A wallet drainer is client-side Web3 instrumentation that interrogates a connected wallet's account state and constructs batched transaction payloads designed to transfer high-liquidity assets in a single confirmation. In production, conversion rates depend almost entirely on evading wallet simulation engines (such as Phantom Safeguard or MetaMask heuristic scanners) that inspect transactions before presentation.
Core Execution Pipeline
Production drainers run three sequential operations under tight latency limits:
1. Account State & Inventory Discovery
When a user connects, the payload fires parallel JSON-RPC requests across dedicated nodes. It maps native balances, SPL/ERC-20 token accounts, Metaplex metadata trees, and DeFi positions (Uniswap V3 LP NFTs, Aave supply, Kamino deposits). Asset lists are sorted by USD liquidity via oracle feeds within 200 to 500 milliseconds.
2. Transaction Construction & Simulation Evasion
Naive transfer instructions trigger instant warning modals in modern wallets. Production engines wrap extraction calls inside contextual camouflage. On Solana, transfer instructions are embedded inside composite Jito tip and swap contexts to satisfy Lighthouse assertion checks. On EVM chains, Seaport 1.6 order fulfillment replaces flagged Permit2 approvals.
3. Atomic Settlement
Once signed, the transaction broadcasts directly through private RPC endpoints to bypass public mempool sandwich bots and frontrunners. Extracted assets route to pre-configured settlement addresses or split contracts.
Architectural Divide: Solana vs EVM
The underlying VM dictates the attack surface and evasion logic:
Solana Runtime (SVM)
Solana transactions can pack multiple instructions into a single atomic block. Assets include native SOL, SPL tokens, SPL-2022 Token Extensions, compressed NFTs (cNFTs) via Metaplex Bubblegum, and native stake accounts. The primary hurdle is Phantom's dual defense: on-chain Lighthouse co-signers and cloud-based Safeguard simulation.
Ethereum & EVM L2s
EVM environments require navigating approval standards across 30+ networks. Generic Permit2 off-chain signatures are blacklisted by MetaMask Snaps, Rabby, and WalletGuard when originating from unverified domains. Modern engines use Seaport 1.6 consideration mapping, EIP-7702 delegation, and EIP-712 v4 typed data.
Operational Infrastructure Requirements
A payload script alone cannot maintain uptime without backend support infrastructure:
- Private RPC Nodes: Public RPC endpoints rate-limit concurrent queries and leak transaction intent to public mempools.
- Automated Domain Rotation: When threat intelligence feeds flag a landing URL, edge proxies must automatically swap traffic to pre-warmed domains with SSL active.
- Gas Sponsorship Layer: Target wallets holding substantial tokens but minimal native coin (zero SOL or zero ETH) fail without an external fee payer covering network execution.
- High-Frequency Telemetry: Instant Telegram callbacks detailing signer address, extracted tokens, and explorer transaction links.
Common Failure Modes in Public Scripts
Open-source GitHub repositories and leaked scripts typically fail for two reasons: hardcoded backdoors where extracted funds redirect to the original author, or burned signature schemas that trigger immediate red warning banners in modern wallet clients.