Signature drainers: permit, setApprovalForAll and blind signing

Wallet drainers are ready-made phishing kits that criminals rent out, usually for a share of what they steal. They connect to your wallet, look at what you hold, and then ask for the single signature or transaction that lets them take the most valuable assets.

The trick is that the request does not look like sending money. It looks like logging in, verifying eligibility or claiming a reward.

Dangerous request types

Token approvals (approve, increaseAllowance)
A transaction that gives a contract permission to move a token. If the spender is the drainer, it can take your full balance later. See token approvals.

setApprovalForAll
For NFTs, it hands over every item in a collection at once. Marketplaces need it, but a "claim" or "mint" page asking for it on a collection you already own is a strong drainer sign.

Permit and Permit2 signatures
A typed-data signature (often shown as Permit, PermitSingle, PermitBatch or PermitTransferFrom) that grants an allowance without a transaction. It is free to sign and nothing happens on-chain until the attacker uses it, often immediately.

Marketplace listing signatures
A signature that lists your NFTs or tokens for sale at a near-zero price, which the attacker then "buys".

Raw or unreadable signatures
A request that shows only a long hexadecimal string. Historically, the eth_sign method could sign an arbitrary transaction disguised as a message. Many wallets now block or strongly warn about it, but blind or unreadable signing remains a red flag on any chain.

Non-EVM chains
On Solana and other chains, drainers use transactions that transfer tokens or change the owner of token accounts, sometimes bundled with a harmless-looking action. Wallet simulations help, but the same rule applies: if the preview shows assets leaving, reject.

What a normal login looks like

"Sign-in with Ethereum" and similar login messages are plain text that names the site's domain and contains a nonce. They grant no permissions. Even so, check that the domain in the message matches the site you are on.

How to read a request before you click

1. Check the domain in the wallet popup. It should match the site you meant to visit.
2. Look at the request type. Is it a transaction, a plain text message or typed data? For typed data, look for words such as Permit, spender, operator, value, deadline or nonce.
3. Check the spender or operator address. Do you recognise it as the protocol's official contract? A random address is a warning sign.
4. Read the simulation. Many wallets now show "You will send" and "You will receive". Assets leaving when you expected to receive something means stop. See transaction previews.
5. When in doubt, reject. A rejected signature costs nothing. A real dApp will let you try again after you have checked.

Danger: If you signed a permit or approval on a site you no longer trust, revoke immediately and move the affected tokens to a new wallet. Drainers usually act within minutes, so speed matters. See I've been hacked.

Hardware wallets do not stop this

A hardware wallet protects your private key, but it will sign anything you approve. Many drained hardware wallet users confirmed a malicious permit on the device. The device screen is the place to read it carefully.