How wallet drainers work
Guide · 13 September 2026
Drainers rarely break cryptography. They get you to approve something, or to sign a transaction that hands over assets. Understanding the shapes of these attacks is most of the defence.
1. Malicious approvals
You connect to a fake or compromised dapp and sign an approval — often unlimited — to a contract you don't recognise. Later, it moves your tokens. The defence: check the spender, avoid unlimited approvals, and revoke what you don't need.
2. Phishing signatures
Some signatures are not payments at all. A message can authorise a transfer, a set of approvals, or a "permit" that lets a contract move tokens without a separate approval. If you can't read what you're signing, don't sign it.
3. Fake airdrops and tokens
An unknown token appears in your wallet. Claiming or swapping it can route you into a malicious contract, or it can be a honeypot you can buy but not sell. Treat unsolicited tokens as untrusted.
4. Address poisoning
An attacker sends dust from an address that looks like one you use, so you copy the wrong address from your history next time. Always verify the full address, or use a saved contact.
What you can do
- Read every approval and signature before you sign.
- Prefer specific allowances over unlimited ones.
- Revoke old approvals regularly.
- Watch for the unexpected — a new approval or an outflow you didn't initiate.
- Use a separate hot wallet for risky apps.
Where Shingan fits
Shingan is the watchful layer: it monitors your wallets across six chains and alerts you on Telegram when a risky approval or a large outflow happens, so a drainer's first move does not go unnoticed. It is read-only and never holds your keys.