How to spot a wallet drainer before you sign

Drainers don't break cryptography. They get you to sign something instead, which costs them nothing, works far more often, and needs only about 4 seconds of your inattention at the wrong moment.

Once you understand that every attack reduces to obtaining one signature, the patterns become easy to recognise.

The three shapes

Almost everything you'll encounter is one of these.

The approval trap. Approve a token, they said. Verification, activation, claiming something. That approval names a delegate who can then move your tokens whenever they like, with no further prompt and no notice. Solana token approvals covers the mechanics and how to revoke.

The disguised transfer. Presented as a claim or a mint. Actually a transfer out. The wallet shows you what it does, and drainers therefore pair it with pressure to click before you finish reading.

The seed phrase ask. Crudest, still effective. Wallet validators, support agents in your DMs, migration tools. Any request for your 12 or 24 words is an attempt to take everything you own, and it has no exceptions and no legitimate version anywhere.

The reliable tell

Urgency. Every time.

Limited airdrop, 10 minutes left. Security alert, your wallet is compromised, migrate now. Presale, 40 spots remaining. Support agent who needs you to act before something is lost forever.

Why does this work so consistently? Because reading takes time, and reading is what stops the attack. So the entire craft of a drainer is manufacturing a reason not to read.

Any legitimate protocol can wait 5 minutes while you think. Treat time pressure itself as the warning, independent of how plausible everything else looks.

The other patterns

Beyond urgency, a few things recur often enough to be useful filters.

Unsolicited contact comes first. Real teams don't DM you about a problem with your wallet. A support account that messages you before you messaged anybody is not support.

Then there's the near-miss domain. One character off, a different TLD, a hyphen where there wasn't one. People check the page and not the address bar, which is precisely the gap being exploited.

Free things with a signature attached come next. Genuine airdrops never need permission over assets you already hold, so any claim flow requesting an approval is quietly doing something other than claiming.

And finally, a transaction preview you can't explain. Can you say in one sentence what this does? If not, reject it. Rejecting a legitimate transaction costs 20 seconds; approving a malicious one costs the account.

Before you sign anything

Four checks, maybe 30 seconds total:

1. Read the domain character by character, not the page
2. Ask whether you initiated this, or whether it found you
3. Read the transaction preview and say aloud what it does
4. Notice whether anything is pushing you to hurry

Step 4 catches most of it on its own.

The habit that caps the damage

Nobody's judgement is perfect at 3am, so structure matters more than vigilance.

Wallet 1: storage, hardware-backed, connects to nothing and approves nothing. Wallet 2: interaction, funded with what a single session needs. Use the second one for anything unfamiliar, and the worst case becomes bounded by whatever was in it.

That's 5 minutes of setup, and it converts a catastrophic outcome into an annoying one. What connecting a wallet shares covers why connecting itself is harmless and signing isn't.

If you think you signed something bad

Order matters here.

Move remaining assets to a fresh wallet first. Revoking delegations first tells an attacker watching the chain that you noticed, and hands them a 30-second window to act while you're still clicking through a revoke tool.

Then revoke everything on the compromised wallet, and stop using it for anything that matters. Assume the address is permanently exposed rather than repaired.

Why this shows up around launches

Coin creators are targeted specifically, because they hold assets and they're constantly connecting to unfamiliar tools.

Which makes the request pattern a useful filter for any service you're evaluating. A campaign on your coin needs one thing: a single signed SOL payment. No key, no approval, no standing authority. Anything more is either bad engineering or the actual product, and you find out which afterwards. How to judge a volume service puts that check first, and the console is a fair reference for what the safe flow looks like.