or script, often sold to criminals as a ready-made kit, that prompts you to sign a transaction or message giving the attacker control of your tokens. It works by deception rather than by breaking encryption, so careful reading of what you sign is the main defence.

Can someone drain my wallet if I only connected it to a site?

Connecting a wallet by itself generally shares your address and balances with the site but does not give it permission to move funds. The danger comes from what you sign next. That said, a malicious site knows what you hold once you connect, and will tailor its requests accordingly, so connect only to sites you reached deliberately.

How do I check and revoke token approvals?

Use the token approval checker on your network's official block explorer, or a revoke feature built into your wallet. It lists every contract you have approved and the allowance size. Revoking sends a transaction that sets the allowance to zero and costs a network fee. Always reach the tool through a bookmark or by typing the address, because fake revoke sites exist.

What is address poisoning?

Address poisoning is a scam in which an attacker sends a tiny or zero-value transfer from an address that looks like one you use, so it appears in your history. If you later copy the address from your history, you send funds to the attacker. Copy addresses from their source and check the full string.

Does a hardware wallet stop wallet drainers?

Not on its own. A hardware wallet stops malware stealing your private key, but if you approve a malicious transaction or signature on the device, it will sign it. It helps most when combined with careful reading of each request and a separate wallet for risky interactions.

Can stolen crypto be recovered?

Rarely. Transactions are final, and funds are often moved quickly through many addresses. If stolen funds reach a regulated exchange, that exchange may be able to freeze them if law enforcement or the victim alerts it quickly. Anyone who contacts you offering recovery for an upfront fee is almost certainly running a scam.