🎣Phishing & Drainers: Anatomy of a Modern Crypto Theft
Summary
Drainers are malicious contracts designed to empty wallets in a single signature. Combined with sophisticated phishing, they stole over $500M in 2024. Understanding how they operate is the only effective defense.
Phishing kit as a service
Crypto phishing evolved: no more crude misspelled emails. SaaS platforms (Inferno Drainer, Angel Drainer, Pink Drainer) sell complete kits: identical website, audited drainer contract that evades detection, and real-time dashboard. The attacker only needs traffic — via Google Ads, comments on famous project tweets, or Discord DMs. Operators take 80% of the loot, the drainer developer 20%.
The 3 deadly signatures
Drainers don't steal your seed phrase — they make you sign transactions that hand them control. The three most common: (1) Approve unlimited: you sign unlimited permission on a token, the drainer drains that token whenever it wants. (2) Permit (EIP-2612): off-chain signature that seems innocuous but grants same power as approve. (3) SetApprovalForAll: sign once and all your NFTs from that collection are vulnerable. The signature looks technical, the site says "free verification" or "claim airdrop", and you click.
Practical defense: the anti-drainer checklist
(1) Separate interaction wallet: don't use your main wallet on new sites — use one with minimal amounts. (2) Weekly revoke.cash: review and revoke old approvals. (3) Read EVERY signature: if app asks for unlimited approve, suspicious; normal is approve for exact amount. (4) Hardware wallet with clear screen: device shows what you sign. (5) Pocket Universe / Wallet Guard / Blockaid: extensions that detect drainers in real time. (6) Bookmarks, not Google: never reach Uniswap/OpenSea from a search engine.
Key takeaways
- Drainers are a business: SaaS kit + dashboard + 80/20 commission
- They make you sign approve/permit/setApprovalForAll, not ask for seed phrase
- An off-chain signature (EIP-2612) can be as lethal as on-chain
- Interaction wallet + weekly revoke.cash = 90% of defense
- Hardware wallet with screen = you see what you actually sign
Warning
If a site asks you to sign 'free' to verify wallet, claim airdrop, mint unexpected NFT or connect to 'reactivate account' — it's 99% a drainer. Close the tab and verify the real project URL from official verified Twitter.