Drainer-as-a-Service (DaaS)
A criminal business model where developers rent out ready-made crypto 'wallet drainer' kits — the malicious code and phishing sites that empty a victim's wallet the moment they connect and approve — to less-skilled scammers for a cut of the proceeds.
Also known as: DaaS, wallet drainer service, crypto drainer kit
Last reviewed: 27 July 2026
A wallet drainer is malicious code that, once a victim connects their crypto wallet to a fraudulent site and signs or approves a transaction, transfers out their tokens and NFTs. Drainer-as-a-Service turns this into a rentable product: skilled developers build and maintain the drainer, host the phishing infrastructure, and lease it to affiliates who supply the victims — through fake airdrops, fake mints, fake 'points' or restaking sites, hacked social accounts, and malicious ads — in exchange for a percentage of everything stolen.
The model industrialises crypto theft the way ransomware-as-a-service did for extortion: affiliates need no coding skill, only an ability to drive traffic and trick users into a single wallet approval. The malicious approval is often disguised as a routine 'connect wallet', 'claim', or 'verify' step, and a single signature can grant sweeping spend permissions.
The defence is to treat any 'connect and approve' prompt on an unfamiliar site as high-risk, verify contracts and official channels independently, and use a separate low-value wallet for experimental interactions.