Crypto wallet-draining scams turn phishing into a service business: operators supply malicious scripts or infrastructure, while affiliates lure people to counterfeit sites that prompt wallet connections, approvals, or signatures. A connection alone does not necessarily transfer funds; the danger is authorizing a contract or spender to move assets. Treat unexpected airdrops and urgent wallet prompts as suspicious, and review what each approval or signature permits.
What is a crypto drainer?
Check Point Research defines crypto drainers as “malicious programs or scripts designed to illegally transfer cryptocurrency from victims’ wallets without their consent.” In practice, the software is only one part of the operation: a service can provide the draining infrastructure, while affiliates attract victims through phishing messages and fake websites.
This service model lets criminals scale wallet theft without each affiliate building the underlying tools. In its December 2023 reporting on Angel Drainer, The Hacker News said collaborators were typically charged 20% or 30% of stolen proceeds. That range is the article’s report about that service at that time, not a universal fee or evidence of current activity. The available reporting does not establish whether Angel Drainer or a particular affiliate program is operating now.
How do crypto wallet-draining attacks work?
1. A message directs the victim to a counterfeit site
A common lure is a supposed airdrop, urgent claim, or other reward promoted through phishing or social media. The linked site may imitate a legitimate project. A familiar name or wallet-connection prompt does not prove the domain is genuine.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
2. The site requests a connection, approval, or signature
Connecting a wallet lets a site interact with it, but the connection itself is not necessarily permission to take tokens. The consequential prompt may instead request an on-chain token approval or an off-chain signature that grants spending permission. The user may see no immediate transfer even though an authorization has been created.
3. The permission is used to move assets
Once a malicious contract or spender has permission, it may use that authorization to transfer tokens. In the permit-based attack described by Check Point Research, a signed ERC-20 permit could later be used to establish an allowance, followed by a transfer of tokens. The key risk is not simply that a wallet was connected; it is that the user may have authorized a spender to act on assets.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Approval transactions and permit signatures are different
Both mechanisms can give a spender permission to move tokens, but the point at which that permission becomes visible differs. A missing approval transaction at signing time does not make a request safe.
| Permission type | What the user may be asked to authorize | What may be visible at the time | What to check |
|---|---|---|---|
On-chain token approval, such as approve |
Permission for a spender to use a token up to a specified amount, which may be very large or effectively unlimited. | An approval transaction is submitted on-chain. | Check the token, spender, and allowance amount. Consider whether the project and contract are legitimate. |
| Off-chain permit signature | A signed message that can establish token-spending permission, depending on the token and signature terms. | The signature may not itself appear as an on-chain approval transaction when signed; it can be submitted later. | Read the wallet’s signature details where available. Check the asset, spender, amount, and any stated expiry or other limits. Do not treat the lack of an immediate transfer as proof of safety. |
Exact wallet wording and available details vary. If a prompt does not make the permission understandable, decline it and verify the request through trusted project channels rather than guessing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
How broad was the reported threat?
Check Point Research’s December 2023 investigation named Ethereum, Binance Smart Chain, Polygon, Avalanche, and almost 20 other blockchain networks in connection with the activity it observed. This is a dated scope from that investigation, not a current count of networks targeted or supported by any service.
Reported theft totals also depend on the source and the service being discussed. The Hacker News reported on December 30, 2023, that Inferno Drainer had taken over $70 million from 103,676 victims. Check Point Research’s December 2023 report said similar services, including Inferno, had assisted in stealing over $80 million. Those are distinct estimates from separate reports, not reconciled totals.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
A later case should not be confused with those 2023 service figures: Check Point Research’s 2024 case study described a malicious Android app impersonating WalletConnect. It reported more than 10,000 downloads and approximately $70,000 stolen in that case, in which the app prompted wallet connections and approvals before tokens were withdrawn.
How to reduce the risk of authorizing a drainer
- Be skeptical of unexpected claims. Treat unsolicited airdrops, urgent rewards, and social-media links as suspicious, particularly when they ask you to interact with a wallet.
- Verify the destination independently. Check the domain and confirm the offer through the project’s trusted channels. Do not rely on a familiar logo, name, or wallet prompt.
- Read every wallet request. Before approving a transaction or signing a message, identify the asset, spender, amount, and duration or expiry where those details are shown. If you cannot tell what the action authorizes, do not sign.
- Check contract legitimacy. Verify the contract through trusted project information and independent sources before granting it access to tokens.
- Keep allowances narrow. Where possible, avoid large or indefinite allowances. Periodically inspect token approvals using a trusted wallet interface or blockchain explorer, and revoke permissions you no longer need.
- Use hardware wallets as one layer, not a cure. A hardware wallet can help protect key custody, but it cannot make a malicious approval or signature safe if you authorize it.
What to do after a suspicious approval or signature
- Stop interacting with the site. Do not approve additional prompts or assume that disconnecting the site removes permissions already granted.
- Assess the wallet’s token approvals promptly. Use a trusted wallet interface or blockchain explorer to identify and revoke suspicious or unnecessary allowances. Check Point Research’s 2024 case study advises creating a new wallet or revoking token approvals before continuing to use an affected wallet.
- Consider moving remaining assets to a new wallet. If you cannot establish that the wallet is safe, create a new wallet using trusted guidance and move assets that remain at risk. Do not reuse a compromised seed phrase in the new wallet.
- Get help through trusted channels. Contact the wallet provider or relevant project using independently verified contact information, not links from the suspicious message.
Revoking an allowance can prevent future use of that permission, but it does not reverse transfers that have already completed. Blockchain transfers may not be recoverable.
Best Value
- All your digital assets in one place. You can manage thousands of crypto including Bitcoin, Ethereum, Solana, Tether and more.
- Defend your identity against hackers: secure your online accounts with passwordless, hardware backed, 2FA logins for all your favorite apps and websites.
- Connectivity: USB-C cable connection only. No Bluetooth.Compatible with the Ledger Wallet crypto app, both desktop (Windows, macOS, Linux) and mobile (Android only). Not compatible with iOS.
- Protect your digital assets with the industry's best security: keep your private keys offline in your private signer, battle-tested by the Donjon's white hat hackers, CC EAL 6+ certified Secure Element, constantly updated Ledger OS.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
What the reporting does—and does not—establish
The detailed service and attack examples above come chiefly from investigations published by Check Point Research in December 2023 and 2024, with the Angel and Inferno figures reported by The Hacker News on December 30, 2023. They document observed tactics and cases at those times. They do not establish which named groups, affiliate programs, or specific network coverage remain active as of October 5, 2026.
Sources: Check Point Research, “The Rising Threat of Phishing Attacks with Crypto Drainers” (December 22, 2023); The Hacker News, “Beware: Scam-as-a-Service Aiding Cybercriminals in Crypto Wallet-Draining Attacks” (December 30, 2023); Check Point Research, “Wallet Scam: A Case Study in Crypto Drainer Tactics” (2024).
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
