Wallet Drainers and Approval Phishing: What the Data Shows
$494 million in 2024. $83.85 million in 2025. Same trick, different year: a signature you didn't know you signed.
Wallet drainers are off-the-shelf phishing kits that trick a victim into signing a message or on-chain approval, then move stolen tokens out automatically. They are not one gang with a name — ScamSniffer tracked losses falling from $494 million across 332,000 addresses in 2024 to $83.85 million across 106,106 victims in 2025, while Chainalysis documents how 'approval phishing' is built and disrupted. This page lays out what is actually confirmed, by whom, and what you can do about it.
Case File Update
Removed unverified 'Phantom Drainer' figures ($50M, 31,500 wallets); page rewritten around ScamSniffer and Chainalysis data.
The Scheme: Approval and Permit Phishing
Chainalysis defines approval phishing as tricking a wallet holder into signing a transaction or off-chain message that grants a scammer's contract permission to move their tokens — rather than stealing a private key outright. A large share of the biggest 2025 losses used the "Permit" / "Permit2" signature standard, which lets a spender move tokens with a gasless, off-chain signature instead of a visible on-chain approval. ScamSniffer's 2025 report puts Permit-style signatures at roughly 38% of large-loss cases.
No gas fee. No on-chain approval. Just a signature — and the keys to whatever it covers.
The Hard Truth: The Losses Are Falling, Not Disappearing
ScamSniffer's 2024 report recorded $494 million stolen from roughly 332,000 addresses, with the single largest loss — $55.48 million in August 2024 — the result of a signature-based attack. The named drainer-as-a-service toolkits active that year, per ScamSniffer, included Angel, Pink, and Inferno.
By ScamSniffer's 2025 report (published 3 January 2026), total phishing losses fell 83% year-over-year to $83.85 million across 106,106 victims — but the largest single case, $6.5 million, was again a Permit signature. Fewer victims lost less money overall, but a single bad signature can still cost a victim millions.
Chainalysis's case study "Operation Atlantic" describes a law-enforcement effort that froze $12 million and traced $45 million connected to approval-phishing operations affecting more than 20,000 victims — evidence that these schemes are large enough, and traceable enough, to justify cross-border takedowns.
The drainer economy shrank in 2025. It did not go away.
The Anatomy: How Drainer Kits Actually Work
Chainalysis's "Understanding Crypto Drainers" explainer and TRM Labs' 2023 "Drainware" research both describe the same basic toolkit model: a developer builds drainer smart contracts and phishing-site templates, then rents or licenses them to lower-skilled operators who run the actual phishing campaigns. The named 2024 services ScamSniffer tracked — Angel, Pink, Inferno — fit this pattern of productized, reusable drainer infrastructure.
The mechanics on the victim side are simple: a cloned or fake site asks for a wallet signature, often framed as a "connect," "verify," or "claim" action that looks free because it requires no gas. If the victim signs, the attacker's contract gets standing permission (an approval) or a time-boxed Permit signature that it can execute whenever it wants — sometimes immediately, sometimes later.
MetaMask's own help center documentation on "signature phishing" confirms this is a known, named attack category serious enough that the wallet vendor publishes consumer guidance on it — not a one-off toolkit or a single operator's invention.
It isn't one toolkit, one gang, or one number. It's a category of attack that keeps getting rebuilt.
Vocabulary Decoded: The Approval-Phishing Dictionary
These are the terms that actually appear in the research — not brand names for a single criminal group:
"Approval Phishing"
What it sounds like:
A permission request, like approving an app to read your email.
What Chainalysis says it actually is:
Tricking a wallet holder into signing a transaction or message that lets a scammer's contract move their tokens, instead of stealing a private key directly. It is the formal name Chainalysis uses for this entire category of theft.
"Permit / Permit2 Signature"
What it is legitimately:
A gas-free, off-chain signature standard that lets a user authorize a spender to move specific tokens, used across much of modern DeFi to save gas and clicks.
Why it is the attack vector of choice:
ScamSniffer's 2025 data shows Permit-style signatures behind roughly 38% of large-loss cases, including the year's single biggest loss ($6.5 million). Because it is a signature, not an on-chain transaction, it can look like a harmless "login" to the victim.
"Drainer-as-a-Service"
What it sounds like:
A rental model for criminal software — build once, license to many operators.
What the research documents:
Chainalysis and TRM Labs both describe drainer kits built by one group and operated by others; ScamSniffer's 2024 report names Angel, Pink, and Inferno as drainer services active that year. No single named service is confirmed to be behind all drainer losses.
"Address Poisoning" (a different attack)
What it is:
Sending small or zero-value transactions from a look-alike address so it appears in a victim's transaction history, hoping the victim later copies the wrong address.
Why it matters here:
A widely reported $50 million USDT loss in December 2025 was address poisoning — a copy-paste mistake — not a signature-based drainer attack. It is a related but distinct threat, and the two should not be conflated.
"Blind Signing"
What it means on hardware wallets:
When a device can only show raw transaction data instead of a human-readable summary, because the wallet app can't decode it.
Why it matters for drainer defense:
MetaMask's signature-phishing guidance and wallet-security best practice both recommend avoiding signing anything you cannot read in plain language — the whole point of a Permit-style attack is that the request looks harmless.
Five terms. One pattern: a signature that doesn't look like a transaction, but moves money like one.
How a Documented Drainer Campaign Worked: CLINKSINK
Google Cloud / Mandiant documented a real, named campaign in January 2024 — not a hypothetical:
Phase 1: The Lure
Mandiant's CLINKSINK reporting (10 Jan 2024) describes drainer campaigns that used a fake Phantom-wallet airdrop as bait — impersonating the popular Solana wallet brand to get targets to visit a phishing site.
"Phantom" here is the legitimate Solana wallet being impersonated — not a drainer toolkit's name.
Phase 2: The Connection Request
Victims were prompted to connect their Solana wallet to claim the fake airdrop, a standard social-engineering hook used across many drainer campaigns, not unique to this one.
An airdrop that asks you to sign something before you receive anything is the pattern to watch for.
Phase 3: The Signature
Once connected, the site requested a signature that authorized the transfer of the victim's assets, consistent with the broader approval/Permit-phishing pattern Chainalysis documents.
No separate "on-chain approval" screen is required if a signature alone grants the access.
Phase 4: The Drain
Mandiant assessed that CLINKSINK campaigns were responsible for at least $900,000 in stolen Solana-based assets as of its January 2024 reporting.
That figure is Mandiant's documented minimum for this specific campaign — not an industry-wide total.
Phase 5: Context — the Bigger Picture
CLINKSINK is one documented campaign among many. ScamSniffer's annual reports put total wallet-drainer losses at $494 million in 2024 and $83.85 million in 2025 across hundreds of thousands of victims — CLINKSINK's reported losses are a small fraction of that total.
No single campaign or toolkit accounts for the full yearly total; it is many operators using the same techniques.
Documented Lure Types (Not Verbatim Messages)
Rather than invented scam scripts, here are lure patterns confirmed across the cited research:
A site impersonating a wallet brand (as in the Mandiant-documented CLINKSINK campaigns) invites the target to "claim" tokens by connecting a wallet and signing a message.
An airdrop you didn't apply for, that asks for a signature before paying out, is the classic drainer hook.
Mandiant's CLINKSINK reporting documents this exact pattern using a fake Phantom-wallet airdrop lure, with at least $900,000 in assets stolen as of January 2024.
A cloned DeFi front end asks the user to "sign in" or "verify" their wallet via a gasless signature rather than a normal wallet-connect handshake.
A real dApp login never needs a Permit-style signature that grants spending rights.
MetaMask's own "signature phishing" help documentation exists specifically to warn users about this category of request.
A look-alike address appears in a victim's wallet history after receiving a small or zero-value transfer, hoping the victim will later copy it by mistake when sending funds.
This is not a signature-phishing drainer attack — it exploits copy-paste habits, not wallet signatures.
Cointelegraph reported a widely covered $50 million USDT loss in December 2025 caused by exactly this kind of copy-paste mistake in an address-poisoning scam — a different mechanism from approval/Permit phishing.
Red Flags: Signs of an Approval-Phishing Page
If a signature costs no gas and grants something for free, read it twice before you sign.
The Numbers: What's Actually Confirmed
$494M stolen in 2024
ScamSniffer's 2024 report: roughly 332,000 affected addresses; the largest single loss was $55.48 million in August 2024, a signature-based attack. Named drainer services that year included Angel, Pink, and Inferno.
$83.85M stolen in 2025
ScamSniffer's 2025 report (3 Jan 2026): an 83% year-over-year drop, across 106,106 victims. The largest single case was $6.5 million, via a Permit signature. Permit/Permit2 signatures were behind roughly 38% of large-loss cases.
$12M frozen, $45M traced
Chainalysis's "Operation Atlantic" case study: a disruption effort against approval-phishing operations that affected more than 20,000 victims.
$900K+ in one documented campaign
Mandiant's CLINKSINK reporting (10 Jan 2024): at least $900,000 stolen via a fake Phantom-wallet airdrop lure targeting Solana users — one campaign among many, not an industry total.
Confused by the Jargon?
Explore our glossary of 301 crypto scam terms with real-world examples.
Why People Sign
The research points to a few recurring reasons experienced users still fall for these requests:
Signature Fatigue
Active DeFi users sign many wallet messages routinely. A malicious Permit request can look identical to a dozen legitimate ones that came before it.
The Permit Blind Spot
Most users associate risk with on-chain transactions that show a gas fee and a contract address. A Permit signature shows neither, so it doesn't register as a transaction at all — yet, per ScamSniffer, it is behind the single largest loss in both 2024 and 2025's reports.
Urgency and Scarcity
Fake airdrops and "claim before it expires" framing — the pattern Mandiant documented in the CLINKSINK campaigns — push targets to sign quickly instead of reading the request.
Brand Trust
Impersonating a trusted wallet brand (as CLINKSINK did with Phantom) or a trusted protocol lowers a target's guard before the signature request even appears.
The best phishing doesn't look like phishing. It looks like a normal wallet prompt.
What Is Approval Phishing? A Plain-English Explainer
Chainalysis breaks the mechanics into a few simple parts:
The Request
A phishing page or message asks the target to sign a transaction or off-chain message — often disguised as a free "claim," "verify," or "connect" action.
The Grant
If the target signs, the scammer's contract receives an approval or a Permit-style authorization to move specified tokens — sometimes with no spending limit.
The Execution
The scammer executes the transfer whenever they choose, which can be immediate or delayed, making it harder for the victim to connect the loss to the original signature.
The Scale
Chainalysis's Operation Atlantic case shows this pattern operating at scale — $45 million traced and 20,000+ victims connected to one disruption effort alone.
It isn't a hack of the blockchain. It's a hack of attention.
Protection: Rules That Stop Approval Phishing
These close the doors that approval and Permit phishing rely on.
- Never sign a "gasless" Permit message you didn't deliberately initiate.
If a site asks you to "sign in" or "verify" your wallet, treat it as a request for spending authority, not a login — per MetaMask's own signature-phishing guidance.
- Avoid blind-signing transactions your hardware wallet can't decode.
If your device can only show raw hex for a requested signature, that is a reason to stop, not to proceed.
- Bookmark the DeFi sites and wallets you actually use.
Avoid clicking through ads or unsolicited links; type verified bookmarks instead, especially for wallet or protocol logins.
- Use a separate, low-balance wallet for unfamiliar sites.
Keep the bulk of your holdings in a wallet you never connect to new or unfamiliar dApps.
- Periodically review and revoke old token approvals and Permit signatures.
Approval and Permit grants can sit unused for months; reviewing them regularly limits what an old, forgotten signature can still authorize.
- Double-check destination addresses by more than a glance, every time.
Address poisoning — like the $50 million USDT loss Cointelegraph reported in December 2025 — relies on a rushed copy-paste. Confirm the full address, not just the first and last characters.
- Treat unsolicited "support" or "airdrop" messages as attacks by default.
Mandiant's CLINKSINK research shows a fake airdrop lure alone drove at least $900,000 in losses; legitimate projects rarely DM you first with a claim link.
What to Do Right Now
A few minutes of review closes most of the doors described above.
Review and revoke unused token approvals and Permit signatures
Use a reputable approval-checking tool connected to your wallet to see what you've authorized, and revoke anything you don't recognize or no longer use.
Check your hardware wallet's signing settings
If your device supports a stricter or clear-signing mode, enable it so unreadable raw-hex requests are flagged rather than silently approved.
Bookmark the protocols and wallets you use, and stop clicking ad links
Mandiant and Chainalysis both document fake-airdrop and ad-driven lures as common entry points; bookmarks remove that attack surface.
A few minutes of review today. Or a signature you can't take back tomorrow.
Got a Suspicious Message?
Use our AI-powered detector to analyze potential scams instantly.
Key Takeaways
- 1.Wallet drainers are a category of phishing attack, not one named group — ScamSniffer tracked $494M stolen in 2024 and $83.85M in 2025.
- 2.Permit and Permit2 signatures were behind the single largest loss in both years' reports, and roughly 38% of large 2025 losses.
- 3.Chainalysis's Operation Atlantic shows the scale of disruption possible: $12M frozen, $45M traced, 20,000+ victims.
- 4.Mandiant documented a real campaign (CLINKSINK) using a fake Phantom-wallet airdrop lure, with at least $900,000 stolen.
- 5.A separate, widely reported $50M USDT loss in December 2025 was address poisoning, not a drainer signature attack — don't conflate the two.
- 6.Reviewing and revoking old approvals, avoiding blind signing, and bookmarking real sites close most of these attack paths.
“They didn't break in.”
You signed something you didn't read. That's the entire attack.
Frequently Asked Questions
Sources & Citations
Research for this investigation compiled from publicly available blockchain data, security reports, and community documentation.
ScamSniffer · 3 Jan 2026
index pageScamSniffer · 3 Jan 2026
ScamSniffer · 3 Jan 2025
index pageScamSniffer · 3 Jan 2025
Chainalysis · 17 Jun 2026
Chainalysis · 17 Jun 2026
Google Cloud / Mandiant · 10 Jan 2024
Google Cloud / Mandiant · 10 Jan 2024
Cointelegraph · 20 Dec 2025
Cointelegraph · 20 Dec 2025
MetaMask Help Center · Date not published or not verified
MetaMask Help Center · Date not published or not verified
TRM Labs · 19 Jan 2023
TRM Labs · 19 Jan 2023
Verification: On-chain references: none published for this case.
Methodology: Every case needs at least two independent sources before publication, plus verifiable on-chain evidence whenever a public transaction trail exists. Full standards: /methodology
Legal notice: This assessment is based on publicly available data, including on-chain records, official statements and reported incidents. It is journalistic and educational analysis, not legal advice, an accusation of criminal conduct or a court finding. Named companies, projects, domains, wallets and individuals are described as reported by the cited sources; a company name may appear because fraudsters impersonated it, not because the company did anything wrong. If you believe something is inaccurate or out of date, write to cryptostrapon@pm.me and we will correct it and log the change. Editorial policy