Wallet Drainers: The Theft You Sign Yourself

On July 30 an attacker began emptying Coldcard hardware wallets. Nobody stole the devices. A build flag set the wrong way in a March 2021 firmware release made Coldcards generate recovery seeds from a weak software random number generator instead of the hardware entropy source they advertised. On older units the effective key strength fell from 128 bits to as little as 40. That is guessable with ordinary computing power, from anywhere, with no physical access to the device. TRM Labs counted about 1,816 BTC — roughly $116 million — drained from more than 5,200 addresses. In one 25-minute stretch, around 594 BTC left some 500 wallets and landed in a single consolidation address. Coinkite shipped emergency firmware on July 31.

That failure is rare, which is why it ran on every front page for a week. Most wallets do not empty that way. Most empty because the owner pressed Confirm.

The permission you forget you gave

Every ERC-20 token has an approve function. It exists for a good reason: a DEX, a lending market or an NFT marketplace needs to move your tokens for you, and nobody wants to sign a separate transfer every time. So you grant the contract permission once, and it spends against that permission afterwards.

Two details turn this into the most productive attack surface in crypto.

The first is size. Most apps ask for an unlimited allowance by default, because it saves the user a second transaction later. One signature can authorise a contract to move every unit of that token you hold — including the ones you buy next year.

The second is lifespan. Approvals do not expire. Whatever you granted in 2022 is still live in 2026 unless you went back and revoked it. Plenty of wallets carry open allowances against contracts whose websites no longer exist.

A drainer needs none of the things people worry about. Not your seed phrase, not your exchange password, not malware on your machine. One signature, on a page that looks like a site you already trust.

The prompt is designed to look boring

Drainer kits are sold as a service, with a support channel and a revenue split. The operator brings traffic — a fake airdrop, a poisoned ad above the real search result, a "claim your refund" reply under a support tweet, a Discord announcement from a compromised moderator account. The kit handles the rest: it reads what your wallet holds, ranks it by value, and builds a signing request for the most valuable thing first.

What you see is a normal-looking approval screen. What you are approving is usually rendered as a contract address and a hex string. That is the whole trick. The malicious request and the legitimate one look almost identical, and the difference sits in data the interface does not translate for you.

MetaMask reported blocking 6.5 million malicious site visits in 2025 and around 150,000 fraudulent transactions. Its July 2026 security roundup also flagged a smaller but instructive case: malware hidden in Steam games infected roughly 8,000 machines and drained about $220,000 from around 80 wallets. Small money, ordinary people, no exotic technique.

One signature is now enough

Since Ethereum's Pectra upgrade in May 2025, EIP-7702 lets a normal wallet temporarily hand its execution rights to a smart contract. It was built for good things — gas sponsorship, batching, session keys. It also collapsed the number of confirmations an attacker needs from several down to one.

Scam Sniffer logged the pattern within months. On 22 August 2025 a user signed what looked like a Uniswap swap and lost close to $1 million. Two days later another lost $1.54 million to a single batch signature that bundled token transfers with NFT approvals. The victim approved once. The batch did the rest.

The current dressing for this is a "wallet security upgrade" or an "AI asset assistant" that asks you to delegate for convenience. If a prompt asks your wallet to delegate to a contract you have never heard of, that is the attack.

Losses fell, then the targeting sharpened

The raw numbers actually improved. Scam Sniffer put drainer losses at $494 million across more than 332,000 wallets in 2024, then $83.85 million across 106,106 wallets in 2025 — down 83 percent in value and 68 percent in victims. The largest single drainer loss dropped from $55.4 million to $6.5 million over the same period.

Then the shape changed. In January 2026 signature-phishing losses jumped 207 percent against December, $6.27 million taken from 4,741 victims — while the victim count fell 11 percent. Fewer people, bigger balances. The mass campaigns are being replaced by patient work against wallets worth targeting individually.

What actually helps

Revoke what you are not using. Etherscan's token approval checker, Revoke.cash and the built-in permissions screens in most wallets all list your open allowances. Most people who look for the first time find approvals they granted years ago to apps they stopped using. Clear them. It costs gas and about ten minutes.

Cap new allowances at the amount you are actually spending. Every serious wallet lets you edit the number before signing. Unlimited is a convenience default, not a requirement.

Keep the balance you trade with separate from the balance you hold. A hot wallet with working capital and a cold wallet that never touches a dApp is unglamorous and it works.

Read the destination, not the design. Before you send funds to an address someone gave you — a support agent, a marketplace, an OTC counterparty, a payout page — run the address through a check and see whether it already has a history. Screening catches addresses that are already known: sanctioned entities, mixer exposure, wallets linked to reported thefts. It will not flag a contract deployed forty minutes ago for one victim. Use it for the case it does cover, and stay suspicious of anything brand new.

If you already signed

Move first, investigate second. Send whatever the approval does not cover to a fresh wallet immediately — a different token, an NFT, the native balance. Then revoke the approval so it cannot be drawn again, and assume any other allowance granted in the same session is compromised too.

Record the drainer address and the transaction hashes before you do anything else. If the funds reach an exchange, that address list is what a compliance team can act on, and it is what a lawyer or an insurer will ask for first. Report it to Chainabuse and to the wallet vendor. Recovery is uncommon, but it is impossible without the addresses.

The Coldcard owners lost money to a bug they had no way to see. Almost everyone else loses it to a screen they had every chance to read. Slow down at the signing prompt, keep your open approvals short, and check where money is going before it goes there.