Crypto Wallet Drainer Scam: What You're Actually Approving When You "Verify"

You see an airdrop announcement, click the link, connect your wallet, and confirm a "verification" step. Within minutes, every token in the wallet is gone. The site looked exactly like the real project — same logo, same colors, same layout. The only difference was a single character in the URL, and the confirmation screen said no funds would be affected.

A wallet drainer is a malicious contract — a piece of code — that empties a cryptocurrency wallet the moment an unsuspecting user grants it permission to do so. The scam works because most victims don't realise they've granted permission at all. The website describes the action as verifying your wallet, claiming your airdrop, or signing in securely. In reality, they've approved an unlimited transfer of their tokens to an address controlled by the attacker.

Understanding why this works requires understanding the difference between three things that look identical from the outside.

How The Scam Works

Three actions — completely different consequences

Connecting your wallet means showing a website your public address. It's the equivalent of giving someone your email address. They can see what you own, but they cannot touch it. Connecting your wallet to a website cannot by itself move any funds. This action is safe.

Signing a message is typically a proof of identity — it confirms you control the wallet. Most sign requests are harmless: they're off-chain, cost no fees, and authorise nothing. Your wallet software shows a pop-up with text to sign. This looks the same whether the request is truly harmless or whether it uses a standard called EIP-2612 (also called a permit signature), which looks like a message but actually functions as a token approval. Victims cannot distinguish these by appearance.

Approving a transaction grants another address the right to move your tokens on your behalf — up to an amount you specify. When you use a decentralised exchange, you approve it to handle your tokens for that trade. When a scam contract gets this approval, it can drain all your tokens at any time, without any further action from you.

The drainer mechanic

Step 1 — Lure. You see a link to an airdrop, an NFT mint, a wallet verification portal, or an exclusive token claim. The site looks professional.

Step 2 — Connect. You connect your wallet. Nothing bad has happened yet.

Step 3 — The trap. The site prompts you to verify, claim, or activate. Your wallet software shows a confirmation screen. The site says this is just a security check — no funds will move, there's no gas fee. You approve.

Step 4 — Drain. You've just approved an unlimited token transfer to a drainer contract. Within seconds — often automated — the contract sweeps your wallet, taking every token it was approved to access. In some cases it also targets NFTs using a separate setApprovalForAll permission.

The reason victims feel safe: the confirmation screen often shows no ETH amount, no visible fee, no obvious you are sending money warning. It looks like a log-in step.

Example Scam Messages

Example 1 — Fake airdrop

Arbitrum Airdrop Round 2 is live — eligible wallets can claim up to 1,200 ARB. Connect your wallet to verify eligibility and claim before the window closes in 4 hours: [link]

Example 2 — Fake NFT mint

LAST CHANCE — the AlphaPass mint is now open to waitlist members. Connect your wallet to the official mint portal and confirm your whitelist spot. Gas is covered. [link]

Example 3 — Fake wallet verification

Your wallet has been flagged for a routine security check. Please connect and sign the verification message to restore full access to your linked accounts. This is not a transaction — no funds will be affected. [link]

Common Warning Signs

The site appeared via a social media post, Discord message, Telegram link, or airdrop aggregator — not through a project's verified official announcement.
The mint, claim, or event is described as urgent: hours remaining, limited supply, last chance.
The site URL doesn't match the project's verified contract address or domain — even by a single character.
Your wallet confirmation screen shows an unlimited approval amount, or a contract address you don't recognise.
The site says this is just a verification while your wallet is asking for a transaction confirmation — these two things cannot both be true at the same time.
A signature request doesn't display a simple readable message — it contains hex data or encoded parameters.

Common Mistakes

Trusting the site's description of the action over what your wallet software is actually requesting — if the site says "no funds affected" but your wallet shows a transaction or approval, believe your wallet.
Clicking airdrop or mint links from Discord DMs, Telegram messages, or social media comments rather than navigating to the project's verified website directly.
Assuming a site is legitimate because it looks identical to the real project — copying a website's design takes minutes; the only reliable indicator is the domain name.
Not revoking approvals immediately after suspecting something is wrong — a drainer contract can wait hours before executing, so quick revocation can still prevent loss.

How To Verify It Is Legitimate

Before connecting your wallet to any site, verify the URL. Paste it into 2check.click. Scam mint and airdrop sites are built on recently registered domains — often registered the same week as the campaign. A domain a few days old carrying a well-known project's branding is a fake.

Find announcements through verified channels only. For any airdrop or mint, find the official announcement through the project's verified social media account, their official Discord server, or their website accessed through a trusted bookmark. Do not use links shared in DMs, public comment sections, or airdrop aggregator sites you haven't independently verified.

Read your wallet confirmation screen carefully. Before approving anything, look at what your wallet is actually asking. If it shows a contract address you don't recognise, an unlimited amount, or the words setApprovalForAll, stop. These are not verification steps — they are permission grants. A genuine site will show you a specific, bounded amount for a specific purpose.

If you're unsure about a signature, reject it. Legitimate services do not require unlimited token approvals to verify wallet ownership. If you're prompted to approve an unlimited amount or approve all of any token type, that is not a normal operation. Decline it.

What Happens If You Respond

Once a drainer contract has your approval, it can empty your wallet at any time — immediately or hours later. The transaction is irreversible. Tokens transferred out of your wallet by an approved contract are gone. Some drainers are built to maximise value: they scan for the highest-value assets first — rare NFTs, large token balances — and drain them in a calculated order before you notice anything has happened.

What To Do Next

If you approved something suspicious: immediately go to a token approval manager such as revoke.cash and revoke all unknown approvals — this does not recover what's already been taken, but prevents further drain. Before connecting your wallet there, confirm the domain is exactly revoke.cash — phishing copies of the site exist and use near-identical domain names.
Check your transaction history in your wallet to confirm exactly what was approved and when.
Report the scam site to your wallet provider's phishing report channel.
If the scam site impersonated a real project, report it to that project's official team via their verified channels.
File a report with your national cybercrime authority.
Cryptocurrency transactions are irreversible — recovery through official channels is rarely possible, and any service offering to recover drained funds is almost certainly a second scam.

How 2check.click Can Help

Wallet drainer sites are built on one thing: a convincing URL that looks like the real project. Sometimes it's a letter swapped, a hyphen added, or a different domain extension. These changes are invisible during a fast-paced claim window.

Before connecting your wallet to any site for a mint, airdrop, or verification — especially one reached via a link rather than a bookmark — paste the URL into 2check.click. It checks domain registration age (drainer sites are almost always newly registered), lookalike signals against known project domains, and redirect patterns that legitimate web3 projects don't use. Checking takes ten seconds. Revoking after a drain doesn't recover what was taken. If you've already approved something and been drained, avoid any service claiming to recover the funds — see the crypto recovery scam guide for why those offers are almost always a second fraud.

Frequently Asked Questions

My wallet software said "Signature Request" not "Transaction." Doesn't that mean no funds move?

Not always. Standard sign messages are safe — but a signature standard called EIP-2612 (permit) allows token approvals to be granted through what appears to be a sign request, with no gas fee and no obvious transaction indicator. If the signature text contains structured data with fields like "spender," "value," and "deadline," it is a permit approval, not a harmless message. When in doubt, reject it.

I only connected my wallet. Could I still be at risk?

Connecting alone — sharing your public address — cannot move funds. However, some scam sites prompt additional interactions immediately after connection: a pop-up claiming you need to verify, or a continue step. The risk comes from what you approve after connecting, not from connecting itself.

The site had the correct project name and matched the style perfectly. How was it fake?

Scam sites copy the real site's design entirely — this takes minutes. The only reliable indicator is the domain name. One character difference in the URL means a completely different website. Paste it into 2check.click to check the domain's registration date and whether it matches the real project's verified domain.

Can I cancel the approval after I've made it?

Yes — if you haven't been drained yet. Use a token approval manager — revoke.cash is widely used — to see all active approvals on your wallet and revoke any you don't recognise. Confirm the domain is exactly revoke.cash before connecting your wallet. Revoking an approval is a small transaction that requires a small gas fee, but it prevents the approved contract from transferring further funds. It does not recover anything already taken.

Someone is offering to help me recover what was drained. Should I trust them?

No. Unsolicited recovery offers targeting victims of wallet drains are themselves a well-documented second scam. Blockchain transactions are irreversible — no third party can retrieve tokens from a drainer contract without the drainer's cooperation. See the crypto recovery scam guide for more on how this second fraud works.