Web3 antivirus extensions: what they catch as drainer losses fall to $84m

A web3 antivirus is a browser extension that reads a transaction before your wallet signs it and tells you what it will do. Wallet drainers took $83.85 million from 106,106 victims on EVM chains in 2025, Scam Sniffer reported in January, down 83% from $494 million in 2024. The tools that protect your crypto wallet from scams of this kind work at one moment: the second before you click Confirm.

How they work

The extension intercepts the request from the site to your wallet, runs the transaction in a simulated copy of the chain and shows the result in plain words: which tokens leave, which contract gets permission to spend them, whether the receiving address matches a known drainer. If the site asks for an unlimited approval, the warning says so before the signature exists.

Which tools exist in 2026

• Web3 Antivirus: a free extension for Chrome, Firefox, Brave and Edge. It simulates transactions in a test environment without access to your wallet, and its Alchemy listing names more than 60 risk types, from address poisoning to honeypot tokens. A MetaMask Snap version covers part of the same checks. Ethereum is its main chain; check the list for others.
• MetaMask's built-in security alerts, run by Blockaid, which flag malicious requests inside the wallet itself.
• Rabby, a wallet with a pre-signing check built in.
• Pocket Universe, which Kerberus bought in August 2025 and is folding into its Sentinel3 extension for EVM chains and Solana.
• Wallet Guard, which Consensys, the company behind MetaMask, bought in July 2024.

Where the money went

Scam Sniffer broke down the 11 largest cases of 2025, those of $1 million or more, worth $22.98 million together. Permit and Permit2 signatures took $8.72 million, approve and increaseApproval $5.62 million. The largest single theft, $6.5 million in September, came through one Permit signature.

“wallet security integration and user education remain critical defenses”

— Scam Sniffer, 2025 phishing report, January 2026 · drops.scamsniffer.io

What they do not catch

A scanner reads transactions. If you type your seed phrase into a fake site, no transaction exists to read. The same goes for spyware on your phone, a fake support email, or a weak seed. On mobile, most wallets do not run browser extensions, so check whether your wallet app has its own alerts. Google DeepMind and Singapore's GovTech have built on-device scam detection for phones.

Our count

• In 2025 a drainer took $790 per victim on average, against $1,488 in 2024, a fall of 47%.
• Permits and approvals made up 62% of the money in the large cases. Those are the exact requests a simulation decodes before you sign.
• The 11 large cases held 27% of the year's losses. The $6.5 million Permit theft equals the average losses of about 8,200 victims.

Install one scanner on the browser profile where your wallet lives and leave the warnings on. Web3 Antivirus and MetaMask's alerts cost nothing; last year's average drainer loss was $790.

This piece compares publicly described features and is not a product endorsement or a security audit. Loss figures come from Scam Sniffer's 2025 report; feature descriptions from the developers' listings.