The five attacks that actually drain DeFi wallets

DeFi is a self-sovereign system. There is no customer support. No chargebacks. No one to call when funds disappear. The security model is entirely your responsibility — which sounds terrifying until you notice the pattern: almost everyone who gets drained falls to one of the same five attacks, and every one of them is avoidable with a small amount of deliberate practice.

01Phishing sites

How it works: fake versions of Uniswap, MetaMask, or a popular bridge — reached through a sponsored search result, a Discord DM, or a reply-guy link — that ask for your seed phrase or trick you into signing a malicious approval.

The block: bookmark the official URLs the first time you verify them, and only ever enter through your bookmarks. Never click wallet or DEX links in DMs, ads, or replies. No legitimate app or "support agent" will ever ask for your seed phrase.

02Malicious token approvals

How it works: to trade a token, you first approve a contract to spend it. Malicious sites request unlimited approvals; months later the contract drains everything it was ever approved for. Even honest approvals become a liability if that protocol is later exploited.

The block: approve only the amount you're actually trading when your wallet offers the choice, and audit your standing approvals at revoke.cash every few months — connect, review which contracts can spend which tokens, and revoke anything you no longer use. Each revocation is a small on-chain transaction; think of the gas as an insurance premium.

03Seed phrase theft

How it works: malware that scans disks and cloud drives for 12- and 24-word lists, fake "support" agents who walk you through "re-validating" your wallet, or a compromised computer reading the seed you saved in a notes app "just for a minute."

The block: never store a seed phrase digitally — no photos, no password managers, no cloud notes. Write it on paper (or steel), store it offline, and for any amount you'd genuinely hurt to lose, move to a hardware wallet.

04Rug pulls

How it works: a project team launches a token, attracts liquidity, then drains the pool or mints unlimited supply — the price goes to zero in a block.

The block: stick to audited, battle-tested protocols for anything that matters, and treat anonymous teams launching brand-new tokens as what they statistically are. If the yield looks too good to be real, that's the product.

05Fake airdrops

How it works: scam tokens appear in your wallet unannounced. Trying to sell or even interact with them triggers contract logic that drains real assets or harvests approvals.

The block: ignore any token you did not buy. Don't touch it, don't try to sell it, don't visit the URL in its name. Unexpected airdrops are spam with teeth.

The hardware-wallet threshold

For any amount you cannot afford to lose — a reasonable threshold is $1,000+ — use a hardware wallet (a Ledger or Trezor). Your private key lives offline inside the device; even a fully compromised computer cannot sign a transaction without the device in hand and its PIN.

The 60-second checklist

That checklist blocks the overwhelming majority of real-world drains. The rest of staying safe is knowing what you're signing before you sign it — reading approvals, verifying contracts, and understanding the transaction flow end to end.

Next up: how to verify any DeFi contract on Etherscan — the check that comes before every signature.