Crypto-draining is theft activity designed to move cryptocurrency out of a victim wallet. Unlike simple password theft, a drain operation aims to trigger transfers or approvals that give the attacker control over funds, often without the victim realizing what happened until the wallet balance is gone.
This matters because blockchain transfers are usually irreversible. Attackers use fake wallet prompts, phishing sites, malicious browser extensions, or compromised web apps to trick users into signing transactions, approving token spending, or revealing recovery data. Defenders reduce risk by limiting wallet permissions, checking transaction details carefully, keeping extensions and software minimal, and separating everyday browsing from high-value crypto activity. In incident response, signs of draining include unexpected approvals, rapid asset transfers, and wallet activity that does not match the user’s actions.