Does a drainer steal my seed phrase?

Usually no. Most drainers never see your key or seed phrase. They obtain a signed authorization, such as an approval, permit, or setApprovalForAll, that lets an attacker-controlled contract move your assets. That is why entering a seed phrase into any website is a separate and even more severe risk.

Why did nothing happen when I signed?

Granting spend permission and spending are separate steps. Signing an approval or permit changes an allowance but does not move funds immediately. The attacker's contract executes the transfer afterward, sometimes much later, using the permission you already granted.

Can a hardware wallet prevent a drainer?

A hardware wallet protects your private key but does not stop you from authorizing a malicious transaction. If the device only shows a hash or truncated data, you are blind signing and a hardware signature on a bad approval is just as final as a software one.

How do people end up on drainer sites?

Through impersonated ads in search and social feeds, fake support agents, typosquatted or compromised domains, comment spam, and airdrop lures. The common thread is a trusted-looking brand plus urgency to make you act before you check.

What single habit helps most?

Slow down at the signing prompt and identify what you are actually authorizing: a transfer, an approve, a permit, or a setApprovalForAll, and which contract it targets. If your wallet cannot show that clearly, do not sign.

How Wallet Drainers Actually Work: The Mechanism

A wallet drainer rarely steals your key. It gets you to sign one authorization, then moves your assets on its own schedule. Here is the mechanism, end to end.

A wallet drainer is not malware in the traditional sense. It does not need to break your device or steal your private key. In most cases it needs one thing: a single authorization, signed by you, that grants an attacker-controlled contract permission to move your assets. The drainer’s entire job is to obtain that authorization while showing you a story that makes the request look routine.

What a drainer is, technically

A modern drainer has two halves. The first is a front end: a phishing website built to imitate a legitimate application, an airdrop claim page, a minting site, or a wallet-support portal. The second is a back-end contract deployed on chain, sometimes called the spender or router contract, that is authorized to pull assets out of victim wallets once permission is granted. Security researchers describe the combination as front-end JavaScript plus an on-chain spender contract that converts a signed message into an immediate transfer to the attacker.

The front end connects to your wallet, reads your balances, and decides what to ask for. If you hold a token with a large balance, it requests an approval for that token. If you hold valuable NFTs, it requests collection-wide operator permission. The request is presented through your own wallet’s signing prompt, which is why it feels legitimate: the prompt genuinely comes from your wallet software, not from the attacker.

How the authorization is obtained

Drainers rely on the fact that granting spend permission and spending are two separate steps in most token standards. You first authorize a spender; the spender can then move tokens later, without asking again, until the authorization is removed. Attackers request one of several authorization types depending on what you hold:

An ERC-20 approval for a fungible token, often for an unlimited amount, so the spender can transfer your entire balance whenever it chooses.
An off-chain signature (a permit or a Permit2 message) that grants the same spending power without an on-chain approval transaction, so there is no gas cost to alert you and nothing appears in your transaction history until the theft occurs.
An NFT setApprovalForAll that hands an operator control over every token you own in a collection.
A direct transfer disguised as a “claim” or “verification” action, where the transaction you sign simply sends assets to the attacker.

Whichever type is used, the pattern is the same: you approve something whose real effect is different from what the page told you.

Why the on-screen story and the transaction diverge

When you cannot read what you are authorizing, you are trusting the website’s description of the transaction instead of the transaction itself. Drainers exploit exactly that gap. The page says “Claim your reward” or “Verify wallet to continue,” while the underlying call is approve, permit, or setApprovalForAll pointing at the attacker’s spender. If your wallet shows only a hash or an opaque blob of typed data rather than a plain-language summary, there is nothing on screen to contradict the phishing narrative.

How victims are funneled to the page

Drainer front ends are useless without traffic, so operators invest heavily in distribution. Common channels include search and social advertisements that impersonate real projects, comment and reply spam under legitimate posts, fake support agents who direct users to a “sync” or “validation” tool, compromised or typosquatted domains, and messages promising airdrops. The unifying theme is urgency and legitimacy: the victim believes they are interacting with a known brand and that they must act quickly.

Drainer-as-a-service

Much of this activity is industrialized. Under a drainer-as-a-service model, a core group develops and maintains the drainer kit and leases it to lower-skilled operators in exchange for a percentage of stolen funds. Group-IB and other researchers document this rental economy, in which the kit authors provide the front-end templates, the spender contracts, and the cash-out infrastructure while affiliates focus purely on driving victims to phishing pages. The result is a large volume of near-identical phishing sites sharing the same underlying machinery.

Why a hardware wallet does not automatically stop this

A hardware wallet protects your private key. It does not, by itself, protect you from authorizing a malicious transaction, because you are the one approving it. If the device can only display a hashed or truncated version of the request, you are effectively blind signing, and a hardware signature on a malicious approval is just as final as a software one. Hardware wallets raise the bar against key theft; they do not remove your responsibility to understand what you sign.

A worked mental model

It helps to separate the two events in your mind:

Authorization. You sign something. Nothing appears to happen. Your balance is unchanged. This is the moment the attacker was waiting for.
Execution. Seconds, hours, or days later, the spender contract calls transferFrom (or the NFT equivalent) and moves your assets. You did not sign this second step, because you already authorized it.

Because execution is decoupled from authorization, victims often report that “nothing happened” when they signed, and only discover the loss later. The delay is a feature of the design, not a coincidence.

How to reduce your exposure

Drainers depend on defaults working in the attacker’s favor. You can change those defaults:

Read the actual call, not the page. Before signing, identify whether the request is a transfer, an approve, a permit, or a setApprovalForAll, and which contract it points to. If you cannot tell, do not sign.
Distrust unlimited approvals. Approve only the amount you intend to spend where the application allows it, and treat “unlimited” requests from unfamiliar sites as a red flag.
Use a wallet that decodes transactions. Wallets and hardware devices that present clear, human-readable summaries make the divergence between story and call visible.
Compartmentalize. Keep long-term holdings in a wallet that never connects to random sites, and use a separate low-value wallet for minting, claims, and experimentation.
Review and revoke approvals regularly. An approval you forgot about is a standing risk. Auditing them closes doors that drainers rely on being left open.

None of these steps require special tooling or expertise. They require slowing down at the one moment the attacker needs you to hurry: the signing prompt.

Sources

Note: CamoCrypt is security & education only — no prices, no predictions, no investment advice. Verify every address and contract yourself; we cannot recover lost funds and neither can anyone who contacts you claiming they can.

How wallet drainers actually work