There’s a particular breed of scam doing the rounds right now that I find genuinely impressive in how nasty it is. Not admirable, to be clear. But the engineering is sharp, the social engineering sharper, and the targets are ordinary British retail investors who’ve done everything right, declared their crypto, tried to stay compliant, and got robbed anyway. The crypto drainer scam UK HMRC FCA combo is the current peak of that particular racket, and it’s worth understanding exactly how it works.
What a crypto drainer actually is
A drainer isn’t a phishing page that steals your seed phrase. That’s old-school. A drainer is a malicious smart contract, usually deployed on Ethereum or a cheap EVM-compatible chain like Base or Polygon, that you authorise yourself. One transaction. One signature. Everything gone.
The flow is simple in concept. The attacker deploys a contract with a function that calls transferFrom on every ERC-20 token in your wallet, plus sweeps native ETH, once you’ve granted approval. The contract often bundles these into a single multicall so the drain completes atomically. If you sign the approval, the contract does the rest without any further input from you or the attacker. Etherscan will cheerfully show you the transaction you authorised. The funds are gone in seconds, typically bridged and tumbled within minutes.
Drainer kits, pre-built, ready to deploy, have been selling on Telegram and dark web forums since at least 2023. By 2026, they’re subscription services. Some charge a flat monthly fee; others take 20–30% of everything drained. There are support channels, changelogs, even feature requests. It’s a genuinely functional criminal SaaS ecosystem.
The HMRC angle: why it’s so effective against UK investors
Here’s where it gets specifically British. HMRC treats crypto as a capital asset, which means UK retail investors have real, ongoing tax obligations, capital gains on disposals, income tax on staking rewards, and a Self Assessment deadline that makes people anxious every January. That anxiety is the attack surface.
The campaigns I’ve been tracking follow a consistent pattern. A UK investor searches for something like “HMRC crypto tax calculator 2025-26” or “how to report crypto gains UK”. They land on a site that looks like a professional tax tool, clean UI, GOV.UK-adjacent colour scheme, the HMRC logo (lifted directly, obviously), and a table showing allowances and rates that are actually accurate. The accuracy matters. It builds trust.
Then comes the hook. To generate your “personalised tax report” or “portfolio gain summary”, the tool asks you to connect your wallet. This is framed as read-only, just so the tool can see your holdings and calculate gains automatically. That framing is a lie. The wallet-connect flow that follows requests a signature that isn’t read-only at all. It’s an approval transaction, or in some cases a permit signature (EIP-2612), which requires no on-chain transaction from you, just an off-chain signature that the drainer contract can then use to pull funds.
Spoofed FCA registration numbers
The second layer of the crypto drainer scam UK FCA attack is spoofing the Financial Conduct Authority’s register. This one is brazen. The FCA’s Financial Services Register is public, anyone can look up a firm’s registration number at register.fca.org.uk. Attackers take real FCA registration numbers from legitimate, inactive, or recently dissolved crypto asset firms and paste them onto their fake platforms.
Most retail investors don’t verify these properly. They see “FCA Registered: 123456” in the footer, search that number, find a result on the FCA register, and stop there. They don’t check whether the firm name matches, whether the registration covers the specific activity advertised, or whether the firm is listed as “Cancelled” or “Removed”. The FCA register UI doesn’t exactly make this obvious at a glance.
I’ve seen at least three campaigns in 2026 using registration numbers belonging to firms that surrendered their authorisation, meaning the number exists in the register but the firm is no longer permitted to operate. Technically accurate enough to pass a quick look. Technically fraudulent in every meaningful sense.
The FCA does maintain a Warning List of known unauthorised firms, and some of these drainer sites do end up there eventually. But the campaigns burn through domains fast, similar to how UK phishing infrastructure rotates through .uk and .co.uk domains before takedown catches up. A site lives for a week, drains a few wallets, disappears.
The wallet-connect flow in technical detail
Let’s get into the mechanics, because understanding this is the only real defence.
When a legitimate DeFi protocol uses WalletConnect or a browser wallet like MetaMask, it sends a JSON-RPC request to your wallet asking for a signature or transaction approval. The wallet UI shows you what you’re signing. The problem is that most users have been trained to click through these prompts, and drainer sites exploit that conditioning brutally.
The specific techniques vary. Some drainers request eth_sign on arbitrary data, which some wallet implementations will sign without showing readable context. Others use personal_sign with a blob that looks like a random hash but is actually a structured message that the contract can verify on-chain. The most sophisticated use EIP-712 typed data signing, which does show structured fields in the wallet UI, but labels them with innocuous names like “TaxReport”, “PortfolioID”, or “ConsentHash”.
The permit approach is particularly nasty because it leaves no on-chain trace until the attacker redeems the signature. You sign something off-chain, nothing happens immediately, and you walk away thinking the tool just didn’t work. Then, hours later, the attacker submits the permit transaction and the drain executes. By the time you notice, the transaction trail has been routed through a mixer.
This connects to a broader pattern of how credential and approval theft works across the UK attack surface, similar social engineering mechanics appear in SIM swap fraud targeting UK banking 2FA, where the goal is always to get the victim to perform a legitimate action that completes the attacker’s objective.
Why victims can’t easily get their money back
This is the part that really stings. Crypto transactions are irreversible by design. There’s no equivalent of a bank chargeback, no Section 75 protection, no FSCS coverage. If you signed the transaction, you signed it. The contract executed correctly from the blockchain’s perspective.
Action Fraud will take your report. What happens next is, let’s say, not exactly rapid. The NFIB system processes crypto fraud reports but chain analysis and cross-border coordination make recovery genuinely rare. The National Cyber Security Centre has published guidance on crypto scams, but prevention messaging doesn’t help people who’ve already lost funds.
Some victims have had partial success contacting exchanges where drained funds were cashed out, if the attacker made the mistake of using a KYC’d exchange, a police production order can sometimes freeze an account. But drainer operators are rarely that careless. Funds typically hit a bridge, then a DEX swap, then a privacy protocol, within one automated script execution.
How to spot and avoid these drainer campaigns
A few concrete things that will actually help. First: no legitimate HMRC tool, tax calculator, or GOV.UK service will ever ask you to connect a crypto wallet. Ever. HMRC calculates tax from figures you provide, not by reading your wallet directly. If something is asking for a wallet connection in a tax context, it’s a drainer. Full stop.
Second: check FCA registrations properly. Don’t just search the number. Verify the firm name matches exactly, check the registration status is “Authorised” (not Cancelled or Removed), and check that the specific permission listed covers what the site claims to do. Crypto asset firms registered under the Money Laundering Regulations have a separate register entry from those with full FCA authorisation, and the distinction matters.
Third: read wallet prompts. Actually read them. MetaMask and most modern wallets now flag high-risk signature types. If you see a warning about unlimited token approvals or permit signatures, stop. No tax tool needs that.
Fourth: use a hardware wallet for anything significant. Ledger and Trezor devices display the full transaction data on a separate screen, much harder to slip malicious approval requests past a user who’s looking at a physical device rather than a browser popup.
The NCSC’s vulnerability disclosure and threat intelligence functions are increasingly aware of drainer campaigns, similar to the infrastructure monitoring described in the GCHQ NCSC disclosure process, but drainer sites move faster than takedown processes. The defence has to start with the individual. Know what you’re signing.
Frequently Asked Questions
What is a crypto drainer and how is it different from regular phishing?
A crypto drainer is a malicious smart contract that empties your wallet after you sign a single approval transaction. Unlike phishing, which steals your seed phrase or password, a drainer works entirely through legitimate blockchain mechanics, you authorise it yourself, which is why it’s so hard to reverse or dispute.
Are fake HMRC crypto tax calculator sites easy to spot?
Not always, which is the problem. The better-built ones use accurate tax rates, credible-looking GOV.UK-style design, and real HMRC logos. The giveaway is the wallet-connect requirement, no genuine HMRC or tax tool will ever ask you to connect a crypto wallet to calculate your gains.
How do I check if an FCA registration number is legitimate?
Go directly to register.fca.org.uk and search the number. Check that the firm name on the register exactly matches the site you’re looking at, that the status shows ‘Authorised’ (not Cancelled or Removed), and that the specific permissions listed cover what the platform claims to do. Mismatches on any of these are red flags.
Can I get my money back if a crypto drainer steals my funds?
Realistically, recovery is very rare. Crypto transactions are irreversible and there’s no FSCS protection or chargeback mechanism. You can report to Action Fraud and the FCA, and in some cases police can freeze exchange accounts via production orders if the attacker used KYC’d platforms, but most drainer operators route funds through mixers and DEX swaps within minutes.
What wallet settings or tools can protect me from drainer attacks?
Use a hardware wallet like Ledger or Trezor for any significant holdings, they display full transaction details on a separate screen. In MetaMask, pay attention to approval warnings and never grant unlimited token approvals to unfamiliar contracts. Browser extensions like Revoke.cash let you audit and revoke existing approvals that you may have granted previously.
Leave a Reply