How to Identify Crypto Phishing Scams and Wallet Drainers

The Mechanics of Wallet Drainer Scripts

Modern crypto scams rarely rely on brute-forcing cryptography. Instead, scammers target human psychology using wallet drainers that trick users into signing malicious cryptographic payloads.

Dangerous Signature Request Methods

• Blind eth_sign Requests: An unformatted byte string signature that can sign any transaction, including a transfer of all assets. Modern wallets block or heavily warn against this method.
• Permit & Permit2 Approvals: Off-chain gasless signatures that grant an attacker permission to withdraw ERC-20 tokens at a later time.
• SetApprovalForAll: Malicious NFT marketplace contracts that request approval to transfer every NFT in your collection.

Common Phishing Vectors

1. Fake Airdrops: Spam tokens dropped into your wallet containing URLs prompting you to "claim rewards" on a compromised site.
2. Search Engine Ads: Sponsored search results that copy the layout of legitimate wallets or DEXs.
3. Compromised Discord / Social Accounts: Hacked admin accounts broadcasting fake "urgent emergency mints".