First of all crypto draining just to be clear is not hacking and can be done by anyone. You don’t get hacked you get scammed! I would say it’s the most efficient and most popular way to make money for scamers/ fraudsters that exist.

It literally means stealing someone else’s cryptocurrency by tricking them into giving permission, definitely not by hacking the blockchain.

Most crypto wallets can sign transactions or grant permissions, to smart contracts. Drainers exploit this by getting user to approve something malicious. Once approved, the bad actor can legally (on chain) move the funds because technically the wallet owner allowed it. So it’s more like convincing the victim to hand you over the key to the safe and less like breaking into the safe.

Basically malicious approval requests… user connects their wallet to fake site any nft, mint, airdrop, defi app, to verify the wallet, site asks for token approval, the approval is unlimited, bad actor later pulls all approved tokens out the wallet.

Wallet pop ups can be confusing, and bad actors rely on that, user is asked to sign somethingb that sound harmless where in reality they acctualy sign over the rights to transfer assets, change wallet premisions or hand over control to another adress etc…