Wallet Drainers & Address Poisoning

A wallet drainer does not break cryptography. It gets you to sign something — a transfer to an address that looks like yours, a firmware seed that was never random, an npm script that reads your keystore while you review a 'test task'. The maths stays intact; the human gets rerouted.

How this vector actually works

Every case below ends the same way: funds leave in one transaction and never come back. What differs is the setup, and the setup is where the tell is. Read the mechanics, then check your own habits against the red flags.

  • The lookalike — The attacker generates an address sharing your recipient's first and last characters, then dusts your history with it. Next time you copy from history, you copy theirs.
  • The compromised source of randomness — If a device or library generates keys from a weak seed, the wallet is public from birth. No phishing needed — the attacker simply derives the same key.
  • The trusted context — A recruiter, a repo, a support agent, a firmware update. The payload arrives inside something you already had a reason to run.

Red flags you can check in a minute

Any single item below is enough to stop and verify before you sign, send or install anything. One signature, empty wallet. The mechanics of drainers, poisoned addresses and tampered devices.

  • You are copying a recipient address from transaction history instead of the original source.
  • A wallet, device or firmware arrived from a marketplace reseller rather than the manufacturer.
  • A 'test task' asks you to run a project locally on a machine that holds keys.
  • The address matches at the ends but you never compared the middle characters.
  • Anyone at all asks for a seed phrase — support never does.

If it already happened

Order matters more than speed of panic: contain the wallet first, preserve the evidence second, report third. Recovery services that contact you after the fact are the follow-up scam.

  • Move whatever is left to a wallet generated on a clean device — the old one is burned.
  • Revoke every outstanding token approval from the compromised address.
  • Save the transaction hashes: they are the only evidence that survives.
  • Report to the chain analytics firms and the exchange that received the funds; freezes do happen, but only fast.

Related vectors and tools

Most real cases mix two vectors, so read the neighbouring hubs, and run anything suspicious through the detector before you act on it.