Wallet-draining phishing is a scam that tricks users into connecting a crypto wallet to a malicious site so the attacker can request approvals or signatures. The goal is not usually password theft. Instead, the attacker uses legitimate wallet workflows to gain permission to move assets or authorise transactions.
Expanded Definition
Wallet-draining phishing is a social engineering attack that exploits the normal consent flow of a crypto wallet. Instead of stealing a password, the attacker lures the user into connecting a wallet and then signs or approves an action that gives the attacker permission to transfer assets or execute transactions.
In practice, the danger lies in the gap between what the user thinks they are authorising and what the wallet actually permits. This is why the term sits at the intersection of identity, transaction approval, and user-interface trust. Definitions vary across vendors, but the core pattern is consistent: a malicious site uses legitimate wallet prompts to turn a user’s own authority into the attack path. The issue is related to broader phishing tactics described in the NIST Cybersecurity Framework 2.0, but it is more specific because it targets signing and approval workflows rather than credential entry. The most common misapplication is treating a wallet approval prompt like a harmless login step, which occurs when users connect wallets to unverified sites and do not inspect the scope of the request.
Examples and Use Cases
Implementing wallet security rigorously often introduces friction at the moment of transaction approval, requiring organisations and users to weigh convenience against the cost of stronger verification and tighter consent review.
- A fake airdrop site asks the user to connect a wallet and approve a token allowance that lets the attacker drain future balances.
- A spoofed NFT mint page presents a routine signature request, but the signature authorises a malicious contract interaction.
- A browser session captured in a phishing campaign is used to direct the user to a site that resembles the original dApp, then the attacker relies on habitual click-through behaviour.
- An operational team investigating CoPhish OAuth Token Theft via Copilot Studio can see the same trust abuse pattern, where a legitimate consent flow becomes the attack mechanism.
- For wallet and token workflows, guidance from the NIST Cybersecurity Framework 2.0 reinforces the need to verify request origin before authorising actions.
These cases are often harder to detect than password theft because the attacker never needs to break authentication. They only need the victim to approve a dangerous action that appears routine.
Why It Matters in NHI Security
Wallet-draining phishing is important to NHI security because it shows how non-human authority can be abused when the user-facing approval path is weak. The wallet, contract, or signing agent becomes the functional identity boundary, and once that boundary is compromised, access control no longer behaves as intended. This is especially relevant in systems where secrets, keys, and delegated permissions are already fragmented. NHIMG research on secrets management shows that organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, which is a useful warning signal for any environment that also depends on wallet-style approvals. Similar trust failures appear in NHIMG coverage of the DeepSeek breach, where exposed credentials and sensitive records made downstream misuse easier. When this scam succeeds, the immediate loss is usually asset movement, but the deeper failure is governance: no one can easily prove which approval was intentional and which was induced. Organisations typically encounter the real impact only after funds disappear or a malicious contract is executed, at which point wallet-draining phishing becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Wallet approvals depend on secret and consent handling, which this control class addresses. |
| OWASP Agentic AI Top 10 | Phishing that exploits tool-use or consent flows maps to agentic authorization abuse. | |
| NIST CSF 2.0 | PR.AC | This term reflects access misuse through deceptive authorization rather than password theft. |
| NIST AI RMF | Risk management must account for user deception in AI-adjacent and automated approval paths. | |
| NIST Zero Trust (SP 800-207) | AC-6 | Least privilege is central when a wallet or signer can be tricked into granting excess authority. |
Review wallet approval paths and token permissions, then restrict any standing authority that can be abused.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
