A drainer is not malware that breaks encryption. It is a signature request: you approve a contract, and the contract moves everything you own.
No private key is stolen. The victim signs, and the signature is valid.
In 2024 the same category took $494M from 332,000 victims. The average fell from $1,488 to $790 — attackers moved to higher volume and smaller tickets.
Most wallets show the raw approval: a contract address and a number. Unless the wallet explains who the spender is and what they can move, the user approves blind.
Not always. Most drainers are valid signature requests that the victim approves.
In 2025, $83.85M from 106,106 victims, an average of $790 per victim.
A wallet that explains the spender and screens the signature can flag most drainer requests before approval.
Revoking existing approvals closes older exposure, but a new signature can reopen it.