KoinlyticsWallet drainer kits are software-as-a-service for scammers. Buy the kit, spin up a phishing site, split the take with the developers. In 2024 they extracted over $600M from users. The exact patterns are boringly consistent.
The four main patterns
- Fake airdrop check. "Click to check if you are eligible for X airdrop." The signature you approve is a token transfer or an approval, disguised.
- Permit / permit2 phishing. A signature request that looks like login but grants unlimited USDC or DAI approval to the attacker. No transaction, no gas cost, no visible risk. Devastating.
- Wallet drainer dApp. Fake DeFi app that shows a swap UI but actually deploys a contract that steals all wETH, USDC, and other tokens with existing approvals.
- Address poisoning. Attacker sends 0-value transactions from an address that visually matches (starts and ends with the same characters as) one you paid before. You paste from history, send to the wrong address.
What signatures actually mean
Wallets show one of three things:
- Transaction. Costs gas, moves tokens, visible on-chain.
- Sign message. Free, off-chain. Might grant permissions if wrapped in a permit standard.
- EIP-712 typed data. Structured signatures your wallet can decode.
Red flags in the signature dialog
- Amount field shows infinity or a very large number.
- Signature is for a token contract you don't recognize.
- Domain is not the one you thought you connected to.
- Contract address appears to be fresh (deployed today).
- Wallet warns "this is a permit" or "this is an approval" and you were not expecting to approve anything.
Defenses
- Use Rabby or a wallet that decodes signatures clearly.
- Turn on wallet warning modes (MetaMask Blockaid, Rabby security).
- Never sign a permit from an airdrop check page.
- Bookmark real dApp URLs. Never click Twitter or Google ads to reach a dApp.
- Verify contract addresses via project's official docs, not search.
- Sanity check: if you weren't planning to move money, don't sign anything that moves money.
If you were drained
Move remaining assets to a new wallet immediately. Old wallet is compromised: even without seed exposure, active approvals will keep draining incoming funds. Report to chainabuse.com and the token issuer.