How to Prevent Wallet Drainer Scams in 2026

A wallet drainer is malicious code or a fraudulent website that pulls assets out of a crypto wallet without the owner meaning to send them. It is not a single technique. Drainers appear in fake airdrop pages, cloned versions of popular dApps, malicious browser extensions, phishing messages and fake support chats. Their goal is usually to get the wallet owner to approve a transaction or a permission that gives an attacker control over tokens.

Drainers work because blockchain transactions are final and because a signature is a clear instruction to the network. Once a permission is granted or a transfer is signed, there is no bank to reverse it. Many victims do not realise they have signed anything harmful, because the request looked like a routine swap, a claim or a login step.

The defence is not one tool. It is a set of habits: know what you are signing, keep secrets offline, check the site you are using, limit old permissions and keep separate wallets for different activity. The sections below cover each of these in order.

Most drainers rely on signature requests rather than on breaking wallet software. Common routes include the following.

• A fake site that copies the look of a known dApp and asks you to connect your wallet, then requests a signature that grants a contract access to your tokens.
• A phishing message that links to a page offering a claim, a mint or a reward that requires a signature.
• A malicious browser extension that changes what appears on a page or swaps a destination address.
• A permit or typed-data signature that looks like a login or a gas-free approval but grants spending rights.

The signature is the key step. A connect request only shares your public address with a site. A transaction or a message signature can authorise a transfer or an allowance. If a site asks for a signature you do not understand, that is the moment to stop.

Legitimate dApps such as Uniswap, Aave or Curve do ask for approvals during normal use, but they usually start from a page you reached on purpose and they explain the action on screen. Scammers imitate that flow, so the interface alone is not proof of safety.

Your seed phrase, also called a recovery phrase, and your private key give full control of a wallet. Anyone who holds them can move every asset in that wallet. No legitimate wallet, exchange, dApp or support team needs them from you.

Follow these basic rules.

1. Write the seed phrase on paper or a metal backup and store it offline in a secure place.
2. Never type it into a website, app, form, chat or call, even if the request appears to come from a known brand.
3. Never store it in a photo, cloud note, email or messaging app.
4. If you must restore a wallet, do it in the official wallet app you installed yourself, not through a link someone sent you.
5. Treat any message that asks you to verify or re-enter your phrase as a scam.

A private key works the same way as a seed phrase. Some tools export keys in a single string, and a fake app can ask for one. Keep both secrets out of every online form. If you think a phrase or key has leaked, create a new wallet with a new phrase and move funds to it as soon as you can, because the old one should be treated as compromised.

Before you approve any request, read it. Most wallets show the action type, the contract address, the amount and sometimes a simulated result. Take the time to look at these details instead of pressing the confirm button by habit.

Check these points on each request.

• Does the action match what you meant to do, such as a swap or a deposit?
• Is the spender or recipient the contract you expect, not an unfamiliar address?
• Is the amount limited, or does it ask for unlimited spending of a token?
• Does the message ask you to sign typed data you do not recognise?
• Does the request come right after you connected to a page you did not reach on purpose?

Unlimited approvals are a common concern. Many dApps request a very large allowance so you do not have to approve each swap. This is convenient but it means a compromised or malicious contract can take the full balance of that token. Where the wallet allows it, approve only the amount you need for the action in front of you.

If anything looks unclear, cancel the request and ask in a trusted community or read the protocol documentation. A delay costs very little compared with a drained wallet.

A token approval gives a contract permission to move a specific token from your wallet. Approvals stay active until you revoke them or spend the allowance, so an approval you granted years ago can still be used. Drainers often target old approvals to old contracts that are no longer maintained or that have been compromised.

To review approvals, use the approval or permissions page in your wallet, or an approval checker run by a well-known block explorer or wallet provider. Check which chain you are on, because approvals are per chain. Look for contracts you do not recognise and for approvals with very large amounts that you no longer need.

To revoke an approval, set the allowance for that token and spender to zero. This action is itself a transaction, so it costs a network fee. Revoke approvals you no longer use, especially for protocols you stopped using, and after a dApp you used has been reported as compromised.

Routine review is useful. Once every few months, or after you try a new protocol, go through your approvals and remove the ones you no longer need. Protocols such as Aave, Curve and 1inch may leave allowances behind after a single use, so it is worth checking after heavy activity.

Many drainers start with a fake copy of a real site. The address may differ by one character, use a different top-level domain or a lookalike symbol. Before you connect a wallet, confirm the address you are on.

Use these checks.

• Type the address yourself or open a bookmark you saved from the official site.
• Look for the exact domain in your browser, and check for small spelling changes.
• Be cautious of sponsored public reporting and links in social posts, since these are common ways to reach a clone.
• Check that the project publishes its contract addresses in its official documentation, and compare them with what the interface shows.
• Confirm the chain and network before you sign, because a page may ask you to use a different network.

The same care applies to apps. Download wallet apps and browser extensions only from official sources, and check the publisher name and the number of users before you install. Remove extensions you no longer use, because each one can read data on pages you visit.

If a site asks you to install something to claim a reward, stop. Legitimate protocols rarely require a new download to use their main features. When in doubt, search for the project through a trusted route and compare the result with the address you were given.

A hardware wallet keeps your private keys on a device that does not expose them to your computer. It reduces the risk from malware on your browser, but it does not stop you from approving a bad transaction. Always read the details shown on the device screen before you confirm.

A common safety setup is to split activity across wallets.

• A cold wallet, kept offline, holds long-term savings and is used rarely.
• A daily wallet holds only the funds needed for regular activity.
• A separate test or low-value wallet is used for new or unfamiliar dApps.

When a daily wallet is drained, the damage is limited to the funds in it. Keep only what you need in active wallets and move surplus to safer storage.

Some people also use a separate browser profile for crypto activity, with no other extensions installed. This does not make a wallet safe, but it reduces the number of scripts that can run next to your wallet pages. Keep your operating system, browser and wallet apps updated, since updates often fix known issues.

Address poisoning is a tactic where a scammer sends a tiny amount of a token from an address that looks similar to one you have used before. The aim is to get you to copy the wrong address from your transaction history. Always check the full address, not only the first and last few characters, before you send funds.

Fake support is another common route. Scammers may post replies under real accounts, send direct messages or call you with a claim that your wallet is locked or your account is at risk. Support teams for real wallets and exchanges do not ask for seed phrases, private keys or passwords, and they do not ask you to move funds to a safe account.

Recovery scams are also common after a theft. Someone may offer to trace your funds or get them back for an upfront fee. Be very careful with unsolicited offers of this kind, and do not share wallet access or pay fees to anyone who contacts you first.

If you receive an unexpected message, slow down, verify through an official channel you found yourself and ignore any deadline that pressures you to act at once.

If you think your wallet has been drained, act quickly and calmly. Speed matters because a drainer with an active permission or a stolen key can keep moving funds.

Steps to take in order:

1. Stop using the device and browser where you signed the suspicious request. If the site or app is compromised, close it.
2. If you still control the wallet and it holds funds, create a new wallet on a clean device with a new seed phrase, and move remaining assets to it. Do not reuse the old phrase.
3. Review and revoke token approvals on the affected wallet, if you can still send transactions from it.
4. Scan your computer for malware and remove any extension you do not recognise.
5. Save transaction hashes, addresses and screenshots. These help with reports to exchanges and to authorities.
6. If you bought or sold through a centralised exchange, contact its support through its official channel and ask about freezing the destination account if funds went there.
7. Report the scam to the relevant police or cybercrime unit in your country.

Do not pay anyone who promises to recover funds for a fee. A recovery service that asks for a seed phrase, a private key or an upfront payment is very likely another scam. Rules for reporting and for consumer protection vary by country, so check what applies where you live.