The mental model most people hold — that crypto theft requires stealing a seed phrase — is now outdated. A large share of losses happen when the owner personally signs a transaction they did not understand, on a site that looked correct, using a wallet that behaved normally. Nothing was stolen in the traditional sense. Permission was granted.

What a drainer actually does

A malicious site prompts you to connect your wallet, which is harmless by itself, then requests a signature. The request is often a token approval granting a contract permission to spend a particular asset, sometimes without limit. At signing time nothing appears to leave your wallet, which is precisely why it does not feel alarming. The contract can then transfer those assets whenever it chooses — minutes or months later.

Where the prompts come from

  • Airdrop claim pages promoted through compromised social accounts of real projects.
  • NFT mint links shared in Discord servers, frequently posted by a hijacked moderator account.
  • "Wallet validation", "sync error", or "revoke to secure" pages that appear after a support conversation.
  • Search advertisements sitting above the genuine result for a well-known exchange or wallet.

Read what you are signing

Wallets increasingly decode requests into plain language. Take the extra seconds to read it. An approval naming a contract you do not recognise, or granting an unlimited allowance, should be rejected. If a request cannot be decoded and displayed clearly, that alone is reason enough to decline it.

The seed phrase rule has no exceptions

Nobody legitimate asks for it: not support, not a wallet provider, not a validation tool, not a recovery service. Any interface requesting a seed phrase or private key is stealing, full stop. This includes hardware wallet setup screens that appear unexpectedly, and browser extensions that ask you to "re-import" an existing wallet.

Practical hygiene

  • Keep long-term holdings on a hardware wallet that never connects to unfamiliar sites.
  • Use a separate, low-balance wallet for minting, claiming, and experimenting.
  • Review and revoke token approvals periodically through a reputable approval checker.
  • Bookmark exchanges and wallet sites; never reach them through search ads or messages.

If you have already signed something

Move remaining assets to a newly created wallet immediately rather than attempting to secure the compromised one — outstanding approvals may still be live. Then revoke approvals on the old address, record the transaction hashes and the contract involved, and report to the exchange if funds moved to one. Recovery is unlikely once funds reach a private wallet, and it is more honest to say that than to imply otherwise.