You connect your mobile wallet to what looks like an airdrop claim page, tap “Confirm” on a request you barely read, and an hour later your USDT is gone. If you are asking what a Trust Wallet drainer is, this is it: a wallet drainer is a scam script, usually hidden behind a fake website or airdrop, that tricks you into signing a transaction or approval which lets the attacker move your tokens. The wallet app itself is not hacked. The drainer works because you, the owner, gave it permission. The good news is that most drainer attacks follow the same pattern, and that pattern has clear warning signs and a clear defence: limit and revoke token approvals.
What a wallet drainer is and why mobile wallet users are targeted
A wallet drainer is not a virus on your phone and it does not need your seed phrase. It is a piece of code on a malicious site that asks your wallet to sign something. Once you sign, the code uses that permission to transfer whatever tokens it can reach to an address the attacker controls, often within seconds.
People search for “Trust Wallet drainer” because self-custody mobile wallets are widely used and easy to connect to websites through a built-in browser or a wallet-connect link. That convenience is exactly what drainer kits exploit. The same attack works against any self-custody wallet on any network that supports smart contracts, including TRON (TRC20 tokens) and BNB Smart Chain (BEP20 tokens), where USDT is widely used.
How a drainer attack works: fake sites, malicious signatures and unlimited approvals
Real-world drainer campaigns usually run in three steps.
- The lure. You reach a fake page through a link in a Telegram group, a reply on social media, a sponsored search result, a direct message offering “support”, or a token that appeared in your wallet with a website in its name. The page copies a known project, a staking site or an airdrop claim.
- The signature or approval request. The page asks you to “claim”, “verify your wallet” or “sync”. Behind the button is a request that grants a spending permission to the attacker’s contract, either an on-chain approval or a signed message that the attacker later submits on-chain.
- The sweep. With that permission, the drainer calls a transfer and moves your tokens out. Many kits check your balances first and target the most valuable tokens.
The key mechanism is the token approval, also called an allowance. Fungible tokens such as USDT on TRC20 and BEP20 follow the same approve-and-spend model: you approve a contract, and that contract can then spend your tokens up to the approved limit without asking again. As the ethereum.org guide to revoking token access explains, many platforms request unlimited approvals so users only approve once, these permissions do not expire, and disconnecting your wallet from a site does not remove them. An old approval to a contract you forgot about can still be used years later.
Warning signs before you connect or sign
Use this checklist every time a site asks your wallet for anything.
| Warning sign | Why it matters |
|---|---|
| You arrived through an unsolicited link, DM or “support” contact | Legitimate projects and wallet teams do not message you first to fix your wallet. |
| Urgency: a timer, “last chance to claim”, “wallet will be suspended” | Pressure is designed to stop you reading the request. |
| A claim or airdrop that requires an approval before you receive anything | Receiving tokens should not require giving someone permission to spend yours. |
| The wallet shows an approval for a token you were not trying to use | Drainers request approvals for your most valuable tokens, often USDT. |
| The approval amount is unlimited or far larger than the action needs | An unlimited allowance lets the spender take your full balance, now or later. |
| A signature request with unreadable data or a vague “sign in” message | Some signatures grant spending rights off-chain and cost no fee, so they feel harmless. |
| Anyone asks for your seed phrase or private key | No legitimate service ever needs it. Stop immediately. |
For a broader list of scam patterns, see our guide to checking crypto scams.
How to revoke token approvals and limit future ones
Revoking an approval sets the spender’s allowance back to zero. It does not move your funds and, done correctly, it cannot cause a loss. The generic process is the same on every network:
- Open an approval checker for your network. Use the token-approval page of your network’s official block explorer or a well-known approval manager. Type the site address yourself or use a bookmark; never follow a link sent to you, because fake “revoke” sites are themselves a common drainer lure.
- Select the right network. Approvals are per network. An approval on BNB Smart Chain does not appear when you check TRON, and the reverse.
- Review every spender. Look for unlimited allowances, contracts you do not recognise, and platforms you no longer use.
- Revoke and confirm. Each revoke is an on-chain transaction, so you need a small amount of the network’s gas token (TRX on TRON, BNB on BNB Smart Chain). Confirm it in your wallet, wait for it to process, then refresh to check the allowance is gone.
To limit future exposure:
- When your wallet lets you edit the approval amount, approve only what the action needs instead of an unlimited allowance.
- Keep a separate “hot” wallet with small balances for new sites, airdrops and experiments, and keep savings in a wallet that never connects to anything.
- Review and revoke approvals on a regular schedule, not only after something goes wrong.
- Treat unknown tokens that appear in your wallet as bait. Do not visit websites named in them or try to sell them.
Our crypto security checklist covers device and account habits that complement these steps.
Checking an address before you send or interact with it
Drainers rely on addresses you have never seen before: the contract asking for approval, the “deposit” address on a fake platform, or the address a scammer gives you for a “verification fee”. Before you send funds or approve anything, check the address you are dealing with. Look at how new it is, where its funds came from, and whether it has links to known scams, stolen funds or sanctioned entities. Our article on signs of a high-risk crypto address explains what to look for.
SafeON screens a wallet address on TRON and BNB Smart Chain and returns a risk score from 0 to 100 with the reasons, including exposure to scam and stolen-fund sources, OFAC sanctions exposure and USDT freeze status. It is an address-risk check, not a drainer detector: it does not analyse what a signature request will do, so always read what you sign as well. Check a wallet’s risk on SafeON before you send or interact.
What to do right after a drainer attack (and why recovery is rarely possible)
If you signed something suspicious or see funds leaving your wallet, act in this order:
- Revoke every approval you do not fully trust, starting with the most recent ones, on each network you use.
- Move remaining assets to a new wallet created with a fresh seed phrase. If you ever typed your seed phrase into a site, assume the old wallet is fully compromised and stop using it.
- Record the evidence: the site URL, the transaction hashes, the attacker’s receiving address, screenshots and the time of each event.
- Report it. Report the receiving address to the exchange or platform where the funds landed, if you can identify it, and file a report with your local police or cybercrime authority. In the United States, for example, the FBI’s Internet Crime Complaint Center accepts reports of online fraud.
Be realistic about recovery. Blockchain transfers cannot be reversed, and drained funds are usually split and moved quickly. Recovery only happens in limited cases, such as when an issuer or exchange acts on a report in time. Be very careful with anyone who contacts you offering to recover your crypto for an upfront fee; recovery scams target drainer victims directly. SafeON does not recover, unfreeze or release funds.
FAQ
What is a Trust Wallet drainer?
It is a common search term for a wallet drainer scam aimed at users of mobile self-custody wallets such as Trust Wallet. The wallet app is not compromised; a malicious website tricks the user into signing an approval or message that lets the attacker transfer their tokens.
Can a wallet drainer take funds without my seed phrase?
Yes. A drainer only needs a token approval or a valid signature from you. With that permission, it can move the approved tokens without ever knowing your seed phrase or private key.
How do I revoke token approvals?
Open an approval checker for your network by typing its address yourself, connect your wallet on the correct network, review the spenders and allowances, then revoke the risky ones. Each revoke is a small on-chain transaction paid in the network’s gas token.
Can drained crypto be recovered?
Rarely. Transfers cannot be reversed. Reporting quickly to the receiving platform and to law enforcement gives the best chance, but there is no guarantee, and anyone promising recovery for a fee is a red flag.