Table of Contents
What a Drainer Actually Is
A drainer is a script embedded in a website. When your wallet connects, it reads what you hold, constructs a transaction that moves the valuable parts to the attacker, and pops a signature request — dressed up as whatever the site claims to be doing.
Nothing is broken. The cryptography works exactly as designed. The transaction is valid, authorised, and final, because your key signed it.
Drainers are sold as a service to people who run the phishing sites, with the operators taking a percentage of what's stolen. That's why the pages look professional: the same polished kit is deployed across thousands of fake sites.
The reframe that protects you: your wallet's job is signing, and it will sign whatever you tell it to. The security question is never "is this site safe to connect to" — it's "do I understand what this specific transaction does to my balances." Every modern Solana wallet answers that for you in the simulation preview. The failure is not reading it.
Attack 1: The Malicious Signature
The main event. You land on a site — an airdrop claim, an NFT mint, a "token migration," a staking portal. You connect. It immediately asks you to sign.
How it reaches you: a reply to a popular tweet, a Google ad above the real site, a Discord announcement from a compromised moderator account, a DM about an exclusive allocation, a QR code at a conference.
What the transaction actually does: transfers your SOL and SPL tokens out, or sets the attacker as a delegate on your token accounts so they can move tokens later.
How to stop it:
- Read the simulation. Phantom and Solflare both preview balance changes before you sign. A "claim" that shows your SOL leaving is not a claim.
- Be suspicious of immediate signature requests. Legitimate sites usually let you look around first. Connect → instant signature prompt is a pattern worth distrusting.
- Use a burner. Anything unfamiliar gets connected with a wallet holding nothing.
- Type domains yourself. Never reach a claim page via a link in a reply, ad, or DM.
Attack 2: Seed Phrase Phishing
Less sophisticated, still extremely effective. You're asked to enter your 12 or 24 words to "validate," "sync," "restore," or "resolve an error." Sometimes it's a fake support agent who appears within minutes of you posting a problem in a public channel.
Give up the phrase and the attacker doesn't need you again — they restore your wallet on their own machine and empty it whenever they like.
There is no legitimate reason to type a seed phrase into anything except your own wallet app during setup or recovery. Not a website, not a form, not a support chat, not a "wallet checker," not a hardware wallet verification page. Every request is theft, with zero exceptions. Anyone who DMs you first offering help is running this attack.
Attack 3: Fake Wallet Extensions
A cloned wallet extension, pixel-identical to the real one, distributed via search ads or a lookalike domain. You install it, create a wallet or import an existing one, and the extension sends your key straight to the attacker.
The version that catches careful people: a fake extension that generates a wallet from a seed the attacker already knows. Everything works normally — right up until the wallet holds enough to be worth taking.
How to stop it: type phantom.com or solflare.com directly. Check the publisher and install count in the extension store. Be sceptical of any "wallet update" prompt that arrives outside the wallet itself. Setup done properly is covered in how to create a Solana wallet.
Attack 4: Poisoned Airdrops
Sending an SPL token to any wallet costs a fraction of a cent, so attackers spray tokens to hundreds of thousands of addresses. The token's name, symbol, or metadata contains a URL: "Claim 5,000 USDC at [site]." Or the token simply looks valuable, so you try to sell it — and the swap interface you find routes through their site.
Either way, the endpoint is the same drainer as Attack 1.
How to stop it: treat unexpected tokens as inert junk. Don't sell them, don't swap them, don't claim anything, don't visit any URL they contain. Hide them and move on. If you need to check whether a token is real, look it up by mint address on Solscan or DexScreener rather than following its links. Hiding tokens is covered in managing your Phantom token list.
Attack 5: Address Poisoning
The attacker generates an address whose first and last characters match one you regularly send to, then sends you a dust transaction so it appears in your history. Later, you copy the address from your transaction history instead of your records — and because you check the first four and last four characters, it looks right.
How to stop it: never copy addresses from transaction history. Use saved contacts in your wallet, or paste from your own records. Verify the entire address, not the ends. If you're using a Ledger, confirm the address on the device screen — malware can change what your browser shows but not what the device shows.
The Defence Stack
Layered, cheapest first:
- Separate wallets by risk. A burner for anything new, a daily wallet with modest funds, and cold storage for the rest. This single habit caps the damage of every attack above.
- Read transaction simulations. Every time. If the preview doesn't match what you think you're doing, reject it. The three seconds this takes is the highest-value security habit in crypto.
- Type domains. Bookmark the real ones. Never navigate via ad, reply, or DM.
- Hardware for anything serious. A Ledger makes remote key theft essentially impossible — though it can't stop you approving something yourself.
- Review delegations periodically. Solana uses per-token delegate approvals rather than blanket allowances, so the exposure is narrower than on Ethereum — but a stale delegate is still a live risk. Solflare surfaces and revokes these.
- Assume unsolicited contact is hostile. Anyone who DMs you first about an opportunity, a problem, or a fix is running an attack. This heuristic has close to no false negatives.
Extra Risk for Token Founders
Running a token makes you a much higher-value target, and attackers tailor the approach:
- Fake listing and partnership offers. "Your token qualifies for a CEX listing — connect your treasury to verify." Real listings never require a wallet signature to apply. See how CEX listings actually work.
- Fake analytics and boost services asking you to connect the wallet holding your LP.
- Compromised team accounts. A drainer link posted from your own verified account does enormous damage. Enable hardware-key 2FA on every project account.
- Targeted spear-phishing. Your deployer wallet is public, so attackers know exactly what you hold and can tailor the bait.
This is a structural argument for splitting your wallets: a compromised ops wallet costs you a marketing budget, while a compromised everything-wallet costs you the project. See wallet setup for token founders and Squads multisig treasuries, where a single compromised key isn't enough to move anything.
If You've Already Been Drained
Act in this order:
- Move whatever remains, immediately, to a brand new wallet created on a device you trust. Attackers often run bots that sweep incoming SOL from compromised addresses within seconds.
- Abandon the compromised wallet permanently. If the seed phrase leaked, that wallet can never be safe again — no amount of revoking fixes it.
- Work out which attack it was. If you signed on a phishing site, other wallets are fine. If you entered a seed phrase, every wallet derived from it is gone. If it was a fake extension, assume the device is compromised and treat every key on it as burned.
- Report the address to Solscan, Phantom and Solflare so it gets blocklisted for others.
- Don't engage with "recovery services." Every single one is a second scam targeting people who just lost money. Nobody can reverse a Solana transaction.
Solana transactions are irreversible. There is no support line, no chargeback, and no authority that can undo a transfer. Anyone claiming they can recover drained funds — for a fee, for a signature, for anything — is lying.
FAQ
What is a wallet drainer?
Malicious code on a website that builds a transaction sending your assets to an attacker, then presents it for you to sign. It breaks no cryptography — it relies on you approving it while believing you're claiming, minting, or connecting normally.
How did my Solana wallet get drained?
Almost always one of three things: you signed a malicious transaction on a phishing site, you entered your seed phrase somewhere, or you installed a fake wallet extension. Solana wasn't compromised — the transaction was authorised by your key.
Can I recover funds from a drained wallet?
No. Solana transactions are final and no authority can reverse them. Move any remaining assets to a new wallet immediately and stop using the old one permanently.
Is it dangerous to connect my wallet to a website?
Connecting alone is low risk — it only shares your public address. The danger starts when you sign. A connection immediately followed by a signature request you didn't initiate is a warning sign.
What should I do if a token I never bought appears in my wallet?
Ignore and hide it. Don't sell, swap or claim it, and never visit a URL in its name or metadata. The token is harmless sitting there — the attack only works if you interact with it.
How do I revoke token approvals on Solana?
Solana uses per-token delegate approvals rather than blanket allowances. Solflare can display and revoke delegated authority on your token accounts, and dedicated revoke tools do the same. Review them periodically, especially after using anything unfamiliar.
Does a hardware wallet make me immune to drainers?
No. It protects your private key from being stolen remotely, which is significant. It doesn't prevent you approving a malicious transaction — if you confirm a drainer transaction on the device, the funds leave.