Short answer
The answer in plain English
A wallet drainer is a malicious website or app that tricks you into approving a transaction or signature that lets an attacker move your crypto. It usually does not break the blockchain. Instead, it abuses a permission that the wallet owner was persuaded to grant.
Why it matters
What to understand
Connecting a wallet usually lets a website see your public address. Approving a token is different: it can give a smart contract permission to spend it. That permission may remain active after you leave the site. Check the domain and transaction carefully, limit approvals, reject signatures you do not understand, and review existing allowances after anything suspicious.
The theft often begins with permission
A wallet drainer does not always break cryptography or “hack the blockchain.” A common pattern is social and procedural: a fake mint, airdrop, support page, or urgent security warning persuades someone to approve a transaction or sign a message whose consequences are wider than they appear.
The wallet then uses the owner’s key to create a valid signature. If the permission is valid and the contract follows it, the network has no way to know that the person was misled.
Connect is not the same as approve
Connecting a wallet usually lets a site see the selected public address and request interactions. By itself, that is not the same as granting a contract the right to spend tokens.
An ERC-20 approval is more consequential. The token standard defines an approve mechanism that sets how much a spender may transfer on the owner’s behalf. Many legitimate decentralized applications need this to swap, lend, or deposit tokens. The danger is not the existence of approvals; it is granting a permission you do not understand, to the wrong contract, for an unnecessarily large amount.
Why disconnecting may not help
Wallet interfaces often include a list of connected sites. Removing a site from that list can stop a convenient front-end connection, but an on-chain token allowance is separate. Ethereum’s own revocation guide warns that disconnecting a wallet does not remove permissions already granted to a contract.
Allowances can remain until they are used, replaced, or revoked. That persistence is useful for repeated legitimate interactions—and dangerous when the spender is malicious or later compromised.
Signatures can carry intent
Not every dangerous request looks like an ordinary token approval transaction. Some systems use signed typed data or permit-style messages so a later transaction can present the user’s authorization. “No gas” therefore does not mean “no consequence.” The meaningful question is what authority the signature conveys.
Wallet warnings help, but they cannot always translate complex contract behavior into plain language. A hardware wallet also cannot rescue a bad decision after its screen confirms the exact malicious transaction or signature; it protects key custody, not judgment.
A safer pause before signing
Before approving:
- Open the project from a trusted bookmark or independently verified source—not a message link or promoted search result.
- Check the network, contract, token, spender, and amount shown by the wallet.
- Prefer a limited allowance when the application supports it.
- Reject requests that are unexpected, rushed, or impossible to explain in one sentence.
- Keep valuable long-term holdings separate from wallets used for unfamiliar applications.
After a suspicious interaction, stop signing new prompts. Review allowances using a reputable explorer or revocation tool, revoke unnecessary access, and consider moving remaining assets to a clean wallet if qualified incident guidance recommends it. Never share a seed phrase with a “support” contact.
The lesson is not “never approve.” An approval is authority. Treat it with the same care as the assets it can move.