Home Blog Sui & Aptos Move Drainers

Sui & Aptos Move Drainers: Why Object Ownership Won't Protect Against Malicious PTBs

1. Move Objects vs EVM Allowances

On Ethereum, your tokens live inside someone else's smart contract mapping. In Move (Sui & Aptos), tokens exist as discrete, typed objects directly in your account storage. While this eliminates rogue infinite ERC-20 allowances, it creates a different attack vector: if you sign a single malicious Programmable Transaction Block (PTB), the script can transfer direct ownership of every coin object and Kiosk NFT in your wallet simultaneously.

2. Sui Programmable Transaction Blocks (PTBs) Exploitation

Sui allows up to 1,024 commands chained inside a single atomic PTB payload. When a user approves a spoofed airdrop:

  1. Gas Coin Splitting: The PTB splits the primary SUI gas object into precise execution fee chunks.
  2. Coin Object Merging: The script loops through all owned coin objects (CETUS, USDC, NAVI, meme coins) and merges them into primary asset objects.
  3. Atomic Transfer: A TransferObjects command sends the merged objects directly to the attacker's recipient address.
  4. Kiosk NFT Extraction: For collections held in Sui Kiosks without hard transfer policies, the PTB calls kiosk::take and transfers the NFT out in the exact same payload.

3. Aptos Module Signer Capabilities

On Aptos, drainers construct batch entry function calls via aptos_account::batch_transfer_coins or request module signer capability delegation, extracting multiple Fungible Assets (FA) and Aptos Digital Assets (DA) in a single wallet confirmation prompt.

4. Frequently Asked Move Draining Queries

Can Move objects be drained without private keys?

Yes. If you approve a PTB containing TransferObjects instructions, Sui validates your cryptographic signature and transfers ownership of the objects directly on-chain.

Do Sui Kiosk NFTs protect against drainers?

Only if royalty and transfer policies enforce strict rule sets that prevent third-party kiosk::take calls in arbitrary PTB payloads. Standard unlocked Kiosks can be emptied immediately.

For more details on cross-chain drainer architecture, read our what is a crypto drainer analysis and explore our Solana drainer architecture.

If you’ve read this far, you know Programmable Transaction Blocks bypass standard Move approvals