You tried to claim an airdrop, mint something new or "verify" your wallet, approved one request, and watched your balance disappear. On Solana, a drain often looks like this: one signature, then several assets move at once.
What is a wallet drainer?
A wallet drainer is a scam site or script built to empty crypto wallets. It gets you to approve a transaction, a token approval or a change to your wallet, or to enter your recovery phrase, then moves your SOL, tokens and NFTs to the attacker.
Drainers rarely look like attacks. They look like a claim page, a mint, a giveaway or a support chat. Many are kits rented out to scammers, with the kit's operator taking a cut of what's stolen, so the same flow shows up on many look-alike sites with different branding.
Connecting alone doesn't hand over your keys or move anything. It shares your public address and lets the site ask for signatures. The damage happens when you approve what it asks for, so only connect to sites you went looking for.
How does a Solana drainer take your assets?
There are a few ways in, and each one leaves your wallet in a different state. Knowing which one happened tells you what you can still protect.
One transaction that moves everything
A Solana transaction can bundle many instructions, and they all execute together when you approve it. A drainer uses that to pack SOL transfers and token transfers into a single request that looks like a claim or a mint. Once it confirms, the transfers are final.
An approval it can use later
A token approval makes another address a delegate on one of your token accounts, allowed to move or burn up to a set amount. A drainer that gets an approval doesn't need to take everything immediately; it can come back for those tokens later. You can clear an approval with a revoke, as long as the tokens are still there.
An owner change on your token accounts
A classic SPL token account can be handed to a new owner by a transaction its owner signs. Once that happens, the new owner controls those tokens, and nothing you sign from your wallet can take the account back. Token-2022 associated token accounts can't change owner, so this trick works on classic SPL token accounts, including the default account for a token like USDC.
A change to your wallet account
Some Solana drainers change the wallet account itself. In one takeover we examined, the victim signed a transaction that turned their address into a durable nonce account with the attacker as its authority. Others assign the address to a program. Either way, the attacker controls the SOL at that address. Anything you send there can be withdrawn or locked, so normal sends from the wallet usually fail. Your tokens usually stay put, and our hacked-wallet guide covers how to move them.
Your recovery phrase or private key
The worst case needs no transaction at all. Fake support agents, fake "wallet validation" pages and fake claim forms ask for your recovery phrase. Anyone who has it controls the wallet completely, today and later, and no revoke or disconnect changes that.
What are the warning signs of a drainer?
- Urgency and free money. "Claim before it expires", surprise airdrops, eligibility checks for a token you never heard of.
- A link from a direct message or a reply. Phantom says its support never contacts you first. Treat anyone who messages you to "fix" your wallet as a scammer.
- Requests for your recovery phrase or private key. No legitimate claim, mint or support process needs them.
- A preview that doesn't match the button. If "claim" shows tokens leaving your wallet, an approval or a warning from your wallet, stop.
- A domain that's almost right. Look-alike spellings and links from unofficial accounts. Open apps from the project's verified site.
- A message signature you don't understand. Signing a message doesn't pay a network fee, but it isn't automatically harmless; a generic sign-in signature can be reused to impersonate you on another service.
How do you protect your wallet from drainers?
Read what your wallet shows before you approve. Phantom simulates transactions and warns about suspicious requests; a claim that shows outgoing tokens is the moment to cancel. A clean preview isn't proof, though. Some Solana drainers build requests that look harmless in simulation or change what happens after you sign.
Use a separate wallet with a small balance for new mints, claims and unfamiliar apps, and keep your main holdings elsewhere. A hardware wallet keeps your keys off your computer, but it signs whatever you approve, so it doesn't make a malicious transaction safe.
Check your approvals now and then. Our Revoke tool scans your SPL Token and Token-2022 accounts for approvals you've granted and lets you clear the ones you don't need. It charges no platform fee; you pay only the network fee.
What should you do if a drainer got you?
Start with what you approved. Find the row that matches what happened:
| What happened | What it means | Next step |
|---|---|---|
| You only connected | The site has your address, not control | Disconnect it in your wallet's connected apps |
| You approved a transaction | Its transfers are final; it may also have set approvals | Open it in an explorer, then follow our scam-site response guide |
| You granted a token approval | The drainer can return for those tokens | Revoke the approval while the tokens are still there |
| Your token accounts show a new owner | The drainer controls those accounts now | Move everything you still control to a fresh wallet |
| Sends now fail and your SOL won't move | Your wallet account may have been converted | Move tokens out with another wallet paying fees, using our hacked-wallet guide |
| You entered your recovery phrase or key | The attacker controls the wallet | Create a wallet with a fresh phrase and move what's left |
Save transaction signatures, the site address and screenshots before you report. Ignore anyone who offers to recover stolen funds for a fee: paid recovery offers are a common follow-on scam.
If your wallet was converted, you can still reclaim SOL from its empty token accounts to a safe wallet. Our hacked-wallet guide shows how and what it costs.
Revoke Approvals
Find token approvals you've granted and remove the ones you don't need, while keeping your tokens.