Crypto glossary

Drainer-as-a-Service

Drainer-as-a-service (DaaS) is a criminal business model in which developers sell or rent ready-made wallet-draining kits to other scammers, usually in exchange for a share of whatever is stolen. It turns crypto phishing into an off-the-shelf product.

Auf Deutsch lesen

How the business model works

A wallet drainer is malicious code on a fake website that, once you connect your wallet, scans what you hold and asks you to sign the transactions or messages that hand those assets to the attacker. Building one well takes skill. Drainer-as-a-service splits the work: one group writes and maintains the drainer, and many affiliates rent it.

The affiliates handle distribution, such as cloned websites, fake social media accounts, paid ads, hacked Discord or X accounts and spam messages. The kit does the technical part. Stolen funds are typically split automatically, with the developers keeping a percentage. Security researchers documented several such operations in 2023, including Inferno Drainer and Pink Drainer.

Why it matters for ordinary users

Because the tools are rented, attackers no longer need to understand smart contracts. That means many more scam sites, appearing faster and copying whatever is popular this week: a new token launch, an airdrop, an NFT mint. Kits often target the most valuable assets first and prefer requests that look routine, such as token permits or approvals, so a single careless click can empty a wallet.

A typical scenario

Say a well-known project's account on X is hijacked and posts a link to a limited claim. The page is a perfect copy of the real site, built from a drainer kit. You connect a wallet holding 2 ETH, 1,000 USDC and an NFT. The site first asks for a signature for the USDC, then an approval for the NFT collection, then a transfer of ETH dressed up as a claim fee. Each prompt looks small. Together they move everything.

How to protect yourself

Treat any urgent claim, mint or airdrop link as suspect, even from an account you trust, because accounts get hacked. Go to apps through your own bookmarks. Read every wallet prompt: which asset, which spender, which amount. Refuse signatures you cannot interpret. Keep savings in a wallet that never connects to new sites, ideally a hardware wallet, and use a separate low-balance wallet for experiments. Many wallets and browser extensions now flag known drainer sites, which helps but will not catch every new one.

Ask Coach about it

Coach is the AI on AtenaCrypto. It explains crypto with live market data, in plain words.

What are the warning signs that a mint or claim page is built from a wallet drainer kit?Ask Coach →

Frequently asked questions

What is the difference between a wallet drainer and drainer-as-a-service?

A wallet drainer is the malicious tool itself. Drainer-as-a-service is the business model of renting that tool to other criminals, often for a cut of the theft.

Can a hardware wallet stop a drainer?

It protects your private key, but if you confirm a malicious approval or signature on the device, the drainer still gets the permission. Read what you approve on the device screen.

What should I do if I connected to a drainer site?

Connecting alone usually does not move funds. If you signed anything, revoke approvals at once and move remaining assets to a new wallet with a new seed phrase.

Learn it step by step

AC Learning explains these ideas in interactive lessons — the first eight sections are free.

Open AC Learning → Create a free account

All glossary terms · Educational reference only — not investment, legal, tax or financial advice.