Fake Web3 Pop-Ups: Beware of Crypto Drainer Scams

Despite being around since at least 2021, crypto drainers and drainers-as-a-service (DaaS) have received little to no attention from security researchers. Today, the threat has evolved into a well-organized crime channel with huge financial impacts, running into millions or even billions of dollars.

CoinMarketCap visitors were the latest victims of this threat campaign. A recent breach involving the cryptocurrency tracking site shows how attackers are now able to mimic legitimate crypto wallet connection prompts to lure users into surrendering their wallet access without a second thought.

This has raised serious concerns about the trust people have in the Web3 ecosystem and digital platforms. Here’s a look at how these scams work and what it says about the evolving threat landscape in Web3.

Table of Contents Table of Contents

1. Key Takeaways
2. What Is a Crypto Wallet Drainer & How Does It Work?
3. Inside the CoinMarketCap Breach That Emptied Crypto Wallets
4. The Impact of Crypto Draining Campaigns on the Web3 Ecosystem
5. Best Measures to Protect Your Wallet From Crypto Drainers
6. The Bottom Line
7. FAQs
8. References

Show Full Guide

Table of Contents

1. Key Takeaways
2. What Is a Crypto Wallet Drainer & How Does It Work?
3. Inside the CoinMarketCap Breach That Emptied Crypto Wallets
Show Full Guide
4. The Impact of Crypto Draining Campaigns on the Web3 Ecosystem
5. Best Measures to Protect Your Wallet From Crypto Drainers
6. The Bottom Line
7. FAQs
8. References

What Is a Crypto Wallet Drainer & How Does It Work?

In Web3, connecting your wallet is second nature. That’s exactly what crypto wallet drainer scripts count on. Behind the scenes, attackers build fake decentralized apps (dApps) or Web3 sites designed to trigger an approval prompt the moment a user connects their wallet.

That prompt doesn’t ask for login details, but rather, it asks for permission to move tokens. And most users, seeing what looks like a familiar interface, give it.

The transaction request comes from a malicious smart contract embedded in the fake site. It’s wrapped in the same flow users trust: approve, confirm, done. But what’s being approved is often a token allowance that grants the attacker access to the contents of the wallet.

Once the approval is signed, the wallet can be drained in seconds with no further clicks needed.

Unlike phishing campaigns that rely on crude imitation or urgent messaging, wallet drainer campaigns blend perfectly into the user experience.

Inside the CoinMarketCap Breach That Emptied Crypto Wallets

The CoinMarketCap incident offers a good example of how crypto draining campaigns operate in 2025.

The breach, which the platform confirmed in an X post, utilized a vulnerability in the doodle image they displayed on their homepage to execute a backend script that empties visitors’ crypto wallets when accessed.

In a statement on X, CoinMarketCap said:

“This doodle image contained a link that triggered malicious code through an API call, resulting in an unexpected pop-up for some users when they visited our homepage.”

While CoinMarketCap didn’t give further information on whether the attackers succeeded in defrauding their visitors, details of the incident were later leaked by an X user, Rey, who claimed that more than 110 victims were affected with a total loss of $43,000 as a result of the attack.

This attack mechanism is effective because it preys on many users’ habitual behaviors of clicking on pop-up prompts without reading the fine print, assuming the site is safe.

Rey shared a screenshot containing the clickbait button pop-up on the CoinMarketCap homepage, which reads, “Connect Wallet.”

Aside from using fake Web3 pop-ups as baits, scammers also use various other tactics and mediums, including fake NFT marketplaces, deceptive ads, malicious smart contracts, or even fake airdrops, as seen when the US Securities and Exchange Commission (SEC) X account was compromised in January 2024.

According to Chainalysis, the wallet drainer acted as the SEC and tricked users into connecting their wallets in an attempt to claim airdrop tokens that don’t exist.

The Impact of Crypto Draining Campaigns on the Web3 Ecosystem

While CoinMarketCap is not a Web3-native platform, the attackers’ use of fake Web3 wallet pop-ups in its recent breach shows that no platform connected to the crypto space is truly immune. If a widely trusted crypto tracking site can be silently weaponized to execute crypto wallet scams, it raises urgent concerns for the broader Web3 community. What platforms can users still trust?

According to Web3 anti-scam solution platform Scam Sniffer, crypto drainer campaigns surged by 67% in 2024, stealing nearly half a billion dollars in a single year. These attacks have quickly become a preferred tactic for cybercriminals due to their scalability, low barrier to execution, and the false sense of legitimacy they create.

Kaspersky’s December 2024 Security Bulletin further highlights this growing threat. It shows discussions about crypto drainer tools on dark web forums spiked by 135%, rising from 55 threads in 2022 to 129 active threads in 2024.

Commenting on the Bulletin, Kaspersky security expert Alexander Zabrovsky noted:

“In light of this trend, the interest of cybercriminals in crypto-drainers and related attacks is likely to grow further in 2025.”

This makes the scamming technique one of the fastest-growing threats in the Web3 ecosystem, even faster than the ransomware technique, as seen in the Chainalysis chart below.

Best Measures to Protect Your Wallet From Crypto Drainers

As a rule of thumb, maintaining a solid crypto wallet security starts with awareness and the right tools.

Cybersecurity leader Kaspersky Security outlines key steps to defend against wallet drainers, summarized below:

The Bottom Line

The use of fake prompts in wallet drainer campaigns shows just how desperate cybercriminals are to steal digital assets undetected.

As the CoinMarketCap incident proved, even a trusted name can become an attack vector when things are overlooked. With the Web3 ecosystem now expanding quickly, it is important to set mechanisms that enable you to stay alert and verify transactions before they complete.

Crypto hackers won’t empty your assets if at one point you didn’t give them what they need, be it access or authorization. The best security approach is to make sure you’re completely in control of how funds move in or out of your crypto wallet.

FAQs