Guide
What Is a Wallet Drainer? How One Signature Can Empty Your Wallet
Answer first: one signature on a fake site sweeps your assets
A wallet drainer is a malicious script that gets you to sign a fraudulent transaction on a fake site or fake dApp, then drains the assets in your wallet all at once. You get lured in with "free mints," "airdrop claims," or copycat sites that look just like the real thing, and the damage is done with a single button-press signature. Once you sign, the transaction generally cannot be reversed.
Key points of this article
A drainer works by getting you to make one signature on a fake site to steal your assets. On Solana, the main tactics are transactions that transfer multiple tokens in one batch, or getting you to sign a token-account ownership transfer / delegate (authority delegation) — somewhat different from Ethereum's "unlimited approve." Defenses: read what you're signing, don't connect to sketchy dApps, and separate your assets with a hardware wallet. For the big picture, see scam tactics and defenses.
The main tactics on Solana
| Tactic | What happens |
|---|---|
| Signing a batch transfer | You sign one transaction that sends SOL and multiple tokens to the attacker |
| Abusing delegate (delegation) | You sign a request that grants the attacker authority to move your tokens |
| Token-account authority transfer | You sign a transaction that hands over ownership of the account itself |
| Fake transaction simulation | The transaction is dressed up to "look safe" to prompt your signature |
Rather than Ethereum's "unlimited approve," Solana attacks are reported to focus mainly on direct transfers and authority delegation. In every case, the entry point is a signature on a fake site.
Defenses (most important)
- Read the details before you sign: check the recipient, the tokens being sent, and whether any delegation is involved
- Don't connect to suspicious dApps or links: don't click the link on an NFT that arrived unsolicited
- Keep large holdings on a hardware wallet: verify physically with a Ledger
- Review permissions regularly: revoke token approvals (approve/delegate)
- Separate your spending wallet from your storage wallet
Read next
- Checkup → How to revoke token approvals
- Start here → Solana scam tactics and defenses
Frequently asked questions
Q. What is a wallet drainer? A. It's a malicious script that gets you to sign once on a fake site and sweeps the assets from your wallet all at once. Transactions are generally irreversible once signed.
Q. Are the tactics different from Ethereum? A. On Solana, rather than unlimited approve, attacks are reported to focus mainly on getting you to sign direct asset transfers or token authority delegation (delegate).
Q. How do I protect myself? A. Read the details before signing, don't connect to suspicious dApps, separate your assets with a hardware wallet, and revoke permissions periodically.
Sources
- Phantom official (revoking approvals): https://help.phantom.com/hc/en-us/articles/19142125651731-Revoke-token-approvals
- Phantom official (if you were scammed or drained): https://help.phantom.com/hc/en-us/articles/5487893286291-I-was-scammed-or-my-wallet-was-drained-What-can-I-do
A note on investing and security
This article is for informational purposes only and is not investment advice. Crypto assets (including SOL) carry risks such as price volatility, hacking, fraud, and network outages. Make security and investment decisions at your own responsibility, and always check the latest official information first.
Sources
FAQ
- What is a wallet drainer?
- It's a malicious script that gets you to sign once on a fake site and sweeps the assets from your wallet all at once. Transactions are generally irreversible once signed.
- Are the tactics different from Ethereum?
- On Solana, rather than unlimited approve, attacks are reported to focus mainly on getting you to sign direct asset transfers or token authority delegation (delegate).
- How do I protect myself?
- Read the details before signing, don't connect to suspicious dApps, separate your assets with a hardware wallet, and revoke permissions periodically.
This article is informational only and is not financial, investment, or trading advice. Prices are reference snapshots and may be outdated. Always do your own research.
