Drainers

Overview

How Drainers Work

1. Phishing Site: Victim visits a fake website mimicking a legitimate project
2. Wallet Connection: Site requests wallet connection (appears normal)
3. Malicious Approval: User signs a transaction granting unlimited token approvals
4. Asset Theft: Drainer contract transfers all approved assets to attacker
5. Speed: Entire process can happen in seconds

Types of Drainer Attacks

Approval-Based Drainers

• Request ERC-20 token approvals
• Can drain all approved tokens at any time
• Most common type

NFT Drainers

• Target NFT collections
• Often use setApprovalForAll function
• Can steal entire collections in one transaction

Permit-Based Drainers

• Use EIP-2612 permit signatures
• No on-chain approval transaction required
• Harder to detect before execution

Native Token Drainers

• Trick users into signing ETH transfers
• Often disguised as minting or claiming functions

Detection Indicators

Common Drainer Tactics

• Fake airdrops: “Claim your free tokens” phishing
• Fake mints: Impersonating popular NFT drops
• Compromised Discord/Twitter: Links posted from hacked accounts
• SEO poisoning: Fake sites ranking for popular project searches
• Typosquatting: Domains similar to legitimate projects

API Example

curl -X GET "https://api.webacy.com/addresses/0x123...?chain=eth" \
  -H "x-api-key: YOUR_API_KEY"

{
  "overallRisk": 95.0,
  "issues": [
    {
      "tag": "drainer",
      "severity": "high",
      "description": "Address related to drainer activity that automates draining assets"
    }
  ]
}

Protection Strategies

1. Verify URLs - Always check you’re on the official website
2. Review approvals - Use our Approval Risks endpoint
3. Limit approvals - Only approve exact amounts needed
4. Revoke old approvals - Regularly audit and revoke unused approvals
5. Use hardware wallets - Provides extra signing verification step
6. Check before signing - Read transaction details carefully