Drainers do not need your recovery phrase. They use your own signature. This guide is part of our section on crypto threats and scams.
What a drainer does
- You land on a fake site, often from an ad, a hacked social account or a fake airdrop.
- You connect your wallet, which alone is usually harmless.
- The site asks you to sign something.
- That signature gives it the right to move your tokens.
- Scripts sweep your assets in seconds.
Most activity like this happens on networks with smart contracts, such as Ethereum.
Types of malicious signatures
| Type | What it does |
|---|---|
| Token approval | Lets a contract spend your tokens, often without limit |
| Off-chain permit | A signature that costs no gas, and that can later be used to approve spending |
| Set approval for all | Gives control of all your NFTs in a collection |
| Direct transfer | Disguised as a claim or a mint |
| Blind signing | The device shows only an unreadable hash |
The worst signatures look free. Off-chain signing costs nothing, and it can feel harmless, but it can move funds.
How to protect yourself
- Use a separate wallet for new sites, holding only what you are prepared to lose.
- Keep savings in a wallet that never connects to anything new.
- Read each request. If you cannot understand what you are approving, stop.
- Avoid blind signing. Turn it off if you can.
- Bookmark sites that you use often. Avoid ads and links.
- Check your hardware wallet's screen.
- Be suspicious of urgency and free mints.
- Review token approvals regularly, and revoke old ones.
If you signed something bad
- Move your remaining assets to a clean wallet straight away.
- Revoke approvals, if this is still useful.
- Treat that wallet as unsafe from now on.
Your recovery phrase may still be safe, as a drainer usually only has approvals. But if you typed your phrase anywhere, follow our emergency steps.
Be aware of follow-up scams. See recovery services.
Other things to watch for
- Address poisoning. Tiny transactions plant a lookalike address in your history. Never copy from there.
- Fake token approvals in a hacked real site. Even trusted sites can be compromised.
- Browser extensions. Fake wallet extensions are common. See malware and hijackers.