Wallet drainers explained: how they work and what stops them

A wallet drainer is malicious code, usually behind a fake website, mint page or airdrop claim, that tricks you into signing something that hands your assets to an attacker. Drainers are sold as ready-made kits, so even unskilled scammers can run them, and they work fast: once you sign, funds can be swept in seconds.

How a drainer works

1. 1You land on a convincing page: a fake airdrop, a cloned DeFi site, a hijacked project link or a paid search ad.
2. 2The page asks you to connect your wallet. Connecting alone usually can't take anything.
3. 3It then asks you to sign: a token approval, a permit signature or a direct transfer, often dressed up as "verify", "claim" or "mint".
4. 4Your signature gives the attacker permission to move your assets, and an automated script sweeps everything it can reach, often within seconds.

The traps to recognize

• Approvals for all your tokens or NFTs. A single "approve all" permission lets the attacker take every item in a collection.
• Off-chain permit signatures. Some tokens let a signature, with no gas fee and no visible transaction, authorize spending.
• Hijacked accounts and links. Real project accounts, Discord servers and websites get compromised and promote fake links.
• Fake support. "Support" that messages you first and wants you to connect or share a recovery phrase.
• Address poisoning. Look-alike addresses planted in your history, hoping you copy the wrong one.

Why speed is the real problem

A drainer's whole advantage is that nothing slows it down. There is no review, no cooling-off period and no second person to say that looks wrong. By the time you realize what happened, the funds have often been moved on. Protection has to work before the signature, or the system has to buy back time after it.

What a withdrawal delay changes

A withdrawal delay (a time lock) adds the missing pause. In a FORTCORE vault your savings sit in a separate vault, not in the wallet you connect to apps. Acting on them with your everyday key doesn't send them anywhere: it only queues a withdrawal that has to wait 48 hours by default. You are alerted straight away, and two of your other keys can cancel it.

So if a drainer tricks your everyday wallet, it can take what that wallet holds, but not the vault. At most it can queue a withdrawal, and a queued withdrawal is something you can see and cancel.

What a delay doesn't change

• Whatever you keep in your everyday wallet is still exposed, so keep that balance small.
• A withdrawal approved with two keys goes through immediately, so check the destination first.
• If two of your keys are compromised, the delay can't help.

A short defense checklist

• Open sites from bookmarks, not search ads or links in messages.
• Treat any request to "verify" or "claim" as suspicious until proven otherwise.
• Read the wallet prompt: what is being approved, to whom and for how much.
• Use a separate wallet for minting and experiments, with little in it.
• Revoke old approvals regularly.
• Keep long-term savings in a vault with a withdrawal delay.

For the full routine, read How to protect your crypto wallet: 9 steps that actually matter.