Public blockchain data only — we never ask for seed phrases, private keys or upfront fees.
No wallet data stored Runs in your browser
All prevention tutorials
Prevention Tutorial 07 2026-09-16 · 8 min read
Wallet Security Phishing and Wallet Drainers: How One Click Empties a Wallet

I Signed One Approval. My Entire Wallet Was Empty in 40 Seconds.

A drainer never needs your seed phrase — it only needs one signature.

Safety note: we never guarantee recovery and never ask for seed phrases, private keys, crypto payments or upfront unlocking fees. Anyone who does is running a second scam.
The short version

What this tutorial says in five lines

  • A drainer takes tokens through an approval you signed — no seed phrase needed.
  • The approval lives on-chain until you revoke it, so the risk outlives the visit.
  • Unlimited approvals are the mechanism; token allowances are the permission.
  • Revoke approvals you do not recognise, on the correct official revoke tool.
  • Bookmark the sites you use; do not reach them through ads or DMs.

Why this matters

Most people assume a drained wallet means a stolen seed phrase. Often it does not. A drainer contract takes your tokens by asking you to sign an approval that you believe is a login, a claim, or a swap. The signature is genuine — which is exactly why it is irreversible. This tutorial explains the mechanism and the two habits that remove most of the risk.

What you actually sign

When you interact with a token, you grant the contract an allowance: permission to move up to a certain amount of that token on your behalf. That is how swaps and staking work at all. A drainer simply asks for an unlimited allowance and then uses it.

The critical difference from a password: an approval is a standing instruction recorded on the blockchain. Closing the browser does not cancel it. The permission remains until it is spent or explicitly revoked.

A signature cannot be undone. Treat every signature request as a permanent, irreversible grant of authority over whatever the contract asks for.

The drainer funnel, stage by stage

Drainers convert attention into signatures. Each stage has a defence, and the defences get cheaper the earlier you apply them.

The drainer funnel and the defence at each stage
StageWhat happensDefence
DeliveryA sponsored ad, a DM, a lookalike domain, a poisoned search resultNever reach a dApp through an ad, a DM or a redirect — bookmark the real URL
Lookalike pageA pixel-accurate clone of a real dApp, often on a near-identical domainRead the domain character by character, including the TLD
Connection requestA wallet connect prompt that only shares your addressConnecting alone is low risk; the danger is what comes next
The signature requestA prompt framed as a login, a claim or a "verification"Read what the prompt actually says. A login never needs an approval.
Unlimited approvalAn allowance for the maximum amount, not the amount you intendedCheck the requested amount and reduce it, or reject and leave
ExecutionThe contract transfers every approved token outSeconds matter; drainers usually execute immediately
PersistenceUnspent approvals remain usable on the compromised addressRevoke every unrecognised approval on the official revoke tool
The drainer funnel and the defence at each stage

Why "just don't approve" is hard in practice

Wallet interfaces show the request in a way that reads as routine. The figures below show which parts of a signature prompt victims reported noticing, from published post-incident accounts where the user could recall what was on screen. The pattern explains the loss: the parts people read are the parts a drainer never lies about.

Data

What victims recalled seeing on the signature prompt

Share of post-incident accounts recalling each element (highest recall first)

Site name / domain 91
A promise like "verify" or "claim" 84
The token involved 52
The amount or "unlimited" label 21
The contract address 7

Reading: The two elements that decide whether funds are drained — the spending amount and the contract address — are the two almost nobody reads. That is not an accident.

The revoke habit

Approvals outlive the visit, so cleaning them is a routine, not an emergency measure. Do it on a schedule for any address that interacts with dApps.

  • 01Use only the official revoke tools for the chain you are on. Search from a bookmark or a known source, never from a link someone sent you.
  • 02Revoke anything you do not recognise, and anything marked as an unlimited allowance.
  • 03Revoke approvals on any address you have stopped using entirely.
  • 04After revoking, re-check in a few days — an unexplained fresh approval means something is still interacting on your behalf and warrants a clean-device reset.
  • 05Keep a low-balance "interaction" wallet for unfamiliar dApps and never approve from your main holdings address.

Separating a small interaction wallet from your main holdings is the single structural change that limits a drainer to pocket change.

If your wallet was drained minutes ago

Forty seconds is enough time for a drainer, so this list is ordered by what can still be saved rather than by comfort.

  • 01Do not add funds to the compromised address under any circumstances, and do not attempt a "rescue" deposit.
  • 02Move any remaining assets to a fresh wallet generated from a fresh seed on a device you trust.
  • 03Revoke all remaining approvals on the drained address — unspent allowances can be used later.
  • 04Record the outgoing transaction hashes and the drainer contract address. These are your evidence.
  • 05Report it: the contract address and destination addresses are the parts that make a report useful to an exchange or to law enforcement.
  • 06Expect a "recovery" approach afterwards. It is a second fraud targeting the same victim.

The visual summary

Everything above, reduced to the four stages that matter for this topic. If you only look at one thing on this page, look at this.

Infographic supporting Phishing and Wallet Drainers: How One Click Empties a Wallet
Phishing and Wallet Drainers: How One Click Empties a Wallet — supporting infographic
Stage map

Where this fits in the pattern

01

Before contact

Nothing has happened yet. This is when every tutorial here is most useful and costs you nothing but reading.

02

During the approach

The script is running. The verification tests in this tutorial are designed to be run here, neutrally, without confrontation.

03

At the money request

The decisive moment. Any request for funds, fees, taxes or unlock deposits is the end of the script, not a stage of it.

04

After a loss

Prevention is over; evidence work begins. Preserve, report, and never pay a second fee to recover the first.

Common questions

No. A signature is final. You can revoke the allowance it granted, but anything already transferred is not recoverable.
Safer, because you review the details on the device screen — but a signature you consciously confirm is still valid. The device protects against key theft, not against being persuaded to sign.
After any new dApp interaction, and on a regular schedule for any address you keep funded. Approvals do not expire on their own.
Next step

Document the drainer address

Scan the destination address, capture its activity window and hop pattern, and export a report you can attach to your complaint.

Primary sources and further reading

External links open in a new tab so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.

Share this tutorial

Prevention only works if it reaches people before the contact does.

Disclaimer: this tutorial is general information, not legal, financial or recovery advice, and is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.