How Wallet-Drainer Contracts Work and How to Detect Them

A "wallet drainer" isn't a virus or a hack of your device — it's a transaction, built by a malicious site, that you sign yourself. Understanding exactly how it works is the fastest way to stop falling for one, because the mechanism is more mundane and more visible than "hacked" implies.

The core trick: you're always signing something real

No wallet drainer bypasses your wallet's signature requirement — that's not how Solana or any blockchain works, and it never gets "hacked" for a phishing site's benefit. What actually happens is that a malicious site builds a transaction that does something you didn't intend, and presents it to your wallet for a completely ordinary-looking signature request. The signature is real, the transaction is real, and it executes exactly as constructed — the deception is entirely in what the transaction actually contains, not in bypassing the signing step.

The two most common transaction shapes

A disguised transfer. The simplest version: a "claim your airdrop" or "verify your wallet" button builds a transaction that transfers SOL or valuable tokens straight out of your wallet to the attacker's address, dressed up with a misleading label like "Verify" or "Claim" instead of anything mentioning a transfer.

A malicious authority delegation. A more dangerous version uses the SPL Token program's approve instruction, which lets you grant another address permission to move tokens out of your account on your behalf, up to a specified amount — a legitimate mechanism, normally used to let a DEX program execute a swap. A drainer site tricks you into approving a delegate address it controls, for your full balance, framed as some unrelated action. Nothing moves at the moment you sign — the theft happens later, whenever the attacker chooses to use the delegation, which is part of what makes this version harder to notice immediately.

Why it works even on careful people

Wallet drainers succeed because the wallet's confirmation screen, while technically accurate, is dense — a page of account addresses and instruction data that most people don't read line by line, especially when a site has already created urgency ("claim expires in 10 minutes") or familiarity (a convincing clone of a real project's site). The attack isn't exploiting a code vulnerability; it's exploiting the gap between what a confirmation screen technically shows and what a rushed person actually reads.

What to actually check before signing

• Read what the wallet says the transaction does, not just the site's button label. A "Claim" button that results in a wallet screen mentioning approve or a transfer to an unfamiliar address is a direct contradiction worth stopping for.
• Be specifically suspicious of approve/delegate requests you didn't initiate through a swap or lending action you recognize — this instruction type has no legitimate reason to appear from a page claiming to give you something.
• Check the destination address, if the wallet shows one, against what you'd expect — a transfer or approval pointed at an address with no relationship to the site you're on is a clear signal.
• Verify the URL, especially for anything mimicking a known project — drainer sites frequently use near-identical domains or paid ads mimicking a legitimate project's name.

Simulating before signing

Some wallets show a plain-language simulation of a transaction's effects before you approve — "this will send 2.5 SOL to address X" — which is far easier to sanity-check than raw instruction data. If your wallet offers this, read it every time, not just when something feels off; drainer sites are specifically designed to not feel off. For any transaction you're unsure about — including one you've already signed and want to understand after the fact — pasting the signature into Transaction Inspector shows exactly what moved, instruction by instruction.

Deeper background on why a legitimate non-custodial app can never move funds without your explicit signature — and how to tell the difference — is in What "non-custodial" actually means and the non-custodial model docs.