Drainer sites in TON: how they work and how not to fall

A drainer site is not just phishing. It is an organised Drainer-as-a-Service industry with its own developers, marketers and affiliate programmes. SlowMist’s 2025 annual report flags drainer attacks as one of the top threats in 2024-2025: across all L1s combined — $83.85M in losses and 106,106 victims. Less than the 2024 peak (drainer activity fell 83% year-on-year thanks to pressure on services), but TON activity is rising — young ecosystem, many users, defensive infrastructure trailing. This breakdown — what a drainer is technically, how it works on TON, and which exact tricks attackers use.

What a drainer is and where they came from

A drainer is an automated service that “empties” a victim’s wallet in one transaction. Logic:

1. The drainer campaign publishes a fake site impersonating a known dApp.
2. The victim connects the wallet via TON Connect.
3. The drainer script scans the balance and packs all valuable assets (jettons, NFTs) into a single batch transaction.
4. The victim signs — all assets leave for the attacker’s address in 5 seconds.

Drainers first appeared on Ethereum (2022-2023, Inferno Drainer and Pink Drainer), then moved to Solana, and in 2024-2025 reached TON. Per Recorded Future, the Russian-speaking Rublevka Team worked TON specifically in early 2025, then switched to Solana — meaning the drainer scene is technically ready for TON and follows the money.

Drainer-as-a-Service: the business model

A drainer kit ships as a ready service. Per SlowMist and Group-IB, the typical commercial structure:

• Developer — writes the smart contract and infrastructure. Earns 20-30% of each theft.
• Affiliate (partner) — buys ads, makes the clone site, lures victims. Earns 70-80%.
• Drops — convert stolen jettons into TON and USDT, run them through mixers. Take 5-10%.

Kit price — $500 to $10,000 depending on features. On the input — a simple panel with checkboxes “clone Getgems”, “clone Fragment”, auto-integration with Telegram ad networks. That turns launching a drainer campaign into a “weekend operation”.

Technical tricks on TON

Unlike Ethereum, TON has no universal approve. Each jetton is a separate smart contract, and the transfer operation is called from the wallet directly. So the drainer scenario differs slightly from EVM analogues.

Trick 1 — packed transfer

The most direct approach. On wallet connect the drainer site scans all jetton balances via the tonscan API and forms one transaction with dozens of jetton_transfer messages to the attacker’s address.

The victim sees a TON Connect signing prompt with a long list of operations. If they read carelessly (rushing to claim a “rare NFT”) — they sign, and all jettons leave at once.

Defence — read the transaction body carefully. In Tonkeeper and MyTonWallet that is the “Operations” or “Messages” field with each item detailed.

Trick 2 — disguise as a mint

The site mimics an NFT collection mint. The signing prompt looks like “pay 0.5 TON to mint”, but the bundle includes extra nft_transfer for every NFT in the victim’s wallet. The mint is real (the contract even sets the address as owner), while it sweeps the existing NFTs in parallel.

Defence — count operations in the transaction. If “minting one NFT” needs 15 operations — it is a drainer.

Trick 3 — deceptive address arguments

Tonkeeper and MyTonWallet show the recipient address human-readable. A drainer uses an address homograph — visually similar first/last characters (UQAB...XYZ vs UQAA...XYZ). At a glance it looks like the project address — but funds go to the attacker.

Defence — verify the full address, not just the first 4 characters. Easy hack — copy the address and compare with what the project’s official site states.

Trick 4 — TON Connect session reuse

If the drainer site got a connection and one signature, a “link” to the app remains in Tonkeeper’s “Connected apps”. Hours or days later the attacker can initiate a new signing request (e.g. at night), and if the user auto-confirms a push notification, funds move out.

Defence — disconnect the session immediately after interacting with any new dApp. “Connected apps” in Tonkeeper, “Connected apps” in MyTonWallet.

Trick 5 — gasless trap via jetton check

A 2025 trick. The site offers to “check airdrop eligibility” — the user signs an apparently empty 0 TON informational transaction. In reality the payload calls a custom contract that uses the TON jetton wallet to siphon tokens. Technically more involved but visually looks like a “free check”.

Defence — there is no eligibility check via signature. Real airdrops use snapshots and automatic distribution or a simple claim site without complex signatures.

What a TON drainer campaign looks like in 2025-2026

A real example (anonymised, based on public tonscan data and SlowMist posts).

1. Day 0. Attacker registers getgems-anniversary.app and buys ads in a 200k-subscriber Telegram channel ($2-5K budget).
2. Day 1, 18:00. Active Telegram audience. Posts about a “3rd-anniversary Getgems NFT giveaway”.
3. Day 1, 18:00-22:00. ~2,500 users click the link. ~500 connect a wallet. ~280 sign the drainer transaction.
4. Day 1, 22:00. Drainer-kit automation moves funds to intermediate addresses, then to a CEX through mixers.
5. Day 2. Telegram complaints, the site is banned. The attacker is already cashing out via P2P.
6. Result. Take — $80-200K in one evening. Net attacker profit after marketing and fees — $50-150K.

This script repeats in variations every month.

Defensive setup

Concrete actions that actually reduce drainer-attack risk.

Wallet segmentation

One wallet for cold storage with Ledger — never connected to dApps. A second one — hot, $50-200 balance, for swaps and mints. A third one — disposable, with minimum TON for gas. A drainer attack only reaches the third; damage capped.

Details on segmentation and a safe seed setup — in the seed phrase storage guide.

Ledger when connecting to dApps

When you sign a transaction via Ledger, details show on the device screen. The drainer cannot hide the transfer from you — every address and amount is physically visible. Slower, but signing errors are practically eliminated.

Reading TON Connect prompts

Never sign without reading. Minimum checks:

• Source address (initiator).
• Operations list — what exactly the transaction does.
• Recipient address per operation — must match the stated dApp.
• Jettons, NFTs, amounts — if “NFT mint” touches USDT balance, it is a drainer.

Bookmarks and official channels

For Getgems, Fragment, STON.fi, DeDust, Tonstakers — bookmark the domains. Visit any “promo” of these projects only via the bookmark. Unsure of the URL — open the project Telegram channel (@getgems_io, @ston_fi, @dedust_io) and verify against the pinned message.

Regular session cleanup

Once a week — open Tonkeeper “Connected apps” and disconnect what you no longer need. That closes Trick 4 (repeat requests via old sessions).

Tonscan monitoring

Watch the main wallet via tonviewer.com or tonscan.org. Any anomalous activity comes via email or a Telegram alert bot.

What to do after an attack

If you have signed a drainer transaction:

1. Immediately — disconnect the TON Connect session (deny the attacker a second go).
2. If the address still has jettons or NFTs that the drainer skipped — sweep to a clean address before the attacker returns.
3. Save the tonscan link to the attacker address and the transaction hash — for the report.
4. Report to Tonkeeper / MyTonWallet support and public scam channels — that flags the address and saves the next victims.

Comparing TON drainers to Ethereum and Solana

The drainer scene grew in Ethereum from 2022, moved to Solana in 2023-2024, came to TON in 2024-2025. Architectural differences change the attack surface.

Main TON risk in 2025-2026 — lack of mature defensive infrastructure. Ethereum has Rabby, Pocket Universe, Wallet Guard — extensions that simulate transaction execution and flag anomalies. Almost no TON analogues exist yet, and the user relies on personal vigilance plus built-in Tonkeeper / MyTonWallet filters that only catch known addresses.

That means in TON the risk assessment of a new transaction sits more on the user than on Ethereum. All the more reason not to sign impulsively.

What wallets do against drainers

Tonkeeper, MyTonWallet, and Tonhub added several defensive layers in 2024-2025.

• Scam-address blocklist. Known drainer addresses are flagged; signing prompts toward them show a red warning.
• Domain warning. If the dApp domain is on the blocklist — warning before the signing request.
• Read-friendly transaction view. Operation-by-operation description: “transfer 1,200 USDT to UQ…XYZ”, not raw bytecode.
• Session limits. Ability to cap how much a dApp can spend per TON Connect session (not yet in every wallet).

Reduces but does not eliminate risk. A new domain with a new contract is unflagged in the first hours — which is exactly when attackers harvest the most.

Outlook for 2026: what to expect

Per SlowMist and Recorded Future, 2026 is expected to bring:

• AI-generated drainer sites. Attackers use LLMs to auto-generate clones for any project in minutes. Per Chainalysis, AI tooling boosts scam-campaign efficiency by 4.5x.
• Multi-chain drainers. A single site that can attack wallets across networks (TON, Solana, EVM) — on connection it inspects which network has a balance and crafts the matching transaction.
• Deep mini-app integration. A drainer inside a seemingly legitimate mini-app, activating not immediately but after several days of usage — to bypass first-screening checks.

Defensive practices stay the same — vigilance, wallet segmentation, Ledger for the main assets, domain and signature checks before every “Confirm”.

Sources

• SlowMist 2025 Blockchain Security and AML Annual Report
• Recorded Future — Rublevka Team report
• Group-IB Knowledge Hub — Crypto Wallet Drainers
• Talos — How drainer phishing scams work
• Ledger — Drainer-as-a-Service explainer