Drainers are sold as ready-made kits. The victim reaches a convincing page — an airdrop, a mint, a support portal, a fake wallet-verification tool — and is asked to sign something described as harmless.
The onchain signature is genuine, so nothing rejects it. Traces of drainer proceeds usually converge quickly on a small number of collection addresses shared across many victims, which is one of the reasons these cases are worth documenting.
Related terms
Token approval
Permission you grant a contract to move a token on your behalf, which stays in force until you revoke it.
Approval revocation
Cancelling a permission you previously granted a contract, so it can no longer move your tokens.
Phishing
Impersonation of a trusted brand or person to obtain credentials, signatures or payments.
Trying to work out what happened to your funds?
The first review is free and we set out scope and price in writing before any paid work.