# Wallet Drainer Tracker: Phishing Losses by Month

> Wallet drainer losses by month: crypto phishing thefts by chain and by the signature that enabled them, from permit and Permit2 to setApprovalForAll.

Markdown copy of https://voltfincrypto.com/apps/wallet-drainer-tracker

**Question:** How much are wallet drainers taking each month, on which chains and through which kinds of signatures?

- Kind: Dashboard in Voltfin Vantage
- Topic: [Security and risk](https://voltfincrypto.com/topics/security)
- Chains: Multi-chain, Ethereum
- Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is.

A wallet drainer is a phishing kit that tricks a user into signing a message or transaction that hands over their tokens: an unlimited approval, an off-chain permit, a near-zero NFT listing or a contract delegation. This dashboard counts what drainers take each month, by chain and by the kind of signature that let them in.

The split matters because each signature type works differently: a permit leaves no on-chain approval to revoke before it is used, while an approval can sit unused for weeks before the drainer moves. Each theft links to the victim's signing transaction or permit and to the transfer that reached the drainer, so every monthly figure can be traced to its transactions.

## Blueprint

### By month

Drainer losses, victims and the signatures behind them, month by month.

- **Taken last month** (USD): Value taken by drainer addresses in the latest complete month, valued at the block of each transfer.
- **Victims last month** (count): Distinct victim addresses that lost funds to drainer addresses in the latest complete month.
- **Median loss per victim** (USD): The median value taken per victim in the latest complete month, so a few large thefts do not hide the typical loss.
- **Active drainer addresses** (count): Drainer receiver addresses that received stolen funds in the latest complete month.
- **Losses by month and signature type** (USD): Value taken per month, split by what authorized each theft: approval, permit, Permit2, NFT approval, marketplace listing or delegation.
- **Share by signature type** (USD): The selected period's losses split by signature type, to show which request drainers rely on most.
- **Largest thefts**: The period's largest drainer thefts with chain, token, value, signature type and the authorizing and draining transactions.

### By chain

Where drainers operate and which approvals are still open to them.

- **Chains hit** (count): Chains on which drainer addresses received stolen funds in the selected period.
- **Approvals still open to drainers** (count): Approvals to known drainer spenders that are still active at the latest block, a measure of losses still possible.
- **Losses by chain** (USD): Value taken by drainers per chain over the selected period, beside the number of victims on each.

Filters: Period (Last 30 days, last 12 months or every month recorded); Chain (Every covered EVM chain).

## How it will be measured

- Drainer addresses come from a reviewed registry of known drainer contracts and receiver addresses, each with its public source; a theft counts only when funds reach one of them.
- Each theft is matched to what authorized it: an ERC-20 or Permit2 approval, a permit() or permitTransferFrom call, an ERC-721 or ERC-1155 ApprovalForAll, a signed marketplace listing or an EIP-7702 delegation.
- Amounts are the token and native transfers from victims to drainer addresses, valued at oracle or DEX pool prices at the block of each transfer.
- A victim is one address: several thefts from the same address in a month count once in the victims figure and in full in the value figure.

## Data it needs

- `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- `token_approvals` (to build): Active ERC-20 and NFT approvals per wallet and spender, with the spender's label and when the approval was set.
- `native_prices_daily` (to build): Reference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- Source: Reviewed registry of drainer contract and receiver addresses, each with its public source
- Source: ERC-20 Transfer logs and transferFrom traces from victims to drainer receivers
- Source: ERC-20 permit() calls and Permit2 permit and permitTransferFrom calls signed by victims
- Source: ERC-721 and ERC-1155 ApprovalForAll logs granting operators later seen draining
- Source: EIP-7702 authorization lists in type-4 transactions that delegate to known drainer contracts
- Source: Oracle and DEX pool prices at the block of each transfer

## Questions

### What is a crypto wallet drainer?

A drainer is a phishing toolkit, often rented to scammers as a service, that shows a fake site and asks the visitor to sign. The signature grants the drainer's contract permission to move the victim's tokens or NFTs, and the kit then sweeps them to addresses it controls.

### How do permit signature scams work?

Tokens that support permit (EIP-2612) and the Permit2 contract accept an off-chain signature as an approval. A phishing site asks for that signature, which costs no gas and shows no transaction, and the drainer submits it later to move the tokens in one step.

### What is a setApprovalForAll scam?

setApprovalForAll gives an operator control over every NFT a wallet holds in one collection. Drainers disguise the request as a mint, a claim or a login, then transfer the whole collection out. An approval like this stays active until the owner revokes it.

### Can a drained wallet get its funds back?

Rarely. Transfers on public chains are final, so recovery depends on an issuer freezing stablecoins or an exchange stopping a deposit before the funds move on. Revoking the remaining approvals stops further losses through the same grant.

### What is an EIP-7702 drainer?

EIP-7702 lets an ordinary account delegate its code to a contract with one signed authorization. A drainer that obtains such a signature points the account at its own contract, which can then move everything the account holds, so delegations are counted as their own signature type here.

## Glossary

- **Drainer-as-a-service**: A criminal business model in which a kit's operators rent phishing sites and contracts to affiliates and take a share of each theft.
- **Permit (EIP-2612)**: A token function that accepts a signed message as an approval, so a spender can be authorized without an on-chain approve transaction.
- **Permit2**: A shared contract that manages token allowances and signature-based transfers for many apps through one approval per token.
- **EIP-7702 delegation**: A signed authorization that lets an ordinary account run a contract's code; a malicious delegation hands the account to the attacker's contract.

## Related apps

- [Token Approval Checker: Open Allowances by Wallet](https://voltfincrypto.com/apps/token-approval-checker)
- [Address Poisoning Tracker: Lookalike Address Scams](https://voltfincrypto.com/apps/address-poisoning-tracker)
- [Crypto Address Checker: Flagged, Sanctioned or Hacked](https://voltfincrypto.com/apps/crypto-address-checker)
- [EIP-7702 Adoption: Delegated EOAs and Top Contracts](https://voltfincrypto.com/apps/eip-7702-adoption)
- [Crypto Hack Tracker: Exploits and Losses This Year](https://voltfincrypto.com/apps/crypto-hack-tracker)
- [North Korea Crypto Hacks: Lazarus Group Theft Tracker](https://voltfincrypto.com/apps/north-korea-crypto-hacks-tracker)

Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F