How Wallet-Drainer Contracts Work and How to Detect Them

A wallet drainer isn't a virus, and nobody hacks your device. It's a transaction that a malicious site builds and that you sign yourself. Once you see how it works, it gets much easier to avoid, because the mechanism is more ordinary and more visible than the word "hacked" suggests. Solana's staying-safe guide covers general habits. This post is about the transaction itself.

You always sign something real

No drainer gets around your wallet's signature. Solana doesn't work that way, and neither does any other blockchain. The malicious site builds a transaction that does something you didn't intend and sends it to your wallet as an ordinary signature request. The signature is real and the transaction is real, and it runs exactly as it was built. The trick lies in what the transaction contains.

The two common shapes

A disguised transfer. This is the simplest version. A "claim your airdrop" or "verify your wallet" button builds a transaction that sends SOL or valuable tokens from your wallet to the attacker. The button says "Verify" or "Claim" and never mentions a transfer.

A malicious delegation. This version is more dangerous. It uses the SPL Token program's approve instruction, which lets another address move tokens out of your account for you, up to a set amount. Approve has honest uses, such as letting a DEX program carry out a swap. A drainer site gets you to approve a delegate it controls for your whole balance, presented as some unrelated action. Nothing moves when you sign. The theft comes later, whenever the attacker decides to use the delegation, which makes it harder to notice at the time.

Why careful people fall for it

The wallet's confirmation screen is accurate, but it's dense: account addresses and instruction data that most people don't read line by line. It's worse when the site has already created urgency ("claim expires in 10 minutes") or looks familiar because it's a good copy of a real project's site. The attack doesn't exploit a bug in any code. It exploits the difference between what the confirmation screen shows and what a hurried person reads.

What to check before you sign

• Read what the wallet says the transaction does, and ignore the label on the site's button. If a "Claim" button leads to a wallet screen that mentions approve or a transfer to an address you don't know, stop.
• Treat any approve or delegate request with suspicion unless it comes from a swap or lending action you recognise. A page that claims to be giving you something has no reason to ask for one.
• Check the destination address if the wallet shows one. A transfer or approval to an address with no connection to the site you're on is a clear warning.
• Check the URL, especially for anything that looks like a known project. This is phishing in its plainest form, and drainer sites often use near-identical domains or paid ads under a real project's name.

Simulate before you sign

Some wallets show a plain-language simulation of what a transaction will do before you approve it, such as "this will send 2.5 SOL to address X". That's far easier to check than raw instruction data. If your wallet does this, read it every time, and not only when something feels wrong, because drainer sites are built to feel normal. For any transaction you're unsure about, including one you've already signed, paste the signature into Transaction Inspector to see what moved, instruction by instruction.

What "non-custodial" actually means and the non-custodial model docs explain why an app that never holds your keys can't move your funds without your signature, and how to check whether an app works that way.