Lesson 02 · Unit 3 · General
Anatomy of a wallet drainer
The bait is always free. The hook is the signature underneath.
A drainer is not someone breaking into your wallet. It is a rented kit — fake site, hostile transaction builder, Telegram bot for the loot — operated as a funnel: reach you, rush you, and get one signature. Your key is never cracked. It is asked for, politely, in a costume.
Bait: ad, DM, fake airdrop
Clone site
Urgency: countdown, limited slots
One hostile signature
Wallet emptied in seconds
The mint that never existed
A hyped project's Discord got compromised for eleven minutes. The announcement channel posted a 'surprise stealth mint' with a link and a 20-minute timer. The site was flawless. 340 people connected and signed the 'mint' transaction.
The transaction transferred out every token and all SOL from each signer. The real team was asleep. Eleven minutes of access, six figures drained — and not one wallet was 'hacked'. Every loss was a signature.
The defense is boring on purpose
Every step of the funnel needs your cooperation. Ignore arriving links: the funnel dies. Read the simulation: the funnel dies. Sign from a throwaway wallet: the funnel starves. Boring habits, applied every time, beat clever attackers.
Where this goes next
A drainer only wins at the signature — reading what you sign is the counter. The offers that get you to the page have a pattern of their own.