When you finish this page you'll have a burner wallet: a fresh hot address holding nothing but gas, kept for the claim pages, test mints and unfamiliar dApps that haven't earned your trust. Know one thing before you start. A burner protects you from drainers. It does nothing to make you eligible for more, and if you fund it carelessly it can look like exactly the kind of wallet a sybil filter is built to catch.

Three wallets, three jobs

The setup experienced farmers describe has three tiers. WhySoGeek's approval guide lays it out as a low-balance burner for new or untrusted dApps, a daily wallet for routine work, and a hardware vault for long-term holdings that rarely connects to anything. The burner is the only one you're building today, but it is only worth anything if the vault exists and stays out of the line of fire.

The case for this has nothing to do with seed phrases. A modern drainer usually doesn't need your phrase. The fake SHIB airdrop that went viral on October 12, 2026 asked victims to connect a wallet and sign, and CryptoTicker reported that the signature granted unlimited token approval, which let the attackers drain holdings later with no further action from the victim. A burner keeps that signature away from anything you'd miss.

What you need

  • A wallet app

    MetaMask or Rabby for EVM chains, Phantom for Solana.

  • Gas money for one task

    Enough for the claim or mint in front of you, and no more.

  • Pen and paper

    For the new recovery phrase. It never goes into a website.

  • Bookmarked official URLs

    For the dApp and for revoke.cash.

Setting it up

  1. Create a new wallet with its own recovery phrase in your chosen app, rather than adding another account to your vault's seed. If the phrase ever leaks, only the burner goes with it. You'll know it worked when the app shows a new address with a zero balance.

  2. Write the phrase on paper. Ledger's phishing status page puts the rule plainly: "Ledger will never ask for the 24 words of a recovery phrase." No airdrop will ever ask for them either. You're done when the paper copy matches the screen.

  3. Send in gas for the one task you're about to do. Think about where that money comes from. WhySoGeek's sybil guide lists many wallets funded from a single source, wallets activated in a tight time window, and near-zero balances right after tasks as the fingerprints filters look for. One major Layer 2 drop filtered roughly 517,000 of 1.3 million eligible addresses. None of the sources say which funding route a filter treats as clean, so the honest advice is to keep the count small: one burner for testing, not a fleet. Read about where several wallets become a cluster before you add a second. Step 3 has worked when the gas shows in the balance.

  4. Open the dApp from your bookmark, never from a post or a DM. The SHIB scam spread through posts "flooding the timeline", in the words of Shiba Eternity adviser Mazrael. You should see the address you saved.

  5. Connect the burner and do the task. It has worked when the transaction confirms in the wallet.

  6. Send anything you claim to the vault. Do it as soon as the claim lands. While tokens sit on the burner, any approval you've signed can reach them. You'll know it worked when the burner's token balance reads zero and the vault shows the tokens.

  7. Revoke the burner's approvals at revoke.cash, opened from your bookmark. WhySoGeek recommends a monthly audit, because drainers sometimes wait weeks after getting an approval before they use it. It has worked when the list of approvals is empty.

If it went wrong

Not necessarily, but treat it as if it will be. Permit and Permit2 signatures often show up as unreadable strings of code, setApprovalForAll can hand over a whole NFT collection, and delegation signatures under EIP-7702 can give away control of the entire account. Move anything of value to the vault and revoke at once. Here's [what those signatures actually grant](/blind-signing-and-airdrop-claim-drainers/).

Close it. WhySoGeek documents attackers registering lookalike domains that copy the emergency "revoke your approvals now" warnings issued after a real exploit, so that panicked users sign fresh approvals. Only use the bookmark.

That's the point of the scam. CleanSky reports the CLINKSINK drainer took about $900,000 on Solana by impersonating Phantom, DappRadar and BONK claim pages. A page that looks right isn't proof of anything. A bookmark is better evidence.

Done

You now have a disposable address that can take a risky signature without putting your holdings behind it. Known tasks belong to the farming wallet, and the vault only connects for transfers in. If that vault is a Ledger and you want to sign known tasks from a hardware-backed address, pairing it with your browser wallet is the next job.

Want to sign known farming tasks from a hardware-backed address?

Pair a Ledger Nano X or Nano S Plus with MetaMask or Rabby, step by step.

Connect Ledger to MetaMask