A wallet drainer usually looks like an ordinary token-claim page, but behind the "Connect Wallet" button sits a request for unlimited permission to move your USDT or NFTs. One click, and days or weeks later the wallet is empty — without you ever signing anything else. Here's how this type of theft actually works, how to check which approvals are active right now, and what exchanger owners should know before linking customer wallets to their platform.
How a drainer empties a wallet without a second signature
The mechanism is almost mundane: every ERC-20 token lets its owner approve another address — a smart contract — to move tokens on their behalf. That's an approval, and legitimate exchanges and DeFi protocols rely on it constantly; otherwise you'd sign a separate transaction for every single swap. The catch is that an approval can be set far above your actual balance — "unlimited," which many interfaces offer by default to save you a future click.
A drainer exploits exactly that habit. A fake airdrop site asks you to "connect your wallet and confirm eligibility" — and quietly swaps in an unlimited-approval transaction pointed at a scammer's contract. The signature looks harmless, gas is minimal, nothing moves right away. Then, a week or two later, once you've forgotten the site existed, the contract simply pulls whatever balance happens to be sitting there — in one call, with no action from you.
Fake claims and hijacked widgets — the two common entry points
- Fake token-distribution pages, usually shared through Telegram, X or email under a known project's name.
- A compromised payment or NFT-marketplace widget embedded on an otherwise legitimate site through a hacked front-end vendor — you connected nothing new, yet the approval still fired.
How a drainer differs from classic phishing
In ordinary phishing, the victim hands over a seed phrase or private key through a fake "restore access" form. A drainer works differently — your key never leaves your hands; what gets stolen is the right to sign, delegated to a smart contract. That's why a password manager won't save you here, but actually reading what you're about to sign in your wallet will.
How to check which approvals you've already granted
On EVM-based networks — Ethereum, BNB Chain, Polygon and similar — dedicated revoke tools connect to your wallet and list every active permission, token by token and contract by contract. It reads a bit like a bank statement: you see who has access and to how much, then decide what's safe to leave and what's stale.
- Open a revoke tool and connect your wallet in read-only mode — no signature needed yet.
- Sort the list by approval size; check the "unlimited" entries first.
- Match the contract address against the protocol's official site before trusting a label — never guess from the name alone.
How to revoke a risky approval
Revoking is just a regular transaction that resets the limit to zero, and it costs the same network fee as any other transfer. On a busy network that fee can spike, so it's worth checking approvals not once a year but after every new airdrop or mint you touch.
- Pick the permission you want to close in the list and confirm the revoke transaction.
- For NFT collections, look separately for "setApprovalForAll" — it grants access to the entire collection, not a single token.
- After revoking, refresh the page and confirm the limit actually reads zero, not just that it vanished from the list.
Why this isn't just personal hygiene — it's an exchanger risk too
At first glance this looks irrelevant to an exchanger: you don't hold customer private keys or grant approvals on their behalf. But the hit often lands sideways — a customer loses funds on some unrelated site, gets the cause wrong, and writes to the support team of whichever service they used most recently: yours. Untangling what actually happened, and explaining the difference between a drainer theft and an issue on your side, becomes your support team's problem.
There's a second angle: the exchanger's own operational wallets. If someone on the team tests a new DeFi tool from the same wallet used for customer settlements, one careless approval can touch real working balance. Separating wallets by role — settlement, testing, cold storage — isn't a formality here; it's the only real boundary.
Limitations and common mistakes
Revoking an approval doesn't bring back stolen tokens — it's prevention, not a cure. A false sense of safety after a single check is another common trap: new approvals appear every time you interact with a new protocol, so one cleanup round never closes the list for good. And mobile wallets tend to show far less detail about permissions than desktop interfaces — for the full picture, it's worth opening a revoke tool from a computer now and then.
Conclusion
Approval-based draining stays underrated precisely because the victim signs the transaction themselves, seeing nothing obviously wrong in it. A quick permission check costs a couple of minutes and is far cheaper than cleaning up after an incident. For an exchanger, it's also a trust question: anyone building their own exchange business and looking to cut reliance on risky third-party wallets might want to look at a dedicated option — iEXWallet, part of the iEXExchanger platform.
