# Wallet drains start with a signature, not a hack

URL: https://www.caijing188.com/drainers-start-with-a-signature/
Published: 2026-10-23T15:09:39+08:00 | Updated: 2026-10-27T22:09:59+08:00
Verified: 2026-10-27

## Quick answer
Most drains are a signature on a permit or a fake mint page, not a broken curve. Ethereum.org's L2 directory put Base at $14.6B of value as of October 2026, and an approval can move a balance without a key being stolen. Simulate, read the request, and keep savings behind a key that never connects.

## Summary
The common drain is a link, a connect dialog and a gasless signature that grants a permission the owner never read. Nothing is extracted from the device, and nothing looks broken afterwards, because the transaction did exactly what it was authorised to do. Simulation filters most of it, reading the request catches more, and a separate savings key caps what any single mistake can reach.

## Key takeaways
- A permit costs no gas now and can cost the whole balance later
- Simulation models the same bytes you sign, so it cannot tell you the payload is honest
- The spender address matters more than the amount on any approval
- Savings behind a key that never connects to a site turns a drain into a small loss

## FAQ
Q: Can a drainer take funds without my private key?
A: Yes, through a permission you signed. A permit, an approval or an operator approval lets a contract move assets later, and the signature costs nothing at the time. The key stays in the device and the balance still leaves.
Q: Does simulation stop drainers?
A: It catches most of them, because a hostile payload simulated honestly shows the hostile outcome. It cannot certify intent: state can change before execution, and proxies can make the simulated effect differ from the label. Treat a clean simulation as a filter, not a guarantee.
Q: What should I check before signing anything unfamiliar?
A: Four fields: the function being called, the spender receiving the permission, the amount with unlimited treated as a red flag, and whether the request costs no gas. If any of the four is unclear, refuse and open the site again from a bookmark rather than the link you were sent.