whodrained.me

Starter Kit

Twelve things worth doing.

Ordered by effort, not by fear. It opens on what anybody can finish tonight and closes on the parts worth sitting down for. Most people are already doing some of these.

Scan this list against a wallet

Soon
Soon

Read-only when it opens. We never ask you to connect a wallet, and there is no signature.

01

Start here

The largest effect for the least explaining. Three cost nothing; one arrives in the post.

0104 · 4 items

  • 01

    Move long-term holds off your trading wallet

    $1.7B left compromised wallets across 34 incidents in the first half of 2025. What you are not trading should not be reachable from the tab you trade in.

    How

    Make a second wallet in the app you already use, never connect it to a site, and send it everything you are not actively trading. It costs nothing and takes about ten minutes.

    Tools

    • Moves funds to the second wallet without publishing the link between the two.

    • Holds several accounts in one wallet, so the second address costs nothing to create.

    • Add a second account inside the wallet you already have. The new address is the one you never connect anywhere.

  • 02

    Separate your hot wallet from cold storage

    The largest single theft of 2024 took $55.5M from one address. A second address helps only until the machine holding its key is the one that gets compromised.

    How

    Buy a hardware wallet and let it hold the keys for the address above. Keep about a week of trading money in the hot one and nothing else.

    Tools

    • The cold side. Keys never leave the device, so a bad signature cannot reach them.

    • Same job, open source firmware.

    • Pairs with a hardware device, so the cold side signs and the hot side never holds the keys.

  • 03

    Support never DMs first

    Seed-phrase social engineering took $284M in January 2026, about 71% of that month's total crypto theft. Nobody legitimate ever needs your seed phrase.

    How

    Close the message. Open the project's official site yourself and use the support link you find there.

  • 04

    Never install a browser extension mid-trade

    $1.7B left compromised wallets in H1 2025. A new extension is an unaudited piece of software sitting next to your keys.

    How

    Install extensions on a day you are not trading, from the official store, and check the publisher name first.

02

Close the identity gap

What connects the wallet to a person.

0509 · 5 items

  • 05

    Stop using one address for everything

    332,000 addresses were drained in 2024. One address doing every job is one address a stranger has to find.

    How

    Run one address per job: one for trading, one for mints, one for receiving from people you know.

    Tools

    • Move between your own addresses without publishing that they are both yours.

    • Self-custody, and holds several accounts in one wallet, so a fresh address per job costs nothing.

  • 06

    Break the exchange deposit link

    181,565 crypto fraud complaints were filed in the US in 2025, reporting over $11B lost. Targeting starts with someone being able to see who you are.

    How

    Move funds through Houdini instead of withdrawing from the exchange straight into the wallet you trade from.

    The tool

    • Breaks the on-chain link between the exchange withdrawal and the wallet you trade from. The only tool in this category.

  • 07

    Move between chains without connecting your addresses

    Drainers took $83.85M in 2025, down 83% in dollars, while the number of victims barely moved. Every bridge that ties two of your addresses together adds to what strangers can see.

    How

    Bridge through Houdini rather than a direct bridge that makes you sign from both addresses.

    Tools

  • 08

    Use a browser that isn't leaking you

    Phishing ran 132 separate incidents in H1 2025, more than any other vector. A browser that blocks the fake site never gets you as far as the signature.

    How

    Use Brave or Firefox with a separate profile just for crypto, and install nothing else into that profile.

    Tools

    • Blocks trackers and known phishing domains without an extension doing it.

    • Use a separate profile for crypto and nothing else.

    • The one extension worth the exception. Install it before you start trading, not during.

  • 09

    VPN on for anything touching funds

    181,565 people filed crypto fraud complaints in the US in 2025. Your IP is one more thing that connects a wallet to a person.

    How

    Turn the VPN on before you open a wallet or an exchange, not after you are already signed in.

    Tools

    • No account, no email, pays by cash if you want. Flat rate.

    • Audited, no-logs, and takes anonymous signup.

    • Free tier that is genuinely usable if you are not paying for one yet.

03

When you're ready

Slower going. One habit to build, and two screens worth sitting down with.

1012 · 3 items

  • 10

    Never sign a message you can't read

    0.4% of stolen crypto was recovered in Q1 2025, down from 21.2% a year earlier. Every drainer kit ends at a signature, and every one of them fails if you refuse.

    How

    If your wallet cannot say in plain words what a signature does, reject it and go find out why before you sign anything.

    Tools

    • Spells out what a signature is being asked to do before you agree to it.

    • Reads the transaction back to you in plain words. If it cannot, that is your answer.

    • Same, and warns on contracts already known to be malicious.

  • 11

    Turn on signature simulation in your wallet

    Phishing ran $410M across 132 incidents in H1 2025. Simulation shows you what a transaction does before you approve it.

    How

    It is under Settings, then Security, in Solflare, Phantom and Backpack. Turn it on, then read what it tells you before approving.

    Tools

    • Simulates a transaction and warns on addresses and sites already known to be malicious.

    • Same simulation, and it shows what leaves your wallet before you approve.

    • Same simulation, and it flags known malicious contracts.

  • 12

    Revoke stale token approvals

    Drainers took $494M from 332,000 addresses in 2024. A standing approval is what makes it one click.

    How

    Open revoke.cash, connect nothing, paste your address, sort by oldest, and revoke anything you do not recognise. Do the stablecoins first, because those are the approvals worth the most to whoever holds them.

    Tools

    • Paste an address and see every open approval. Read-only until you choose to revoke one.

    • Shows connected apps and lets you disconnect them from inside the wallet.

Ground rules

The rest of it, and none of it is scored.

The twelve above each carry a number we can source and a check we can run. These do not, and they are worth doing anyway. A wallet that follows all of this and none of the twelve is still worth scanning, which is exactly why they are kept apart.

  • 01

    Use a multisig for anything you can't afford to lose

    Squads on Solana, Safe on Ethereum. Set the threshold above one signer, or it is a single key wearing a costume.

  • 02

    Bookmark the sites you use

    Arrive from your own bookmark. Not a search result, and not a link someone sent you. The fake site buys the slot above the real one.

  • 03

    A chart page is not a source

    Links on token scanners are submitted by whoever listed the token. Plenty of them lead to a drainer. Read the domain before you connect anything.

  • 04

    Never scan a QR code you didn't go looking for

    A QR code is a link you cannot read before you follow it. Stickers on hardware, codes in a DM, a screen at an event asking you to verify: type the address in yourself instead.

  • 05

    Seed phrases go on metal

    Paper burns, runs and fades. A stamped plate survives the house it was in.

  • 06

    Split the backup

    A Shamir backup breaks the seed into shares, so one share found in a drawer is not your wallet.

    How

    Trezor calls it Shamir Backup and offers it during setup. Pick a threshold like 2 of 3, then keep the shares in places that would not burn down together.

  • 07

    Carry a physical security key

    On every account that takes one. A code sent by text is the weakest second factor still in service.

  • 08

    Your phone is not a vault

    Keep on it only what you would hand to a stranger, because one day you will hand it to one.

  • 09

    Money on a bot or a terminal is lent, not held

    Count it as gone until it is back under keys you control. Then it is yours again.

  • 10

    Turn off automatic downloads

    A browser that saves files without asking has already done the difficult half of the job for whoever sent it.

    How

    Chrome and Brave: Settings, then Downloads, then turn on “Ask where to save each file before downloading”. Firefox: Settings, then General, then Downloads, then “Always ask you where to save files”.

  • 11

    Travel with a travel machine

    A second laptop, a small balance, and nothing signed on it you would miss.

  • 12

    Rebuild the machine now and then

    A clean install is the only way to know what is running on it.

  • 13

    Don't let the boring money sit in one place

    One stablecoin, one chain, one contract is a single point of failure. Spreading it is a backup, not a trade.

  • 14

    Nobody is too careful

    Everyone this happens to was sure it would not. Work from the assumption that you are the mark and the twelve above get easier to finish.

The rest of the stack

Not security fixes.

These are here because people ask what we use, not because they do any of the twelve things above. A trading venue on a security list would only make the list mean less.

  • Where most Solana trading happens. Spot, perps, lending and staking in one place. A trading venue, not a security tool.

  • HoudiniFixed byHoudini Swap

    Swaps across 100+ chains without connecting a wallet or signing. The privacy items above are the reason it is on this site.

  • Self-custody Solana wallet. Browser extension and mobile, pairs with a hardware device, holds multiple accounts.