A drainer is automated software that steals crypto from compromised wallets. Seed phrase drainers import stolen recovery phrases and sweep all assets across all chains within seconds. Approval drainers exploit token approvals you previously granted to malicious contracts, transferring your tokens without needing your seed phrase or private key at all.
What Is a Seed Phrase Drainer / Approval Drainer?
3 min read
The short version
A seed phrase drainer is a bot that monitors stolen seed phrases and races to empty every wallet derived from them before the victim can react. An approval drainer is sneakier: you unknowingly granted permission to a contract in the past, and the drainer uses that permission to move your tokens out whenever it wants. Both result in total loss, just through different doors.
How It Works
Seed phrase drainers: attackers collect seed phrases from phishing sites, data breaches, or malware. The drainer software: imports the phrase, scans all derivation paths across all supported chains (Ethereum, BSC, Polygon, Arbitrum, etc.), identifies assets, and broadcasts withdrawal transactions with high gas priority to front-run any recovery attempt. All assets are swept in seconds. Approval drainers (also called ice phishing): exploit ERC-20 approve() or ERC-721 setApprovalForAll() that victims previously signed for a malicious contract. The drainer contract can call transferFrom() at any time to move approved tokens to the attacker's address. No further victim interaction needed after the initial approval. Victims often do not realize they signed a malicious approval until their assets disappear hours or days later. Drainer-as-a-service: criminal operations sell/rent drainer kits to less technical scammers, taking a 20-30% cut of stolen funds. This has professionalized crypto theft.
A drainer sweeping a compromised wallet across 5 chains
A user enters their seed phrase on a fake MetaMask security update site. Within 8 seconds: (1) The drainer imports the phrase and derives addresses on Ethereum, BSC, Polygon, Arbitrum, and Optimism. (2) It detects: 2.1 ETH on Ethereum, 500 USDC on Polygon, 0.3 BNB on BSC, an NFT worth 1.5 ETH on Ethereum. (3) It broadcasts high-priority transactions on all chains simultaneously: transferring ETH, calling transfer() on USDC, sending BNB, and transferring the NFT. (4) By the time the victim realizes (typically minutes later), all assets across all chains are gone. Total time from phrase entry to empty wallets: under 20 seconds. The victim now has empty accounts on every chain their seed phrase controlled.
What People Get Wrong
Drainers only work if you share your seed phrase
Approval drainers work without your seed phrase. If you ever signed a malicious approval (which can look like a normal transaction in your wallet), the attacker can drain the approved tokens at any time without any further action from you. This is why regularly revoking approvals matters.
If my wallet still shows assets, I have not been compromised
Approval drainers can wait. They may not trigger immediately (to avoid tipping you off or to wait for higher balances). Having assets visible does not mean no malicious approval exists on your account. Check revoke.cash periodically to audit your outstanding approvals.
Only large wallets get targeted
Drainer bots are automated and indiscriminate. They sweep every wallet where they have access, regardless of size. A compromised seed phrase controlling $50 in assets still gets drained because the bot has no reason not to try.
Keep Reading
Sources & Further Reading
- Revoke.cash
Audit your wallet for dangerous approvals and revoke them
- Flashbots Rescue
Flashbots Protect RPC documentation for private transaction submission and rescue bundles
Questions People Also Ask
- How do I check if I have dangerous approvals?
- Visit revoke.cash, connect your wallet, and review all active token approvals. Revoke any approvals for contracts you do not recognize or no longer use. This costs a small gas fee per revocation. Make this a monthly security habit.
- Can I rescue assets from a compromised wallet?
- Extremely difficult. For seed phrase compromise: the drainer has a bot watching the wallet. If you send ETH for gas to rescue tokens, the drainer front-runs you and steals the ETH. Specialized services (Flashbots rescue bundles) can sometimes outrun drainer bots by bundling gas delivery + asset rescue in one atomic transaction, but success is not guaranteed.
- How do drainer-as-a-service operations work?
- Criminal groups build and sell drainer toolkits to less technical scammers for a revenue share (typically 20-30% of stolen funds). The buyer sets up phishing sites, the toolkit handles wallet draining. Some operations are advertised openly on Telegram. It has industrialized crypto theft.