What this tutorial says in five lines
- A drainer takes tokens through an approval you signed — no seed phrase needed.
- The approval lives on-chain until you revoke it, so the risk outlives the visit.
- Unlimited approvals are the mechanism; token allowances are the permission.
- Revoke approvals you do not recognise, on the correct official revoke tool.
- Bookmark the sites you use; do not reach them through ads or DMs.
Why this matters
Most people assume a drained wallet means a stolen seed phrase. Often it does not. A drainer contract takes your tokens by asking you to sign an approval that you believe is a login, a claim, or a swap. The signature is genuine — which is exactly why it is irreversible. This tutorial explains the mechanism and the two habits that remove most of the risk.
What you actually sign
When you interact with a token, you grant the contract an allowance: permission to move up to a certain amount of that token on your behalf. That is how swaps and staking work at all. A drainer simply asks for an unlimited allowance and then uses it.
The critical difference from a password: an approval is a standing instruction recorded on the blockchain. Closing the browser does not cancel it. The permission remains until it is spent or explicitly revoked.
A signature cannot be undone. Treat every signature request as a permanent, irreversible grant of authority over whatever the contract asks for.
The drainer funnel, stage by stage
Drainers convert attention into signatures. Each stage has a defence, and the defences get cheaper the earlier you apply them.
| Stage | What happens | Defence |
|---|---|---|
| Delivery | A sponsored ad, a DM, a lookalike domain, a poisoned search result | Never reach a dApp through an ad, a DM or a redirect — bookmark the real URL |
| Lookalike page | A pixel-accurate clone of a real dApp, often on a near-identical domain | Read the domain character by character, including the TLD |
| Connection request | A wallet connect prompt that only shares your address | Connecting alone is low risk; the danger is what comes next |
| The signature request | A prompt framed as a login, a claim or a "verification" | Read what the prompt actually says. A login never needs an approval. |
| Unlimited approval | An allowance for the maximum amount, not the amount you intended | Check the requested amount and reduce it, or reject and leave |
| Execution | The contract transfers every approved token out | Seconds matter; drainers usually execute immediately |
| Persistence | Unspent approvals remain usable on the compromised address | Revoke every unrecognised approval on the official revoke tool |
Why "just don't approve" is hard in practice
Wallet interfaces show the request in a way that reads as routine. The figures below show which parts of a signature prompt victims reported noticing, from published post-incident accounts where the user could recall what was on screen. The pattern explains the loss: the parts people read are the parts a drainer never lies about.
What victims recalled seeing on the signature prompt
Share of post-incident accounts recalling each element (highest recall first)
Reading: The two elements that decide whether funds are drained — the spending amount and the contract address — are the two almost nobody reads. That is not an accident.
The revoke habit
Approvals outlive the visit, so cleaning them is a routine, not an emergency measure. Do it on a schedule for any address that interacts with dApps.
- 01Use only the official revoke tools for the chain you are on. Search from a bookmark or a known source, never from a link someone sent you.
- 02Revoke anything you do not recognise, and anything marked as an unlimited allowance.
- 03Revoke approvals on any address you have stopped using entirely.
- 04After revoking, re-check in a few days — an unexplained fresh approval means something is still interacting on your behalf and warrants a clean-device reset.
- 05Keep a low-balance "interaction" wallet for unfamiliar dApps and never approve from your main holdings address.
Separating a small interaction wallet from your main holdings is the single structural change that limits a drainer to pocket change.
If your wallet was drained minutes ago
Forty seconds is enough time for a drainer, so this list is ordered by what can still be saved rather than by comfort.
- 01Do not add funds to the compromised address under any circumstances, and do not attempt a "rescue" deposit.
- 02Move any remaining assets to a fresh wallet generated from a fresh seed on a device you trust.
- 03Revoke all remaining approvals on the drained address — unspent allowances can be used later.
- 04Record the outgoing transaction hashes and the drainer contract address. These are your evidence.
- 05Report it: the contract address and destination addresses are the parts that make a report useful to an exchange or to law enforcement.
- 06Expect a "recovery" approach afterwards. It is a second fraud targeting the same victim.
The visual summary
Everything above, reduced to the four stages that matter for this topic. If you only look at one thing on this page, look at this.
Where this fits in the pattern
Before contact
Nothing has happened yet. This is when every tutorial here is most useful and costs you nothing but reading.
During the approach
The script is running. The verification tests in this tutorial are designed to be run here, neutrally, without confrontation.
At the money request
The decisive moment. Any request for funds, fees, taxes or unlock deposits is the end of the script, not a stage of it.
After a loss
Prevention is over; evidence work begins. Preserve, report, and never pay a second fee to recover the first.
Common questions
Document the drainer address
Scan the destination address, capture its activity window and hop pattern, and export a report you can attach to your complaint.
Primary sources and further reading
- FTC — Scams That Follow a Scam consumer.ftc.gov
- FBI — Common Scams and Crimes www.fbi.gov
- CISA — Cybersecurity Best Practices www.cisa.gov
External links open in a new tab so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.
Prevention only works if it reaches people before the contact does.
Disclaimer: this tutorial is general information, not legal, financial or recovery advice, and is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.