Site contains a wallet drainer script

What it is

Your site is running obfuscated JavaScript that robs visitors who have a Web3 wallet — typically MetaMask, Phantom, Coinbase Wallet. The attacker injected the JS through a hacked plugin, a compromised admin session, or a flaw in the application. The script prompts the visitor to connect their wallet, asks for a “routine” signature, and drains their balance.

Vulscan detects this based on a combination of XOR+base64 obfuscation and markers such as eth_sendTransaction, setApprovalForAll or calls to known Polygon/Ethereum RPC endpoints.

Why it’s a problem

This is not a theoretical finding. If someone with a Web3 wallet visited your site in the last few hours and signed the proposed transaction, their funds are probably no longer theirs. Drainers are fast — a matter of minutes from signature to empty wallet.

Secondary damage:

• Google Safe Browsing will flag your site within hours. Chrome and Firefox will start showing a full-screen warning.
• SEO is permanently damaged — Google may deindex the site.
• Brand reputation — if someone lost money, you’ll read about it in the press.

How to fix it — incident response

Follow these steps in order, don’t improvise.

1. Take the site offline (15 minutes)

Fastest: hosting → maintenance mode, or switch DNS to a placeholder page. The goal is to stop the supply of new victims.

2. Identify and remove the malware

• Find where the injection is. From our report you know which URL the drainer appeared on — open view-source and find the <script> tag that doesn’t belong there.
• Look in the database too. WordPress drainers like to hide in wp_options (the blogname, siteurl and homepage options), in post_content, in custom widgets.
• Look for a backdoor. Files such as wp-content/uploads/2024/01/.system.php or an overwritten wp-load.php. The Sucuri scanner (open-source plugin) can help.

3. Rotate credentials

• Passwords of all WP admins (and force-logout all sessions).
• Database password.
• FTP / SSH keys to the server.
• Hosting admin password.
• API keys in wp-config.php and in plugins.

4. Patch the entry point

The drainer got in somehow. Update WordPress core, all plugins and the theme to the latest versions — that also patches the known vulnerabilities of the old ones. Delete plugins you don’t use, and go through the changelogs and security advisories of the developers of those that stay.

5. If you can’t handle it yourself — reach out

A drainer is more serious than a “defacement”. If you don’t have experience with incident response, call a professional. Write to us or to specialized firms (CSIRT.CZ, GovCERT.CZ, or private IR firms).

6. After cleanup — rescan

Once it’s fixed, run vulscan once more. Drainers hide — you might not find them all the first time.

References

• CSIRT.CZ — national CSIRT