Wallet-draining scam is a cryptocurrency fraud that tricks a user into approving a malicious transaction or connection to a wallet. The attacker exploits transaction signing, token approvals, or dApp permissions so the victim authorises asset transfers that the attacker can then remove from the wallet.
What Wallet-Draining Scams Exploit
Wallet-draining scams succeed by abusing the trust model of crypto wallets and dApps. The victim is not usually “hacked” in the traditional sense, but instead is induced to sign a transaction, grant token approvals, or connect a wallet in a way that gives the attacker permission to move assets.
That makes the scam dangerous because the blockchain can record an apparently valid authorisation even when the user did not understand the effect. The security failure sits in the approval step, not in the transfer itself.
How the Scam Works
The attacker typically hides the real effect of a transaction behind a benign-looking prompt, then relies on the wallet interface or the dApp flow to present an approval that feels routine. Once the signature, approval, or connection is granted, the malicious contract can trigger asset movement or later drain tokens under the permissions already given.
This pattern is especially effective because many users treat signing as authentication, when it may actually be authorisation for a specific on-chain action. A malicious request can therefore look like normal wallet usage while it is actually granting broad control.
Why Wallet Permissions Become a Security Boundary
Wallet permissions are a security boundary because they control whether a third party can spend, transfer, or otherwise act on assets held by the wallet. NIST SP 800-63 Digital Identity Guidelines is useful here as a reminder that strong identity assurance does not prevent a user from authorising the wrong action, and approval UX still matters.
In practice, token approvals, permit-style signatures, and dApp connections can all extend trust beyond the moment of interaction. That is why draining scams often target repeated approvals, stale approvals, or overly broad permissions rather than only trying to steal a seed phrase.
How Users and Defenders Reduce Exposure
Defences focus on reducing the chance of signing the wrong thing and limiting what a granted permission can do. NIST Privacy Framework and NIST Cybersecurity Framework 2.0 both reinforce the need to understand assets, control exposure, and detect abnormal behaviour before a permission becomes irreversible.
For wallets and dApps, that means reviewing approvals, using fresh wallets for higher-risk interactions, preferring narrow permissions, and treating unfamiliar signing requests as security events rather than routine clicks. Monitoring for unexpected approvals and unusual outbound transfers is also important because compromise often becomes visible only after the attacker begins draining value.
Risk and Threat Considerations
Wallet-draining scams create immediate asset-loss risk because the user can authorise a malicious contract once and lose funds later, sometimes without any further interaction. The threat is strongest where users are conditioned to approve transactions quickly and where the wallet interface does not make the authorisation scope obvious.
Failure mechanism: The attacker abuses transaction signing, token approvals, or connection permissions so that the victim grants a valid-looking authorisation that the attacker can later exercise to transfer assets.
Impact: Assets can be drained from the wallet, approvals may remain active after the initial scam, and recovery is often limited because the transfer appears to have been authorised by the wallet owner.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Signing scams exploit mistaken authorisation despite identity assurance |
| Recommendation — Design wallet flows so users can see exactly what each signature authorises. | ||
| NIST CSF 2.0 | ID.AM-01 — Identities and assets are inventoried | Wallet and approval exposure depends on knowing which assets and permissions exist |
| PR.AA-05 — Authenticator management and access enforcement | Wallet approvals function as access decisions that must be narrowly controlled | |
| Recommendation — Inventory wallet-connected assets and active approval paths. Limit approval scope and require explicit user action for high-risk transfers. | ||
| MITRE ATT&CK | T1211 — Exploitation for Defense Evasion | Scams rely on deceptive interaction to bypass user scrutiny |
| Recommendation — Hunt for deceptive approval patterns and suspicious transaction prompts. | ||
| OWASP API Security Top 10 | API5 — Broken Function Level Authorization | The scam abuses overbroad permission to perform functions the user did not intend |
| Recommendation — Enforce function-level authorization on wallet or contract actions. | ||
Practitioner Guidance
What to watch for: Treat unexpected approval prompts, unfamiliar contract addresses, unlimited token approvals, and requests that combine wallet connection with signing as high-risk signals. Teams supporting wallets, exchanges, or dApps should make permission scope visible and easy to revoke, because ambiguity is what these scams exploit.
Practitioner takeaway: The decisive control is not just authentication, but clear, narrow, and reviewable authorisation at the point of signing.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org