A drainer is a piece of software, usually sold as a kit to affiliates, that empties a wallet once its owner signs a malicious approval or transfer on a site the affiliate controls. Because the kit is shared, the collector addresses behind it recur across many unrelated victims and campaigns, which is what makes them attributable on a check. For a wallet owner the label is a warning about a destination; for a receiving desk it is an explanation of where an inbound payment came from.
The model is commercial. A developer builds and maintains the drainer, affiliates run the traffic — fake mints, fake airdrops, cloned dApps, comment-section links — and the take is split automatically between the affiliate and the operator. The victim's loss looks instantaneous, but it usually starts with a signature that granted permission rather than with a stolen key.
Because the same kit serves many affiliates, its collector and split addresses are reused. Reuse is what turns a single victim report into an attribution that protects everyone else.
Because the wallet warning and the address check answer different questions. MetaMask's security alerts flag a transaction or signature as "Malicious" or "Warning" and are enabled by default, but they do not block — the user can still confirm. Trust Wallet's Security Scanner likewise shows a risk level on a destination address or dApp and leaves the decision to the user (source below). Screening the destination address gives you a second, independent read before you make that decision.
On the other side, drained value is cashed out through retail channels, so it lands on P2P sellers and small exchangers. Checking a counterparty address before you accept a payment keeps that out of your account. The Telegram bot does it free, three checks a day.
Drainer activity is named as its own category in plain words in the result, distinct from the broader scam and phishing labels, because the operating model and the cash-out behaviour are different. It appears beside the verdict — CLEAN, LOW, MEDIUM, HIGH or CRITICAL — with a recommendation of Proceed, Caution, Review or Reject and the decision drivers written out.
Support and compliance teams triage these in the workspace, where the category filters the case queue and each result exports as a signed report for the file. Plans are on the pricing page.
Through permission. A signature can approve a contract to move tokens on your behalf, and the drainer uses that approval later. Nothing has to be stolen in the traditional sense for the balance to leave.
It may warn you. MetaMask's security alerts and Trust Wallet's scanner both flag risky transactions and destinations, but both leave the confirmation with the user by design, so the final decision is always yours.
Move remaining funds to a wallet whose keys were never exposed, then revoke outstanding approvals from the affected address. Record the hashes and destination addresses before anything else.
Also available in: · · ·
Because the kit is sold to many affiliates who share the same infrastructure. That reuse is exactly what allows a collector address to be identified and flagged for everyone.
Send any wallet to the Telegram bot and get a verdict in seconds. Three checks a day, free, no signup. Desks that screen every deposit run it on plans from $199/mo.