Wallet Drainer Kits: The Industrialisation of Theft
Drainer software is sold as a service with support, updates and a revenue share. Understanding the business model explains the volume.
Priya Raman · 2 min read
Most wallet-draining attacks are not built by the people running them. They are rented.
The business model
A developer writes the draining software. It handles connecting to a victim’s wallet, enumerating what they hold, ranking it by value, and constructing the signature requests most likely to be approved.
The software is then sold or licensed to operators, who supply the victims. The developer typically takes a percentage of what is stolen, collected automatically by the software itself.
The operator’s job is traffic: building the fake site, buying advertisements, compromising a community channel, or running the social side.
Why this matters
It explains the volume. The technical skill required to run one of these operations is now close to zero. The barrier is marketing, not engineering.
It explains the polish. A kit used by hundreds of operators gets refined continuously. The signature requests are designed and tested to maximise approval rates.
It explains the speed. Drains execute within seconds of a signature because the software has already enumerated the wallet and prioritised targets.
It explains the consistency. The same patterns appear across unrelated scams because they are running the same code.
What the software actually does
Enumerates holdings across multiple chains as soon as a wallet connects, before requesting anything.
Prioritises by value and ease. Tokens with existing approvals first, then those requiring a new approval, then native assets last since those need a direct transfer.
Constructs the least alarming request that works. Frequently a permit signature rather than a transaction, because it costs no gas and appears less consequential.
Chains multiple requests. If the victim approves one, more follow immediately.
Moves funds through predetermined routes to break the trail, automatically.
The defence that actually works
Not detecting the site. The sites are good, they are numerous, and several have been legitimate applications whose front ends were compromised, where no warning sign existed.
The defence is structural: a separate wallet for connecting to anything, holding a small balance, with long-term holdings in a wallet that has never connected to a website.
A drainer can only take what the connected wallet holds or has approved. Sizing that wallet is the entire defence, and it works regardless of how convincing the site was.
The secondary defences
Transaction simulation. Several wallets now show expected balance changes before signing. This catches the mismatch between what a site claims and what the request does.
Approval hygiene. Monthly review through a block explorer, revoking what is unused.
Treat message signatures as seriously as transactions. Permit signatures carry the same authority and none of the friction.
For the working balance
Funds at a regulated venue are not reachable by a signature at all. That is a genuine advantage for money you are actively using, and an exchange you can actually contact with a withdrawal allowlist adds a second barrier even if account credentials are compromised.
The category of loss described here requires a signature from a wallet. Remove the signature and it cannot happen.
Move any remaining funds to a wallet with a newly generated seed phrase before anything else. Then revoke token approvals, and report the incident to your local authorities and the exchange involved. Do not pay anyone who promises to "recover" your coins. That is a second scam, aimed at victims of the first.