Taken last month
USDValue taken by drainer addresses in the latest complete month, valued at the block of each transfer.
Dashboard · VantagePlanned
Wallet Drainer Tracker: Phishing Losses by Month
How much are wallet drainers taking each month, on which chains and through which kinds of signatures?
What wallet drainers take each month, on which chains and through which signatures: approvals, permits, NFT listings and delegations.
ShareEmail it
Blueprint
What the dashboard will show.
The dashboard as it will open in Vantage. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
By month
Drainer losses, victims and the signatures behind them, month by month.
Victims last month
countDistinct victim addresses that lost funds to drainer addresses in the latest complete month.
Median loss per victim
USDThe median value taken per victim in the latest complete month, so a few large thefts do not hide the typical loss.
Active drainer addresses
countDrainer receiver addresses that received stolen funds in the latest complete month.
Losses by month and signature type
USDValue taken per month, split by what authorized each theft: approval, permit, Permit2, NFT approval, marketplace listing or delegation.
Share by signature type
USDThe selected period's losses split by signature type, to show which request drainers rely on most.
Largest thefts
The period's largest drainer thefts with chain, token, value, signature type and the authorizing and draining transactions.
By chain
Where drainers operate and which approvals are still open to them.
Chains hit
countChains on which drainer addresses received stolen funds in the selected period.
Approvals still open to drainers
countApprovals to known drainer spenders that are still active at the latest block, a measure of losses still possible.
Losses by chain
USDValue taken by drainers per chain over the selected period, beside the number of victims on each.
- Period
- Last 30 days, last 12 months or every month recorded
- Chain
- Every covered EVM chain
About
What it answers, and for whom.
A wallet drainer is a phishing kit that tricks a user into signing a message or transaction that hands over their tokens: an unlimited approval, an off-chain permit, a near-zero NFT listing or a contract delegation. This dashboard counts what drainers take each month, by chain and by the kind of signature that let them in.
The split matters because each signature type works differently: a permit leaves no on-chain approval to revoke before it is used, while an approval can sit unused for weeks before the drainer moves. Each theft links to the victim's signing transaction or permit and to the transfer that reached the drainer, so every monthly figure can be traced to its transactions.
Method
How it will be measured.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →- Drainer addresses come from a reviewed registry of known drainer contracts and receiver addresses, each with its public source; a theft counts only when funds reach one of them.
- Each theft is matched to what authorized it: an ERC-20 or Permit2 approval, a permit() or permitTransferFrom call, an ERC-721 or ERC-1155 ApprovalForAll, a signed marketplace listing or an EIP-7702 delegation.
- Amounts are the token and native transfers from victims to drainer addresses, valued at oracle or DEX pool prices at the block of each transfer.
- A victim is one address: several thefts from the same address in a month count once in the victims figure and in full in the value figure.
The data it needs
Chain data, with some off-chain sources
- address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- token_approvalsTo buildToken approvalsActive ERC-20 and NFT approvals per wallet and spender, with the spender's label and when the approval was set.
- native_prices_dailyTo buildOracle prices by dayReference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- Reviewed registry of drainer contract and receiver addresses, each with its public source
- ERC-20 Transfer logs and transferFrom traces from victims to drainer receivers
- ERC-20 permit() calls and Permit2 permit and permitTransferFrom calls signed by victims
- ERC-721 and ERC-1155 ApprovalForAll logs granting operators later seen draining
- EIP-7702 authorization lists in type-4 transactions that delegate to known drainer contracts
- Oracle and DEX pool prices at the block of each transfer
Questions
Questions people ask.
What is a crypto wallet drainer?
A drainer is a phishing toolkit, often rented to scammers as a service, that shows a fake site and asks the visitor to sign. The signature grants the drainer's contract permission to move the victim's tokens or NFTs, and the kit then sweeps them to addresses it controls.
How do permit signature scams work?
Tokens that support permit (EIP-2612) and the Permit2 contract accept an off-chain signature as an approval. A phishing site asks for that signature, which costs no gas and shows no transaction, and the drainer submits it later to move the tokens in one step.
What is a setApprovalForAll scam?
setApprovalForAll gives an operator control over every NFT a wallet holds in one collection. Drainers disguise the request as a mint, a claim or a login, then transfer the whole collection out. An approval like this stays active until the owner revokes it.
Can a drained wallet get its funds back?
Rarely. Transfers on public chains are final, so recovery depends on an issuer freezing stablecoins or an exchange stopping a deposit before the funds move on. Revoking the remaining approvals stops further losses through the same grant.
What is an EIP-7702 drainer?
EIP-7702 lets an ordinary account delegate its code to a contract with one signed authorization. A drainer that obtains such a signature points the account at its own contract, which can then move everything the account holds, so delegations are counted as their own signature type here.
- Drainer-as-a-service
- A criminal business model in which a kit's operators rent phishing sites and contracts to affiliates and take a share of each theft.
- Permit (EIP-2612)
- A token function that accepts a signed message as an approval, so a spender can be authorized without an on-chain approve transaction.
- Permit2
- A shared contract that manages token allowances and signature-based transfers for many apps through one approval per token.
- EIP-7702 delegation
- A signed authorization that lets an ordinary account run a contract's code; a malicious delegation hands the account to the attacker's contract.
Related
More apps like this.
Token Approval Checker: Open Allowances by Wallet
Every spender that can still move a wallet's tokens or NFTs, with the allowance, when it was granted and the transaction that set it.
Multi-chainAddress Poisoning Tracker: Lookalike Address Scams
Lookalike addresses planted in wallet histories with zero-value and dust transfers, and the funds victims later send to them.
Multi-chainEthereumBNB Chain+1Crypto Address Checker: Flagged, Sanctioned or Hacked
Check an address before you send or accept funds: direct flags and one-hop links to sanctioned, frozen, hacked or phishing addresses.
Multi-chainEthereumTron+1EIP-7702 Adoption: Delegated EOAs and Top Contracts
How many accounts have delegated their code under EIP-7702, the contracts they point to and how much of it looks like sweeper scams.
Multi-chainEthereumBase+3Crypto Hack Tracker: Exploits and Losses This Year
Every major hack and exploit of the year with the amount taken, how the attackers got in and where the stolen funds sit now.
Multi-chainNorth Korea Crypto Hacks: Lazarus Group Theft Tracker
Thefts attributed to North Korea-linked groups, what their attributed wallets still hold and how the funds move across chains.
Multi-chainEthereumBitcoinBuild Wallet Drainer Tracker: Phishing Losses by Month on verified data.
Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.