Wallet Drainers and Approval Phishing Explained: Protecting Your Crypto in Australia

Moving your crypto into your own wallet removes the risk of an exchange being hacked or freezing your funds — but it hands you a new responsibility. The most common way self-custody investors lose money in 2026 is not a stolen seed phrase or a brute-forced password. It is approval phishing, where you are tricked into signing a transaction that quietly hands a scammer permission to empty your wallet. The tools that automate this are called wallet drainers, and they have industrialised what used to be a manual con.

This guide explains, in plain English, how wallet drainers work, why they are so effective against experienced users, and the specific habits that keep an Australian self-custody investor safe. Understanding token approvals is genuinely the difference between using DeFi confidently and losing everything in a single click. We will also walk through exactly how to read a risky signature, and what a real drainer transaction looks like.

How token approvals work — and why they are dangerous

When you use a decentralised app — a DEX like Uniswap, a lending market like Aave, or an NFT marketplace — you grant a smart contract permission (an “approval”) to move a specific token on your behalf. This is normal and necessary; it is how DeFi functions. Your wallet holds ERC-20 tokens, and a contract cannot touch them until you explicitly authorise it to.

The danger is that many apps request an unlimited approval for convenience, meaning the contract can move all of that token, now and forever, until you revoke it. A malicious contract that obtains an unlimited approval can drain that token from your wallet at any moment, without needing your seed phrase or any further action from you. You already gave permission — you just did not realise how much. The approval can sit dormant for months and be triggered long after you have forgotten the interaction that created it.

What a wallet drainer actually does

A wallet drainer is a kit — often sold as “drainer-as-a-service” to scammers who split the proceeds with the developers — that sits behind a malicious website and is engineered to get you to sign the most damaging transaction possible. Depending on the trick, a single signature can:

Grant an unlimited token approval (approve or increaseAllowance) to the attacker’s contract.
Authorise the transfer of your NFTs via a deceptive setApprovalForAll marketplace signature.
Use gasless “permit” signatures (EIP-2612 or Permit2) — where you sign a message rather than a transaction — that authorise spending without you noticing an obvious approval or paying any gas.
Trick you into signing a transaction that changes your account’s delegation or directly transfers your most valuable asset.

Because the wallet pop-up often looks routine, and the malicious site looks identical to a real one, even careful users get caught. The drainer then sweeps the approved assets in seconds, often prioritising your highest-value tokens automatically. This overlaps heavily with the broader landscape of crypto scams Australians face, but approval phishing specifically targets self-custody wallets rather than exchange logins.

How you get lured to a drainer

The malicious site is only half the con; the other half is getting you there and lowering your guard.

Fake airdrops. “Claim your free tokens” is the classic hook — and note that even legitimate airdrops carry an ATO tax angle, so the free-money framing is doubly misleading.
Impersonated brands. Sponsored search ads and lookalike domains for real DeFi apps — the malicious result often sits above the genuine one in search results.
Compromised social accounts. A hacked project X (Twitter) or Discord account posting a “mint” or “claim” link that thousands trust because it comes from a real account.
Fake support. Someone messaging you in a Discord or Telegram offering to “help” connect your wallet to fix a problem — genuine support never DMs first.
Poisoned token airdrops. An unfamiliar token simply appears in your wallet; interacting with it or visiting its “claim” site leads to a drainer.

Reading a signature: what safe vs dangerous looks like

The moment of truth is the wallet pop-up. Learning to read it is the single most protective skill in self-custody. When your wallet asks you to sign, pause and check:

Is it a transaction or a signature? A plain message signature that mentions spending, allowances, a “Permit”, or “Seaport” on a site you did not deliberately trust is a major red flag, because these gasless permits are a favourite drainer tool and do not show up as an obvious approval.
What amount is being approved? An approval showing “Unlimited” or a huge number for a token you only meant to swap a small amount of should make you stop.
Which contract is the spender? A brand-new, unverified contract address requesting broad permissions is suspicious.
Does the action match your intention? If you clicked “claim a free NFT” but the wallet is asking to approve your valuable stablecoins or set approval for all your NFTs, the site is malicious. A genuine claim rarely needs you to approve tokens you already own.

Many modern wallets now surface a plain-English summary and flag known drainer contracts — heed those warnings rather than clicking through them.

Practical defences for Australian self-custody users

1. Read every signature before you approve

Slow down and actually read what your wallet is asking you to sign. Be deeply suspicious of any request for an unlimited amount, any setApprovalForAll on your NFTs, or a permit signature on a site you did not deliberately seek out. If a “free claim” asks you to approve token spending, that is the con — a genuine airdrop rarely needs an approval to receive it.

2. Revoke approvals you no longer use

You can review and cancel the approvals your wallet has granted using a reputable token-approval checker (such as Revoke.cash or the token-approvals tool built into Etherscan). Make it a habit to revoke unused approvals periodically — for example, a quick review every few months, and immediately after interacting with any new protocol. An approval you cancel can never be exploited later. Note that revoking costs a small amount of gas, which is a trivial price for closing off a standing risk.

3. Use a hardware wallet

A Ledger or Trezor shows the transaction details on its own trusted screen and requires a physical button press. It will not stop you approving a malicious contract if you ignore the details, but it forces a deliberate confirmation and protects your keys from malware on your computer. The distinction between hot and cold wallets matters here, and it is worth reading how to set a hardware wallet up safely before you rely on it.

4. Use a separate “hot” wallet for risky interactions

Keep the bulk of your holdings in a wallet that never connects to random dapps. Use a small, separate wallet — funded with only what you can afford to lose — for minting, testing new protocols and claiming airdrops. If that wallet gets drained, your main stack is untouched. This compartmentalising is one of the most effective habits in self-custody, and it is far easier to adopt than perfect vigilance on every single signature.

5. Protect the fundamentals

None of the above matters if your seed phrase leaks, so never type it into any website — a legitimate dapp will never ask for it. Combine that with strong 2FA on your exchange accounts, and you cover both the self-custody and custodial sides of your setup. Bookmark the real URLs of the apps you use and reach them only through those bookmarks, never through a search ad or a link in a message.

A walkthrough: how a single click drains a wallet

To make this concrete, picture a common scenario. You follow a link from a hacked project’s X account promising an airdrop claim. The site is a pixel-perfect copy of the real project, and a “Connect Wallet” button appears. Connecting is harmless — it only shares your public address — but the site now reads your balances and identifies your most valuable token, say a large USDC holding.

You click “Claim”. Instead of a simple claim, your wallet pops up a signature request. If you are rushing, it looks routine and you approve it. In reality you may have just signed one of two things: an unlimited approval giving the attacker’s contract permission to move all your USDC, or a gasless Permit2 signature authorising the same thing without even a visible transaction. Within seconds a bot detects the fresh approval and transfers your USDC out. No seed phrase was ever exposed — you handed over permission yourself, one click at a time. The only points where this could have been stopped were reading the signature, noticing that a “free claim” was asking to spend a token you already owned, and using a throwaway wallet for the interaction.

Why drainers keep working — the economics

It is worth understanding why these attacks are so relentless. Drainer kits are sold as a service: developers build the malicious code and take a cut (often 20–30%) of everything stolen through it, while affiliates handle the phishing and traffic. This division of labour means unsophisticated scammers can run professional-grade attacks, and the developers are incentivised to keep innovating new signature tricks faster than wallets can warn about them. That is why relying on your wallet’s warnings alone is not enough, and why durable habits — a separate hot wallet, reading every signature, revoking approvals — matter more than any single tool. This same drainer-as-a-service model powers a large share of the losses covered in our overview of crypto scams Australians face.

What to do if your wallet is drained

Move fast, and act in this order:

Rescue what remains. If you still have funds in the compromised wallet, immediately transfer them to a brand-new wallet with a fresh seed phrase generated on a clean device. The old wallet must be treated as permanently unsafe — the attacker may hold standing approvals that let them re-drain new deposits.
Revoke outstanding approvals you can still reach, to cut off the attacker’s access to any remaining or future tokens.
Do not move NFTs or tokens back to the compromised wallet under any circumstances — some drainers run bots that instantly sweep any new arrival.
Report it. Because these transactions are irreversible, report the incident to Scamwatch and ReportCyber for intelligence purposes, even though recovery is unlikely.
Ignore “recovery” offers. Anyone promising to recover your funds for a fee is a follow-up scammer exploiting your distress.

Frequently asked questions

Can a wallet drainer steal my crypto without my seed phrase?

Yes — that is what makes them so dangerous. By tricking you into signing a malicious approval or permit, an attacker gains permission to move your tokens without ever seeing your seed phrase. The signature you approved is the authorisation.

Do I need to revoke token approvals?

It is strongly recommended. Every active approval is a standing permission that could be exploited if that contract is malicious or later compromised. Periodically reviewing and revoking unused approvals through a reputable tool closes off that risk for a trivial gas cost.

Does a hardware wallet make me immune to drainers?

No. A hardware wallet protects your private keys and forces you to confirm transactions, but if you approve a malicious signature anyway, it will execute. Hardware wallets reduce risk; reading every signature and using a separate wallet for risky activity is what closes the gap.

An unknown token appeared in my wallet — is it dangerous?

Do not interact with it. Unsolicited “airdropped” tokens are a common lure: their name or a linked “claim” site is designed to send you to a drainer. Simply holding the token does no harm, but attempting to sell, swap or claim it can prompt a malicious signature. Ignore and hide it.

Is it safe to connect my wallet to a new DeFi app?

Connecting a wallet (which just shares your public address) is low-risk; the danger is what you later sign. Verify the app’s real URL through an official source, use a separate low-value wallet for anything experimental, read every approval carefully, and revoke the approval afterwards if you do not plan to keep using the app.

General information only. This article is general information and education, not financial or tax advice. Cryptocurrency is highly volatile and you can lose money. Crypto Australia Guide does not hold an Australian Financial Services Licence (AFSL). Always do your own research and consider speaking to a licensed financial adviser or registered tax agent about your personal circumstances before investing. Tax treatment depends on your individual situation and current ATO guidance.