How to Use a Burner Wallet for Risky DApps

How to use a fresh burner wallet for unaudited dApps and airdrop hunting: setup, funding, and disposal.

What you'll need (prerequisites)

• Self-custodial wallet
• A second device for verification
• Block explorer (Etherscan, Solscan, etc.) familiarity

Step-by-step

1. Step 1: Understand what a burner wallet is and when to use one

   A burner wallet is a throwaway, self-custodial wallet you use for a single risky interaction — minting a new NFT, claiming an airdrop, or testing an unaudited dApp — so any malicious approval or drainer hits an almost-empty wallet instead of your savings. Because it holds little and is disposable, a compromise costs you almost nothing. Treat it as isolation, not as long-term storage.

2. Step 2: Create a fresh wallet separate from your main funds

   Generate a brand-new wallet — a separate MetaMask or Rabby account, or ideally a separate browser profile or device — that shares no seed or history with your main wallet. Keeping it fully separate means a malicious site cannot see or touch your primary balances. Label it clearly so you never confuse it with your main account.

3. Step 3: Fund it with only what the interaction needs

   Transfer in just the amount required for the specific action — the mint price plus gas, for example — and nothing more. If a drainer empties the burner, your exposure is capped at that small balance. Never park spare funds in a burner for convenience.

4. Step 4: Connect the burner, not your main wallet, to the risky site

   When the dApp prompts you to connect, select the burner account and double-check the wallet header shows the burner address before you approve anything. Read each signature request carefully — especially token approvals and setApprovalForAll — and reject anything you do not understand. Confirm you are on the correct, official URL to avoid phishing clones.

5. Step 5: Revoke approvals and sweep residual value after use

   When you are done, visit revoke.cash (or your explorer's approval tool) and revoke any allowances the site was granted, since an open approval can be drained later. Move any remaining tokens or NFTs you want to keep to a safe wallet. Leaving live approvals on a funded burner is the most common way people get drained days after an interaction.

6. Step 6: Never store long-term value or link it to your identity

   Keep only trivial amounts in a burner and never treat it as a savings wallet. Avoid sending funds directly between your burner and your main wallet, since that on-chain link ties the two identities together and undermines the isolation. When a burner has served its purpose, retire it and spin up a fresh one for the next risky task.

Common errors and fixes

• Approval can't be revoked due to insufficient gas. Revoke transactions cost the same gas as a normal token transfer. Top up the wallet with a small amount of native gas token before revoking.
• Funds already drained. On-chain theft is generally irreversible. Document everything, file police / IC3 / Chainalysis Reactor reports, and contact the protocol team if a known exploit. CEX-side funds may be recoverable if the attacker on-ramped to a regulated exchange.
• Suspected key leak but no losses yet. Move all funds immediately to a freshly created wallet. Burn the old seed. Audit every device the seed touched (browser extensions, cloud backups, email).
• Cannot identify the malicious contract. Use Etherscan's "advanced filter" to filter by token approvals and unusual contract calls. Run the suspicious tx through Tenderly to decode the call.
• Phishing email looks real. Always verify by typing the URL manually. Real exchanges and protocols never email asking for seed phrase, password, or 2FA codes — full stop.

FAQ