Phishing, Drainers and Malicious Signatures
Permit, setApprovalForAll, fake airdrops, poisoned addresses: understand how drainers empty a wallet and learn to read a signature request.
The essentials
What is a drainer?
A drainer is a set of ready-to-use tools that scammers rent or buy to set up phishing sites. The site imitates a well-known application (a DEX, an NFT marketplace, an airdrop page), invites you to connect your wallet, then automatically analyzes what you own to present you with the most profitable signature request.
The difference from "classic" phishing is important. In the past, they had to extract your recovery phrase (seed phrase) from you. Today, a drainer can obtain the right to move your tokens simply because you clicked "Sign" or "Confirm." Your private key stays safe, but your funds leave anyway.
To give an order of magnitude, the security firm Scam Sniffer counted in 2025 about $83.85 million in losses linked to drainer-type phishing, across 106,106 victims. That is far less than in 2024 (about $494 million), but the phenomenon remains massive, and the year's largest single theft, about $6.5 million, went through a simple Permit signature.
Transaction or signature: the distinction that costs dearly
Your wallet can ask you two different things:
- A transaction: an action sent to the blockchain, which costs network fees (gas). Example: a transfer, a swap, a classic approval.
- A message signature: a text or set of data that you sign off-chain. It costs nothing and doesn't immediately appear on the blockchain.
Many users think a free signature is harmless, something like "proving you own the wallet." That's sometimes true (logging in to a site with "Sign-In with Ethereum," for example). But some signatures amount to a spending authorization, and that's precisely where drainers strike.
The main malicious signatures
Permit (ERC-2612)
The ERC-2612 standard lets you grant a spending authorization on a token by means of a signed message, instead of an approval transaction. The message contains in particular the beneficiary ("spender"), an amount, a unique number (nonce) and a deadline. Anyone can then submit this message to the blockchain and pay the gas on your behalf.
The convenience (no fees for you) is also the danger: you sign for free, the drainer submits the signature, then transfers your tokens right away. Because it's a signature and not a transaction, some wallets display less visible alerts than for a classic approval. Not all tokens support Permit, but many widely used tokens do.
Permit2
Permit2 is a contract published by Uniswap Labs to pool authorizations across applications. You approve the Permit2 contract once for a token, then each application asks you for a signature to obtain an authorization, which can be time-limited, or to carry out a one-off transfer.
The mechanism is legitimate and rather safer than unlimited approvals. But if you've already approved Permit2 for a token, a malicious site only needs a signature to obtain the right to move it. According to Scam Sniffer, Permit and Permit2 signatures dominated the large thefts in 2025.
setApprovalForAll
On NFTs (ERC-721 and ERC-1155), the setApprovalForAll function gives an "operator" the right to manage all the NFTs of a collection that you own, not just one. It's normal when you list NFTs for sale on a well-known marketplace. It's catastrophic if the operator is a scammer's address.
approve and increaseAllowance
The classic approval of a token (the approve function, or increaseAllowance on some contracts) is a transaction. The most frequent trap is approving an unlimited amount to an unknown address. Scam Sniffer ranks these approvals among the methods behind significant losses in 2025. To go further, see our guide on approvals and how to revoke them.
eth_sign and unreadable signatures
The eth_sign method signs a raw hash (a hexadecimal string) with no readable context. In practice, it can be used to sign anything, including a transaction. Several wallets have disabled it by default or surround it with very explicit warnings. Simple rule: if you can't read what you're signing, don't sign.
Bundled signatures (EIP-7702)
Since Ethereum's Pectra upgrade, a regular account can temporarily delegate its operation to a contract (EIP-7702), which notably allows several actions to be bundled into a single approval. Scam Sniffer reports that drainers began exploiting this type of bundled signature in 2025. Be wary of any "account upgrade" request that you didn't initiate.
Other common techniques
Fake airdrops and fake claim sites
Unknown tokens or NFTs appear in your wallet, with a name that points to a site "to claim your rewards." ethereum.org reminds us that these fake airdrops lead to malicious sites that ask you for approvals. The same logic applies to sponsored ads in search engines and fake social media accounts announcing an urgent "claim."
Address poisoning
Address poisoning targets your transaction history. According to Etherscan, the attacker generates an address that starts and ends with the same characters as an address you deal with, then sends you a transfer of 0 tokens, or a transfer of a fake token imitating USDC or USDT. The fake address then appears in your history. If you copy-paste "the last address used" without checking it in full, you send the funds to the scammer. No signature is needed: the mistake comes from a simple copy-paste.
Fake support in private messages
On Discord, Telegram or X, a "moderator" or a "support agent" contacts you privately to solve your problem. They send you a "sync" or "wallet validation" link, or ask for your recovery phrase. ethereum.org is clear: real support does not contact you on its own initiative and will never ask for your keys or your seed.
Malicious browser extensions
A fake wallet extension, or a compromised one, can change what is displayed on a page, replace a copied address or harvest data. Only install extensions from reliable sources, checking the publisher, and keep the number of extensions to a strict minimum on the browser that hosts your wallet.
How to read a signature request
Before clicking, take thirty seconds to check the following points:
- The site: is the address in the browser bar exactly that of the service? Use a bookmark, not a link you received or an ad.
- The type of request: is it a connection, a transaction or a message signature? A simple connection doesn't need to mention a token, an amount or a "spender."
- Sensitive keywords: "Permit," "PermitSingle," "PermitBatch," "setApprovalForAll," "approve," "spender," "operator," "allowance." Their presence means you are granting a spending right.
- The beneficiary: to whom are you granting this right? If it's an unknown address rather than a protocol's official contract, stop.
- The amount and duration: an unlimited authorization, or one valid for a very long time, needs a real reason.
- Consistency: why would an "airdrop claim" site ask you for a spending right over your stablecoins?
Transaction simulation
Many wallets and security extensions offer a simulation: before you approve, they replay the operation and show you the expected result ("you will send X, you will receive Y," "you are granting a spending right on Z"). It's a valuable aid, especially for signatures that are hard to read. But a simulation can be wrong or be bypassed; it complements your vigilance, it doesn't replace it.
The burner wallet
A burner wallet (disposable wallet) is a secondary address that holds only the bare minimum. You use it to test a new site, claim an airdrop or mint an NFT. If you sign something malicious, only that small amount is exposed. Your savings stay in another wallet, ideally protected by a hardware wallet, that connects only to applications you know.
A concrete example
Claire receives in her wallet a token named after a well-known protocol, with a name like "Reward available on [site]." Curious, she opens the site: it looks identical to the official interface. She connects her wallet, clicks "Claim," and her wallet displays a signature request, with no fees.
Instead of signing, Claire reads the content. She sees "PermitSingle," a token (her USDC), a maximum amount and a "spender" that is an unknown address. A claim should never ask for a spending right over her stablecoins: she rejects the request and closes the tab.
She then checks on the protocol's official site, via her bookmark: no airdrop is underway. The token received was bait. She doesn't try to sell it or "delete" it through another site, simply hides it in her wallet, and as a precaution checks the list of her active authorizations. Had she signed, the drainer could have submitted the signature and then transferred her USDC within moments.
What to do if your wallet has been drained
Act quickly, but in order. Start by identifying the type of attack, because the response isn't the same.
| What was stolen | Probable cause | Response |
|---|---|---|
| Several assets, on several networks | Recovery phrase or private key compromised | The wallet is lost: move what remains to a new wallet |
| One or a few specific tokens | Malicious approval or Permit signature | Revoke the relevant authorizations |
| NFTs from a collection | setApprovalForAll or marketplace signature | Revoke the malicious operator |
Then:
- Compromised seed: there is no way to "re-secure" this wallet. Create a new wallet, on a clean device, with a new recovery phrase generated offline, and check your computer (malware, extensions).
- Approval or signature: immediately revoke the active authorizations to the scammer's address. Revoke.cash states that once the revocation is done, the wallet can be used normally again, since its key did not leak.
- Permit signature not yet used: it's sometimes possible to invalidate it before execution, but drainers generally use it almost immediately.
- Document everything: note the addresses, transaction hashes, the fraudulent site's URL. File a complaint and report the address to the exchanges where the funds might land.
- Beware of "recovery agents": anyone who contacts you promising to recover your funds in exchange for payment is very likely a second scammer.
This guide provides general security information and does not constitute legal or investment advice.
Mistakes to avoid
- Signing because it's free: a signature with no fees can grant a full spending right over your tokens.
- Interacting with a token you received without asking: no selling, claiming or "unlocking" on an unknown site.
- Copying an address from the history: use an address book and check the middle characters, not just the start and end.
- Replying to "support" in private messages: real services don't contact you on their own initiative.
- Using the same wallet for everything: separate savings from experiments with a burner wallet.
- Leaving unlimited approvals lying around: regularly clean up your authorizations.
- Clicking a sponsored ad to reach a protocol: use your bookmarks.
Frequently asked questions
What is a wallet drainer?
A ready-made phishing kit that scammers use to set up fake sites. It does not necessarily need your recovery phrase: all it takes is for you to sign the right request to get the right to move your tokens.
Can a free signature empty my wallet?
Yes. A Permit, Permit2 or setApprovalForAll signature costs no fee, but it can grant spending rights over your tokens or a whole NFT collection. According to Scam Sniffer, Permit and Permit2 signatures dominated the large thefts of 2025.
What should I do if I signed a malicious request?
Identify the cause. After a malicious approval or signature, revoke the permissions involved immediately. If your recovery phrase is compromised, the wallet is lost: create a new one and move what is left. Document everything and file a police report.
How do I recognize a dangerous signature?
Look for the words "Permit", "setApprovalForAll", "approve", "spender" or "operator": they mean you are granting spending rights. Check the site, the beneficiary, the amount and the duration, and refuse anything unreadable or inconsistent.
Key takeaways
- A drainer doesn't need your seed: a single Permit, Permit2 or setApprovalForAll signature can be enough to drain a wallet.
- Read every request: type, site, beneficiary, amount, duration. If it's unreadable, inconsistent or urgent, refuse.
- Transaction simulation and a burner wallet greatly reduce the risk, without replacing your vigilance.
- Fake airdrops, fake support and poisoned addresses exploit curiosity, panic and copy-paste: slow down.
- After a theft, identify the cause: compromised seed, new wallet; malicious approval, immediate revocation.
- Nobody can "recover" your funds for a fee: that is a second scam.
Sources
- Scam Sniffer — 2025 Crypto Phishing Report: losses fall 83% to $84 million
- Ethereum Improvement Proposals — ERC-2612: Permit Extension for EIP-20 Signed Approvals
- Uniswap Labs — Introducing Permit2 & Universal Router
- Etherscan Information Center — Address Poisoning Attacks
- Revoke.cash — What to do when you've been scammed
- ethereum.org — Ethereum security and scam prevention