Wallet Drainers & Address Poisoning
One signature, empty wallet. The mechanics of drainers, poisoned addresses and tampered devices.
A wallet drainer does not break cryptography. It gets you to sign something — a transfer to an address that looks like yours, a firmware seed that was never random, an npm script that reads your keystore while you review a 'test task'. The maths stays intact; the human gets rerouted.
Every case below ends the same way: funds leave in one transaction and never come back. What differs is the setup, and the setup is where the tell is. Read the mechanics, then check your own habits against the red flags.
Documented cases in detail
The self-deployed version is documented in our investigation into fake AI trading-bot tutorials that substitute a wallet-draining contract after showing the victim clean source code.
The rented-kit end of this vector is documented in our investigation into wallet drainers and approval-phishing attacks that use Permit2 signature traps — Permit2 traps, blind signing and a $1,500/month Telegram subscription.
For the law-enforcement side of the same signature abuse, read Operation Atlantic, the approval-phishing network taken down after months of token-allowance theft and how the approvals were harvested at scale.
The full catalogue of fake wallet scams — cloned MetaMask extensions, pre-seeded hardware, signature traps — is in our breakdown of crypto wallet scams and how seed phrases actually get stolen with the damage-control sequence for after you signed.
Ledger never asks for the 24 words, which is the whole point of the fake Ledger letter scam that phishes a seed phrase by post and QR code — printed pages, a boxed device and a recovery phrase the sender already knows.
How it works
The lookalike
The attacker generates an address sharing your recipient's first and last characters, then dusts your history with it. Next time you copy from history, you copy theirs.
The compromised source of randomness
If a device or library generates keys from a weak seed, the wallet is public from birth. No phishing needed — the attacker simply derives the same key.
The trusted context
A recruiter, a repo, a support agent, a firmware update. The payload arrives inside something you already had a reason to run.
Investigations in this vector
Coldcard Drain: $130M Walked Out Of Wallets Nobody Touched
About $130M in bitcoin left offline Coldcard wallets in August 2026 — no phishing, no user error. The weak keygen theory, decoded.
Read the investigation7 Crypto Wallet Scams Draining Victims in 2026
Phishing apps stole $4.6B in 2025. See real attack screenshots, fake seed phrase tricks, and the 3-step verification that stops 99% of wallet drains.
Read the investigationAddress Poisoning: The $0.08 Trick That Steals $9,850
Same first 4 digits. Same last 4. Different owner. A $0.08 dust tx just poisoned your wallet — and you won't notice until it's too late.
Read the investigationFake 'Test Projects': Job-Interview Malware Hits Devs
Fake Web3 job offers ship malicious repositories at developers, stealing credentials and draining crypto wallets on the first npm install.
Read the investigationRed flags
- You are copying a recipient address from transaction history instead of the original source.
- A wallet, device or firmware arrived from a marketplace reseller rather than the manufacturer.
- A 'test task' asks you to run a project locally on a machine that holds keys.
- The address matches at the ends but you never compared the middle characters.
- Anyone at all asks for a seed phrase — support never does.
If it already happened
- 1.Move whatever is left to a wallet generated on a clean device — the old one is burned.
- 2.Revoke every outstanding token approval from the compromised address.
- 3.Save the transaction hashes: they are the only evidence that survives.
- 4.Report to the chain analytics firms and the exchange that received the funds; freezes do happen, but only fast.
Related vocabulary
Got a suspicious message, link or token?
Paste it into the free detector. No signup, no cost, answer in seconds.