Among a wide variety of possible scams that involve cryptocurrencies, crypto draining attacks stand in their volume and amount of losses. As the name suggests, such an attack drains the entirety of contents of an involved cryptocurrency wallet. But let’s have a more detailed look at how this fraud works, and how you can avoid getting in such a trap.
How Do Crypto Drainers Work?
Crypto drainers operate through deceptive tactics. First, victims are lured to counterfeit websites through fake airdrop campaigns mimicking legitimate platforms. These phishing schemes start innocuously, with social media or email promotions offering free tokens.
For current exact-domain examples, compare the TokenSight TKST Airdrop scam warning with the fake PAXOS Token Launch scam, which shows how an invented brand token can lead to a signature or approval trap.
But it’s a classic scam scheme, and behind the enticing offers lie well-crafted, fraudulent websites that can look real. Next, the service asks the user to connect a wallet. The connection alone does not transfer assets; the danger begins when the page obtains a risky signature, transaction, token approval, or wallet secret.
In the final step, users are encouraged to link their digital wallets. This is often done under the pretense of identity verification or token claims. However, a risk is involved as users may unknowingly interact with malicious smart contracts that are camouflaged as part of the token claim process. Such contracts may contain hidden functions compromising the wallet’s security or initiating unauthorized transactions.
Current Examples: Fake $EXT Allocation and Fomo Lookalike
Two July 2026 lookalikes show why a familiar name or copied layout is not enough. Check the exact hostname and compare the requested action with the project’s documented account or claim flow before connecting a wallet.
| Page and red flags | How to verify it |
|---|---|
Extended ($EXT) allocation at claimext[.]com. The page advertises a May 1 balance snapshot, a July 27 deadline, a live claim feed, and a wallet check across hundreds of providers. |
Extended’s documented claim function is for test collateral on its testnet, not a public $EXT allocation at this hostname [1]. Check the claimext.com scanner report without opening the suspected page. |
Fomo lookalike at fomoo[.]family. The extra o is easy to miss. The copy replaces the normal branded account flow with a broad Connect Wallet chooser. |
The current official service uses the exact fomo.family domain and an email or Apple ID account for its web/app flow [2]. Compare the spelling with the fomoo.family scanner report. |
Do not approve a transaction, token allowance, permit, or signature just to “check eligibility.” For the broader patterns behind these lures, see the common cryptocurrency scams guide. If the lure arrived as an account message, compare it with the fake crypto wallet validation email flow.
Angel Drainer Group Leads Crypto Draining
Angel Drainer Group is a hacking group based in Eastern Europe. It first came to the attention of law enforcement in 2017. Then, the gang was linked to stealing $50 million worth of Bitcoin from a South Korean cryptocurrency exchange. Since then, the group has been responsible for other thefts, including the theft of $100 million worth of Ethereum from a Japanese exchange in 2018 and the theft of $200 million worth of Bitcoin from a US exchange in 2019.
Angel Drainer Group typically targets cryptocurrency exchanges, using social engineering, phishing, and malware to get access to exchange systems. Once they have access, the group will steal as much cryptocurrency as possible before moving it to other wallets. In addition to the thefts that Angel Drainer Group has been linked to, the group is also suspected of being involved in other illegal activities, including money laundering and cybercrime.
The ‘Permit’ Function
This method uses social engineering and manipulates the ‘Permit’ function in ERC-20 tokens. It means users are tricked into signing off-chain messages with their private key, unknowingly setting up an allowance for the attacker’s address. This technique is nefarious due to its subtlety, as it doesn’t necessitate on-chain transactions for each approval.
Once access is gained, assets are stealthily transferred from the victim’s wallet. Attackers use cryptocurrency mixers and multiple transfers to conceal the stolen assets’ trail, significantly complicating recovery. Comprehending these mechanics is vital for users and platforms in the crypto realm to develop effective security measures.
Safeguarding Assets
It is crucial to be cautious and use technological safeguards while dealing with cryptocurrency. First, you must be skeptical of unsolicited airdrop claims. Verify all smart contracts you have to deal with and prefer using hardware wallets when possible. Since cryptocurrency is a favorite place for internet scammers, you must be as careful as possible.
What to Do After Opening, Connecting, or Approving
- Opened the page only: close it and return through the project’s independently verified official domain. Do not use a recovery link or wallet checker from the same message.
- Connected but signed nothing: disconnect the site in the wallet. A connection can expose the public address and balances, but it does not by itself authorize token movement [3].
- Signed an approval, permit, or transaction: review and revoke the affected on-chain allowance. Disconnecting the site is not the same as revoking an approval, and revocation normally requires an on-chain transaction.
- Entered a recovery phrase/private key or saw an unauthorized transfer: use a clean device to move remaining assets to a fresh wallet, stop using the exposed wallet, and report the scam. Blockchain transfers generally cannot be reversed [4].
- Installed an app, extension, or file from the lure: remove it and run a full Gridinsoft Anti-Malware scan for local malware or persistence. A device scan does not revoke wallet approvals or restore transferred funds.
A different drain path: the Ill Bloom weak-seed vulnerability can expose a wallet without a fake airdrop, token approval, or signature. If funds moved without an interaction, check the public address and do not enter the recovery phrase into any website.
Related wallet-drainer cases: Solana airdrop lures often turn into wallet-drainer prompts. Our Solana giveaway scam guide explains one version, while the $ETHFI, Kinetiq, Grass and PowerGacha Vote Rewards scam guide covers fake voting and rewards pages that push malicious wallet approvals.
References
- Extended. “Testnet.” Extended Documentation, updated 2026, accessed July 26, 2026. https://docs.extended.exchange/extended-resources/more/testnet
- Fomo. “Announcing fomo web.” Fomo, April 29, 2026, accessed July 26, 2026. https://fomo.family/blog/announcing-fomo-web/
- MetaMask. “User guide: dapps.” MetaMask Help Center, accessed July 26, 2026. https://support.metamask.io/more-web3/dapps/user-guide-dapps/
- MetaMask. “I’ve been hacked or scammed (unauthorized transactions on my account).” MetaMask Help Center, accessed July 26, 2026. https://support.metamask.io/stay-safe/protect-yourself/ive-been-hacked-scammed-unauthorized-transactions-on-my-account
