Drainers: one approval, and the wallet is empty
It's evening, you're tired, and you're scrolling through your feed. A post catches your eye: a project is giving away tokens to its first participants, and all you need to do is connect your wallet. The site looks tidy, the logo is familiar, and a timer is counting down the last few minutes. You click "Connect". Your wallet opens a window with a long address and a "Confirm" button. You press it, the way you've done dozens of times before.
Nothing happens. No tokens arrive, but nobody asked you for money either. You close the tab. An hour later you open your wallet, and your USDT is gone.
This scene is made up, but real cases unfold in much the same way. And the detail people miss is always the same one: they didn't read what they were actually approving.
Why one click is enough
A drainer is a website or contract that asks you not for a transfer but for permission to manage your tokens. In your wallet this looks routine: "approve", "permit", "allow spending". Sometimes no amount is shown at all. Sometimes there's a line about an unlimited allowance.
You would notice a transfer, because you'd be asked how much to send and to whom. A permission feels like a formality, a bit like accepting cookies. But once you've granted it, someone else's address can take your tokens on its own, whenever it likes, without any further action from you.
That's why the money often doesn't disappear right away. By the time someone sees an empty balance, they may have forgotten about the strange site and don't connect the two.
A similar idea shows up in other schemes too. On 12 October 2026, the address 0x9d8d…213c was added to our records. It isn't a classic drainer: its owner took advantage of an abnormal BTCB price update in one protocol, which led to liquidations of roughly $912,000. Nobody broke into anyone's wallet directly. All it took was one place where the system trusted something it shouldn't have. In the 30 days up to 14 October 2026, we recorded 5 more cases like it.
Why people don't notice
It isn't only a matter of paying attention. Confirmation windows are hard to read: a hexadecimal address, a function name in English, small print. And the circumstances add pressure: a countdown timer, "only 37 spots left", a message from "support" insisting you confirm something urgently or your account will be blocked.
If you sign transactions often, your hand moves to the button almost on its own. Drainers count on exactly that.
On top of that, a fraudulent contract looks like any other: the same string of characters, no red warning frame. You can't tell it apart from an honest one by eye.
What you can do in a minute
Before you confirm any permission request, copy the address that's asking for it and check it. If the address is already linked to thefts, you'll find out before you give it access.
You can check it at guardpay.online/check. As of 14 October 2026, our database held 26,527 addresses flagged as linked to fraud or theft. If an address isn't there, that doesn't guarantee it's honest. If it is there, it's better to stop.
The steps are simple. If you see "approve", "permit" or "unlimited", pause. Copy the address and check it. Ask yourself why a site would need the right to spend your tokens when you came to receive something. A genuine giveaway usually doesn't need that right.
If you've already clicked confirm, don't blame yourself. Experienced people get caught this way too. What matters more is acting quickly. The blockchain shows which addresses the money went to, and that information will be useful when you contact an exchange or the police. Usually only an exchange or a court can return the funds, and the sooner they have details of how the money moved, the better.
Next time your wallet shows a confirmation window, stay on it a few seconds longer than usual. Often that's all it takes.