You know what a wallet drainer is. You’ve read about signature scams, Permit2 exploits, and blind signing. You can identify phishing sites and recognize social engineering patterns.
But knowing isn’t enough. Prevention requires systems — habits, tools, and architectural choices that protect you even when you make mistakes.
This guide covers the full prevention stack: from wallet architecture to daily habits to automated monitoring. Every measure is actionable and doesn’t require advanced technical knowledge.
BLUF: Preventing wallet drainer attacks requires layered defense: (1) segregate your wallets so a single mistake can’t wipe everything, (2) maintain approval hygiene so no contract has standing permissions to drain you, (3) use simulation tools that catch malicious signatures before you confirm, (4) monitor your wallet so you catch attacks in progress, (5) build safe habits so the right action is the default. No single measure is sufficient — combine them all.
Layer 1: Wallet Segregation
The single most effective defense: never put all your eggs in one wallet.
The Three-Wallet Architecture
| Wallet | Purpose | Connected to dApps? | Approval Surface | Blind Signing |
|---|---|---|---|---|
| Vault (cold) | Long-term holding, significant assets | Never | Zero | Disabled |
| Daily driver | Regular DeFi use, moderate balances | Only trusted sites | Minimal, exact-amount | Enabled, with simulation |
| Burner | New/untrusted sites, airdrops, experiments | Anything | Expected to be compromised | Enabled |
Vault Wallet Rules
- Hardware wallet only (Ledger, Trezor, GridPlus)
- Blind signing OFF
- Zero token approvals — never interact with any smart contract
- Receive-only for external transfers — use it as your “bank vault”
- Fund it by sending from your daily driver, not by connecting to exchanges
- Store the seed phrase offline (metal backup, never digital)
Daily Driver Rules
- Hardware or software wallet (Rabby, MetaMask with Snaps)
- Simulation enabled (Rabby built-in, Pocket Universe, Blockaid)
- Only connect to verified sites from bookmarks
- Exact-amount approvals for large amounts; unlimited only for small balances
- Monthly approval audits on revoke.cash
- Moderate balance — enough for DeFi activity, not your life savings
Burner Wallet Rules
- Disposable software wallet (fresh MetaMask account, Rabby profile)
- Fund only with what you need per session
- Use for: new protocol testing, airdrop claims, NFT mints on unfamiliar sites
- Rotate regularly — create a new burner every few weeks
- Never hold significant assets — if it gets drained, it’s a learning cost, not a catastrophe
Why This Works
Even if a scammer tricks your burner wallet into signing a Permit2 message or an infinite approval, they can only drain what’s in that wallet — typically a few hundred dollars of interaction capital. Your vault remains untouched.
The cost of maintaining three wallets: ~30 minutes of setup, plus the discipline to move funds between them. The benefit: catastrophic loss becomes impossible from a single mistake.
Layer 2: Approval Hygiene
Active token approvals are liabilities. Each one is a contract that can take your tokens — whether through a hack, a rogue admin, or a compromised frontend.
The Monthly Approval Audit
Once a month (put it on your calendar):
- Go to revoke.cash
- Connect your daily driver wallet (read-only)
- Review all active approvals across all chains
- Revoke any approval for a protocol you haven’t used in 30+ days
- Revoke any approval you don’t recognize
- Cost: $5-30 in gas — the cheapest insurance in crypto
Approval Rules
| Rule | Implementation |
|---|---|
| Exact amounts for large swaps | Toggle “Exact” instead of “Unlimited” in DEX settings |
| Revoke after use | After interacting with a protocol, revoke the approval |
| Never approve what you can’t afford to lose | If approving a token would expose >$1,000, use a burner |
| Audit new approvals | After any new approval, verify on Etherscan that it went to the expected contract |
Permit2 Audit
If you use Uniswap or any Permit2-integrated protocol:
- Check revoke.cash for the Permit2 contract (
0x000000000022D473030F116dDEE9F6B43aC78BA3) - Review which tokens are approved through Permit2
- Revoke tokens you don’t actively swap via Permit2 protocols
- See our full Permit2 exploit guide for technical details
Layer 3: Real-Time Simulation
The most powerful preventive tool available today: transaction and signature simulation that shows you the outcome before you confirm.
Wallet-Level Simulation
| Wallet/Tool | How It Works | Setup |
|---|---|---|
| Rabby Wallet | Shows “You will lose X tokens” or “You will approve X” for every signature and transaction | Switch to Rabby as primary wallet |
| Pocket Universe | Browser extension that overlays risk assessment on MetaMask/Rabby | Install from pocketuniverse.app |
| Blockaid | Security layer integrated into MetaMask, Phantom, and others | Enable in wallet settings |
| MetaMask Snaps | Install security Snaps (like Blockaid, Tenderly) | Settings → Snaps → Browse |
How Simulation Works
These tools read the transaction data or signature payload before you confirm and simulate it against the blockchain’s current state. They can tell you:
- “This transaction will transfer 5 ETH to 0x7a3f…”
- “This signature will grant unlimited USDC allowance to 0x3b2c…”
- “This transaction will set approval for all NFTs in collection 0x9d8e…”
- “⚠️ This interaction matches a known wallet drainer signature”
If the simulation shows any asset loss or unexpected approval, reject immediately.
Limitations
Simulation isn’t perfect:
- It can’t predict outcomes on protocols it hasn’t indexed
- Cross-chain interactions may not simulate correctly
- Some advanced Permit2 signatures may not fully decode
- A determined attacker could construct transactions that look safe in simulation but are malicious
Simulation reduces risk dramatically but doesn’t eliminate it. Always combine with other layers.
Layer 4: Address and Domain Verification
Domain Verification Protocol
Before connecting your wallet to any site:
- Check the URL character by character — not a glance, a careful read
- Look for homoglyphs: é instead of e, а (Cyrillic) instead of a (Latin), о instead of o
- Check the TLD:
.comvs.iovs.xyzvs.app - Check for extra subdomains:
app.uniswap.io(real) vsuniswap-app.io(phishing) - Navigate from bookmarks — don’t click links from Twitter, Discord, or Telegram
- Verify on the protocol’s official site — most list their official URLs in docs/gitbook
Address Verification Protocol
Before signing any transaction or approval:
- Verify the spender/recipient address matches what you expect
- Cross-reference on the protocol’s docs — the contract address should be publicly listed
- Check on Etherscan — is the contract verified? Does it belong to the expected project?
- Use our address risk scoring API to check if the address has been flagged
Address Poisoning Defense
Address poisoning attacks create fake transactions in your history with addresses that look similar to ones you use:
- Never copy addresses from your transaction history
- Always copy from the source (exchange deposit page, protocol’s official site)
- Use an address book / whitelist in your wallet
- Verify the first 6 and last 4 characters on a trusted screen
Layer 5: Automated Monitoring
Real-Time Alerts
Set up alerts so you’re notified of any activity on your wallets:
| Tool | What It Monitors | Alert Method |
|---|---|---|
| Etherscan Address Watch | Transactions, approvals, token transfers | |
| Forta Network | Suspicious approvals, drainer signatures | Webhook/Discord |
| DeBank | Portfolio changes, new approvals | App notification |
| Zerion | Transactions, approvals | Push notification |
What to Monitor
- New token approvals — especially unlimited/infinite approvals
- Permit2 signatures — any Permit2 activity you didn’t initiate
- setApprovalForAll transactions — NFT approvals
- Outgoing transfers — especially to unknown addresses
- Changes in token balances — unexpected decreases
The 5-Minute Window
Most drain attacks execute within seconds to minutes of the victim signing. If you catch an unauthorized approval or transfer within the first few minutes:
- Immediately move all assets to a fresh wallet
- Revoke the approval if possible (may be too late for Permit/signature-based drains)
- Report the attacker’s address to Chainabuse and our risk API
Speed matters. The faster you react, the more you can save.
Layer 6: Safe Habits
The “Pause Principle”
Before signing anything on any site, pause for 5 seconds and ask:
- What am I signing? (Can I read the content?)
- Why am I signing? (Is the reason legitimate?)
- Who asked me to sign? (Did I initiate this, or did a link/message prompt me?)
- What happens if this is malicious? (How much can I lose?)
If you can’t answer all four questions confidently, don’t sign.
The “Never” List
- Never sign messages from links in Twitter/Discord/Telegram
- Never connect your main wallet to an unfamiliar site
- Never approve unlimited tokens on a burner wallet
- Never ignore a wallet warning (“This site has been flagged”)
- Never reuse a seed phrase across wallets
- Never store your seed phrase digitally (cloud, password manager, notes app)
- Never enter your seed phrase on any website — ever
The “Always” List
- Always navigate from bookmarks
- Always verify the domain before connecting
- Always read what your wallet shows before confirming
- Always use simulation tools
- Always keep your wallet software updated
- Always revoke approvals you no longer need
Building Your Personal Security Stack
Minimum Viable Security (Free, 30 minutes)
- Create a fresh MetaMask/Rabby account as a burner wallet → free
- Install Pocket Universe extension → free
- Move most assets to your existing wallet (don’t connect it anymore)
- Use the burner for all new dApp interactions
- Run revoke.cash audit once → ~$10 gas
Recommended Security ($50-150 hardware wallet)
- Buy a Ledger Nano S Plus or Trezor Safe 3 → ~$79
- Set up vault wallet on hardware → free
- Install Rabby Wallet as daily driver → free
- Set up Etherscan address watch → free
- Monthly revoke.cash audits → ~$10/month
Maximum Security (Paranoid mode)
- Hardware wallet with multisig (Gnosis Safe) for vault → free + gas
- Dedicated laptop for crypto (no browsing, no extensions) → varies
- Custom node for transaction broadcasting → ~$10/month
- Multiple simulation layers (Rabby + Pocket Universe + Blockaid) → free
- Weekly approval audits → ~$20/month
- Metal seed phrase backup → ~$50
Frequently Asked Questions
Q: I’ve been using one wallet for everything for years. Is it too late to start segregating?
A: No. Create a new wallet today, move your significant holdings there, and start using your old wallet as a daily driver (or abandon it entirely). The sooner you segregate, the smaller your risk surface.
Q: How often should I rotate my burner wallet?
A: Every 1-3 months, or immediately after connecting to any suspicious site. Creating a new wallet is free — there’s no reason to reuse a compromised burner.
Q: Are hardware wallets really necessary?
A: For amounts over $1,000, yes. A hardware wallet’s main benefit isn’t the device itself — it’s the forced physical confirmation step that makes you pause before signing. That pause is where most attacks are prevented.
Q: What if I already have active approvals I’m worried about?
A: Go to revoke.cash right now and revoke them. It costs a few dollars in gas. Every minute you wait is a minute an attacker could exploit those approvals.
Q: Can I use these defenses on L2s (Base, Arbitrum, Optimism)?
A: Yes. revoke.cash, Rabby, Pocket Universe, and Blockaid all support major L2s. The same threats exist on L2s — Permit2, infinite approvals, and signature scams work identically across all EVM chains.