Drain methods
How wallets actually get drained on Solana and EVM chains, in plain words: what the trick looks like, the red flags, and how to protect yourself. 20 methods.
- Solana·3 incidents
Bookmarklet drains
A fake verify bot or support account gets you to save a bookmark and click it on a trading site. The bookmark runs code inside your logged-in session and empties your wallet.
- Solana + EVM·4 incidents
AI agent hijacking
An AI agent that can move funds reads hidden instructions, in a post, web page, document, token name or its own memory, and sends the funds to the attacker.
- EVM·3 incidents
Permit and Permit2 signature phishing
You sign what looks like a harmless login message, but it is an off-chain permission that lets the attacker move your tokens. No gas, no transaction, so it feels safe.
- EVM·2 incidents
Malicious token and NFT approvals
A transaction that looks like a mint, claim or swap actually gives the attacker unlimited permission to spend your tokens or move all your NFTs.
- EVM·3 incidents
EIP-7702 delegation phishing
Since Ethereum's Pectra upgrade, a normal wallet can delegate itself to smart-contract code. Sign a malicious delegation and that code can do anything with your wallet.
- Solana + EVM·5 incidents
Address poisoning
The attacker sends you a tiny or fake transfer from an address that looks like one you use, hoping you copy it from your history next time you send.
- Solana·2 incidents
Token account ownership change
A Solana transaction quietly hands ownership of your token accounts (or your whole account) to the attacker, so the tokens are no longer yours to move.
- Solana·0 incidents
Hidden instructions and spoofed previews
A Solana transaction can carry many instructions. Drainers hide transfers among them, or make the preview look harmless, so you approve a sweep you never saw.
- Solana·1 incident
Durable nonce tricks
Normal Solana transactions expire in about a minute. A durable-nonce transaction doesn't, so a drainer can hold your signature and use it later.
- Solana·0 incidents
Token delegates
A delegate lets another address move tokens from your Solana token account without your signature, until you revoke it.
- Solana + EVM·4 incidents
Fake airdrop, claim and mint sites
Look-alike pages promise a token airdrop, a reward or a mint. Connecting and signing is the drain.
- Solana + EVM·2 incidents
Drainer kits (drainer-as-a-service)
Ready-made drainer software rented to scammers for a cut of the loot. It powers most phishing sites you'll ever see.
- Solana + EVM·3 incidents
Malicious browser extensions
A fake wallet extension, or a real extension that was sold or hijacked, reads your seed phrase or swaps transactions as you sign.
- Solana + EVM·2 incidents
Clipboard hijackers
Malware on your computer or phone watches the clipboard and swaps any wallet address you copy for the attacker's.
- Solana + EVM·1 incident
Fake Telegram bots and 'verify' gates
Fake 'Safeguard' verification bots and fake trading bots trick you into running code, pasting a login or importing your private key.
- Solana + EVM·4 incidents
Fake wallet and trading apps
Look-alike apps on app stores or download sites that steal your seed phrase or show a fake balance while keeping your deposits.
- Solana + EVM·14 incidents
Leaked private keys and seed phrases
A private key or seed phrase ends up somewhere readable: code on GitHub, an env file, a hacked server or cloud notes. Bots find it within minutes.
- Solana + EVM·12 incidents
Supply-chain stealers
A popular code package or app update is hijacked to steal wallet keys or swap addresses, hitting everyone who installs it.
- Solana + EVM·11 incidents
Social engineering and fake support
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something.
- Solana + EVM·4 incidents
Front-end and DNS hijacks
The real website of a dapp you trust is taken over (DNS, hosting or a script it loads) and starts serving a drainer.