§ Guide · Foundation

Wallet drainer red flags — 2026 verification checklist

How to spot the wallet drainers stealing $311M+ in early 2026 — fake extensions, sponsored ads, malicious dApps, and the signatures to never sign.

By dont-trust-verify Published May 9, 2026

January 2026 alone saw $311 million drained from individual crypto wallets — a single social-engineering incident accounted for $284M of that, and Safe Labs publicly flagged more than 5,000 known drainer addresses by the end of Q1. These aren’t exchange hacks or DeFi exploits. They are individual users, sitting at home, signing a transaction they thought was harmless and watching their balance evacuate to an attacker’s address in the next block.

I want to walk through how the modern drainer pipeline actually works, what red flags catch each stage of it, and the small set of verification habits that turn most of these attacks into a non-event. None of this requires special tools beyond what you already have on your machine — but it does require a five-second pause before you click Approve.

TL;DR. The four dominant drainer vectors in 2026 are fake browser extensions (sideloaded or stolen-publisher), sponsored search ads above legitimate results, typosquat phishing domains linked from social media, and malicious dApps / WalletConnect sessions that mine signatures over time. Each has a free, deterministic verification step. Verify the publisher, the URL, the binary hash, and the transaction simulation before you sign — every time, no exceptions.

How the 2026 drainer pipeline works

Drainers are no longer one-off scripts. They’re rented kits — Inferno, Pink, Angel, Venom, and a handful of newer entrants — sold as a service to affiliate operators who handle the “marketing” (phishing, ads, social engineering) and split revenue with the kit author. Reports from SlowMist and Scam Sniffer describe the typical economics: the kit author gets 20–30% of every successful drain, the affiliate keeps the rest, and infrastructure (hosting, ad budgets) is a few thousand dollars a week to run profitably.

That economic structure changes the threat model in two ways:

This is why the verification step is mechanical, not aesthetic. Don’t trust your eye — verify the URL, the binary, and the transaction.

Vector 1 — Fake browser extensions

In Q1 2026 alone, security researchers documented at least 17 fake wallet extensions in the Chrome Web Store mimicking MetaMask, Phantom, Rabby, OKX Wallet, and Backpack. Several were uploaded by attackers who had compromised the publisher account of a smaller, legitimate developer — which means the “verified publisher” badge in the store gave users false confidence.

A typical pattern: the extension installs, the icon and on-load behavior look identical to the real thing, and you import or generate a seed inside it. The extension immediately exfiltrates that seed to a server. There is no “signing” step — you’ve just given the attacker your master key.

Red flags I look for, every time, before installing any wallet extension:

  1. The publisher’s domain. Click the publisher name in the store listing and confirm it sends you to the wallet’s official domain — not a random Gmail address or a domain registered last month.
  2. Install count vs review age. Real wallet extensions have install counts in the hundreds of thousands and reviews going back years. A “MetaMask” with 800 installs and reviews from the past two weeks is a clone.
  3. Permissions. Real wallets request a small, predictable set of permissions. An extension asking for “Read and change all your data on all websites” beyond what the wallet needs is exfiltrating something.
  4. The download path. Don’t install from a Google search result for “MetaMask download”. Install from the link on the wallet’s official documentation site (typed by hand or from a known-good bookmark), then verify the link that opens lands in the actual store under the actual publisher.

If you’re already using a hardware wallet — and you should be — the browser extension only ever sees public keys and unsigned PSBTs. A fake extension can show you a fake address to receive on, but it can’t sign with your keys. This is the strongest single defense in the entire drainer threat model: the seed never lives in the browser.

Vector 2 — Sponsored search results

Google Ads and Bing Ads have been the highest-conversion drainer channel for two years running. The mechanic is simple: the attacker buys the ad slot above the organic results for “ledger live download”, “phantom wallet”, or “wallet of satoshi”. The ad’s display URL shows the real domain (ad systems still let advertisers display one URL while the destination URL is different), but the click resolves to a typosquatted or homoglyph domain serving a drainer page.

Google has tightened policy enforcement in 2026 but hasn’t solved the underlying problem. Ads still appear above organic results, and a meaningful percentage of users — especially newer ones — click the first link without reading the URL.

My rule, full stop: never click a sponsored result for a wallet, exchange, or hardware vendor. Type the URL by hand from a known-good source (the vendor’s documentation, the QR code printed on the device’s box, or a bookmark you saved years ago and haven’t touched since). When in doubt, search for the term plus the word “github” — most legitimate Bitcoin tooling has an open-source repository, and GitHub’s URL is much harder to spoof.

The free uBlock Origin extension blocks Google ad results entirely. I run it on every browser I use for anything financial. The five-second rule still applies, but the chance of fat-fingering the wrong link drops to near-zero.

Vector 3 — Typosquat domains and homoglyphs

Even without sponsored ads, drainers seed typosquat domains across X, Reddit, Telegram, and Discord — sometimes from compromised accounts of well-known Bitcoiners. Common patterns:

Browser address bars don’t always render homoglyphs in punycode, especially in shortened-URL or in-app webview contexts. The attacker’s lookalike domain reads as identical to a hurried eye. You can paste any URL into our Lightning address verifier for an LNURL/Lightning-address check, or — for plain web URLs — feed the bare domain into a WHOIS lookup and confirm the registration date. Drainer domains are typically registered within the past 30 days; legitimate wallets and exchanges have registration dates many years old.

For Bitcoin and Lightning addresses specifically, copy the address into our Address validator to confirm the encoding (BIP-173 bech32, BIP-350 bech32m, P2PKH, P2SH) decodes cleanly to a hash. Drainer interfaces sometimes show a real-looking address that is in fact malformed or controlled by the drainer — the validator catches that in milliseconds.

Vector 4 — Malicious dApps and signature mining

The most insidious 2026 vector is the slow drainer. You connect your wallet to a dApp that looks legitimate — a yield aggregator, an NFT mint, an “airdrop claim” page. The first signature it asks for is a permission grant: typically setApprovalForAll, Permit, or an EIP-2612-style permit. The transaction looks like it’s authorizing one specific contract for one specific token. The data field — which most users never read — is in fact authorizing the drainer to move every token of that type, forever, to any address it wants.

This is where transaction simulation matters. Modern wallets (Rabby, MetaMask with the Blockaid integration, Frame) preview the outcome of the signature, not just the calldata. If the simulation says “this signature lets address 0x...drainer move all your USDC indefinitely”, you do not sign it, regardless of how legitimate the page looks.

For Bitcoin proper, the equivalent threat is the PSBT swap: a malicious wallet UI shows you what looks like a normal send-to-Alice transaction, but the underlying PSBT it asks your hardware wallet to sign actually sends to the attacker’s address. Hardware wallets with a real screen — Ledger, Trezor Safe, Coldcard, BitBox02 — show the destination address on the device itself, and the device is the only thing you should trust at signing time. If the address on the device’s screen does not match what you typed into the UI, do not press confirm.

You can independently SHA-256-verify your hardware wallet companion app installer against the vendor’s published hash with our Wallet verify tool. It runs entirely in your browser, does not upload the file, and confirms the binary you downloaded is bit-for-bit identical to what the vendor signed.

Vector 5 — Compromised hardware wallets in transit

This isn’t a 2026-only vector, but it had a high-profile 2026 incarnation: shipments of resold or “open-box” hardware wallets that contained pre-generated seeds shipped with the device. The buyer thinks they’re setting up a fresh device, the device shows them the “their” 24 words on screen — but the device firmware was modified to display a deterministic seed the attacker already knows. Funds sent to the resulting addresses are drained the moment they arrive.

The defense is procedural and absolute: buy hardware wallets only from the manufacturer’s direct store (Ledger.com, Trezor.io, Coldcard.com, BitBox.swiss) or from a reseller the manufacturer publicly authorizes. Do not buy from Amazon, eBay, secondhand, gifts, or “found one in storage”. The trust assumption of the entire device collapses if a single attacker had unsupervised access between manufacture and your hands.

When the device arrives, verify the tamper-evident seal, run the device’s own genuine-check (Ledger calls it “Genuine Check”, Trezor uses Trezor Suite’s verification) before generating a seed, and write down the words yourself rather than trusting any words pre-printed on a card.

The five-second verification habit

Everything above collapses into a small, mechanical checklist that I run before any significant Bitcoin action. It takes longer to read than to do.

  1. URL bar. Read every character. If it’s not the canonical domain you bookmarked, stop.
  2. TLS certificate. Click the lock icon and confirm it’s issued to the right organization. Drainer pages are usually issued generic Let’s Encrypt certs to a homoglyph domain — not “Issued to Ledger SAS” or “Issued to Trezor Company s.r.o.”.
  3. Address on the device screen. For receives, derive the address on the hardware wallet and confirm it matches the receive UI. For sends, confirm the destination address on the device, character-by-character — not the truncated UI version that hides the middle.
  4. Transaction simulation. Read the simulated outcome before signing. If it says you’re approving anything more than you intended, cancel.
  5. Cool-down. If anyone — ad copy, a Discord moderator, an “exchange support agent” — is rushing you, the answer is no. Real Bitcoin actions are not time-pressured.

What to do if you’ve been drained

If a drain has already happened, stop and do these things in order:

The pattern in nearly every successful drain I’ve seen post-mortem: a five-second check on the URL, the publisher, the address on the device, or the simulated outcome would have caught it. The drainer pipeline is industrial; the defense is personal — a verification habit, applied consistently, every time. Don’t trust — verify.