Real Crypto Wallet vs Wallet-Drainer dApp
How to tell a legitimate decentralised application from a wallet-draining smart contract designed to steal your entire crypto balance in one transaction.
Last reviewed: 1 June 2026
Connecting a wallet to a decentralised application is a normal part of using crypto, and the vast majority of interactions do exactly what the interface says they will. Drainers exploit the fact that the dangerous step looks identical to the safe one. Attackers clone a well known interface closely, buy a search advert or push the link through a direct message about an airdrop or a mint closing soon, and change only the contract sitting behind the approve button. You are then asked to sign something your wallet describes in terms almost nobody reads carefully, under time pressure you did not create. The distinction that matters most is not how the site looks but what the transaction actually authorises, and whether the contract address matches the one in the project own documentation.
Side-by-side comparison
| Legitimate dApp / wallet | Wallet-drainer dApp | |
|---|---|---|
| URL & domain | Matches the official domain; listed on the project's verified social channels | Slight misspelling or different TLD; often promoted through paid ads or Discord DMs |
| Smart contract address | Matches the audited contract published in official documentation | Different address; no audit trail; 'approve' calls request unlimited token allowances |
| Token approval scope | Requests only the tokens needed for the specific transaction | Requests 'unlimited' or max-integer approval across all tokens in your wallet |
| Transaction preview | Your wallet shows a clear description of what is being moved and to whom | Transaction data is obfuscated; estimated outcome shows zero received |
| Social proof | Thousands of verifiable on-chain transactions; active GitHub repo | Fresh contract; few real transactions; praise comes only from bots or new accounts |
| Source of link | Found via the project's pinned official website or coingecko.com listing | Sent unsolicited via DM, airdrop NFT, or a Google ad targeting the project name |
Common red flags
- URL delivered through a Discord DM or a paid search ad rather than an official project page
- Wallet-approval pop-up requests unlimited token allowances
- Transaction preview shows you receiving nothing in return
- Smart contract address does not match the one listed in official project docs
- Site appeared very recently and has no verifiable history
Verification steps
- Navigate to the dApp only through the URL listed on the project's official Twitter/X pinned post or CoinGecko page — never from ads or DMs
- Before confirming any approval, check the contract address on Etherscan or the relevant block explorer against the project's published documentation
- Use a wallet that shows human-readable transaction previews, and reject any approval for more tokens than the transaction requires
- Revoke unnecessary token allowances regularly using a tool such as revoke.cash
What not to do
- Do not click wallet-connect links sent via DM, airdrop, or unsolicited email
- Do not approve unlimited token allowances without fully understanding the contract
- Do not assume a site is safe because it looks identical to one you have used before
A safe response
Slow the transaction down before you sign anything. Close the tab you arrived through and reach the application again by a route you control, such as the project own site or a link from its verified channel. Compare the contract address on screen against the project documentation, and read what the approval grants, rejecting anything requesting unlimited spending you do not need. If you have already signed, act now: revoke the allowance with a revocation tool, then move remaining assets to a fresh wallet whose seed phrase has never touched that device. Report the address and the site so others are warned, and keep a record of the transaction hashes.
Frequently asked questions
Is simply connecting my wallet to a site dangerous by itself?
Connecting alone usually only lets the site read your public address and balances, which is not enough to move anything. The risk begins at the next step, when you sign. Losses come from approvals and signature requests that grant spending permission or transfer assets, not from the connection prompt itself. So connect sparingly, and treat every signature screen afterwards as the real decision point, reading what it authorises and rejecting anything you cannot explain to yourself.
Can a hardware wallet protect me from a drainer?
A hardware wallet stops remote key theft but not drainer approvals — you still sign the malicious transaction on the device. The protection is reading the transaction carefully before signing.
Is it possible to reverse a wallet-drainer transaction?
Blockchain transactions are irreversible. If you acted quickly enough to revoke the token approval before the drainer script executes, you may save unaffected tokens, but already-transferred funds cannot be recovered on-chain.