Agent Lane robot mascotAgent Lane
Menu

Guide

Crypto wallet drainers: how to spot one and what to do if you signed

Some links may earn us a commission at no cost to you, which helps keep these guides free and up to date.

Short answer: A wallet drainer is a fake crypto website that gets you to approve something in your wallet, and that approval lets the scammer move your coins. Only connect to sites you reached yourself, never approve a request you can’t read, and if you think you signed one, move what’s left to a new wallet and revoke approvals right away.

By Agent Lane Editorial · Page dated 3 November 2026

What is a crypto wallet drainer?

California’s DFPI describes drainers as tools scammers use to automatically empty a crypto wallet while the owner is using a malicious site posing as a real crypto project. The site doesn’t need your password. It needs you to press approve on one request in your wallet app.

MetaMask explains why this works: wallet requests are rarely written in plain language, so people think they are signing in, claiming a reward or listing an item, when the request actually gives the site permission to move their tokens.

How do people end up on a drainer site?

  • Free tokens. The FBI warns about fake “airdrops” offered by email, on social media, or in a note attached to tokens that suddenly appear in your wallet. The link leads to a site that connects to your wallet or asks for your seed phrase.
  • Surprise releases. The FBI also describes hacked or look-alike accounts of real projects posting a “surprise” or “limited supply” sale that links to a copy of the real site.
  • Ads and look-alike addresses. MetaMask lists sponsored search results, hacked community chats and cloned apps with nearly identical web addresses.
  • AI-made sites and chatbots. The FBI says scammers use AI to write content for fake crypto websites and put chatbots on them that push you to click.

What does a drainer request look like in my wallet?

It usually looks harmless. The button says “Connect,” “Verify,” “Claim” or “Sign in.” Three kinds of request can hand over control:

  • A spending approval. It lets a site move a token from your wallet later. ethereum.org says these approvals don’t expire and stay in place even after you disconnect the site.
  • A permission over a whole collection. It lets a site list or move every NFT you hold in that collection.
  • A “signature” with no network fee. MetaMask says some of these are off-chain permissions a scammer can use days or weeks later, so losing nothing right away doesn’t prove you’re safe.

How do I avoid wallet drainers?

  • Reach sites yourself. Type the address or use a bookmark. Don’t follow links from messages, ads or replies.
  • Treat free tokens you didn’t ask for as bait. The FBI says to check any offer with the crypto provider before you accept it or give any information.
  • Never type your seed phrase into a website. No real airdrop, mint or support check needs it. See never share a seed phrase.
  • Reject what you can’t read. If a request asks for an unlimited amount, names an address you don’t recognize, or your wallet can’t show what it does, say no.
  • Use a small separate wallet for new sites. Keep only what you’d be okay losing in it. See dedicated wallet.
  • Keep savings on a hardware wallet such as Ledger or Trezor. It only helps if you read the request on the device’s screen before you press approve.
  • Clear out old approvals. ethereum.org lists tools such as Etherscan and Revoke.cash to see and cancel them. Each cancel costs a small network fee.
  • Don’t rely on warnings alone. MetaMask says some wallets now flag known drainers before you confirm, but a brand-new drainer may not be on any list yet.

What should I do if I signed something on a drainer site?

Move fast. Drainers can empty a wallet in seconds, but some wait.

  1. Move what’s left to a new wallet with a new seed phrase you created yourself. MetaMask notes these permissions apply only to the account that signed, so a fresh account is out of their reach. If you typed your seed phrase anywhere, treat every account in that wallet as compromised.
  2. Revoke approvals on the old wallet with a tool listed on ethereum.org, so tokens that arrive later can’t be taken.
  3. Write down the details: the site address, the transaction IDs, the addresses your crypto went to, and the times.
  4. Tell your wallet provider and report it to the FBI at ic3.gov, even if you didn’t lose anything. Full reporting steps: AI crypto scams: how to report.
  5. Ignore recovery offers. The FBI warns that people promising to recover stolen crypto, especially for an upfront fee, may be running a second scam.

Can I get crypto back from a wallet drainer?

Usually not. The FBI says crypto transfers can’t be reversed, and MetaMask notes that in the blockchain’s eyes you approved the transfer, so there’s nothing to undo. A report is still worth filing: transfers are recorded on public ledgers, which the FBI says lets law enforcement trace where the money went.

Sources

Checked 3 November 2026 on each organization’s own site.

Related guides

All guides