You open your wallet one morning and the balance is gone. You never told anyone your seed phrase and you never confirmed a transfer out. So how? The answer is usually the same: at some point you signed an approval and handed a contract standing permission to move your tokens. It does not need your private key, and it does not need you to press send a second time. When the moment suits it, a drainer empties the wallet in a single transaction. Here is what an approval really is, how scammers get you to sign one, and what to salvage if you already have.
- A drained wallet does not mean your seed phrase leaked — one approval you signed yourself is enough for someone to move your tokens legitimately.
- The worst version is the unlimited allowance: sign once and the contract can take the entire balance of that token whenever it likes, without asking again.
- The defense is unglamorous: read what you are signing before you confirm, and revoke allowances you no longer use on a regular schedule.
First, what an approval actually is
If you have ever swapped tokens, provided liquidity or bought an NFT on Ethereum, BNB Chain, Solana or anything similar, you have signed an approval. It is not a transfer. It is a permission slip: you tell a smart contract that it may move a particular token out of your wallet later, up to a certain amount, without asking you each time. That design exists for a good reason. A decentralized exchange cannot swap your USDT unless it is allowed to take the USDT out of your wallet first.
The catch is that the permission slip has no opinion about who receives it. Grant it to a legitimate router and it executes your swap. Grant it to a contract written to rob you, and that contract can move the same token out just as smoothly, because as far as the chain is concerned nothing irregular happened at all: the owner of the wallet authorized it. No private key is required, and you are never asked to confirm a second time.
That is the cruelty of this scam. There is no break-in to detect and no alert to miss: the victim is a consenting participant in a transaction they did not understand.
How scammers get you to sign one
Nobody approves a random contract for no reason, so the work of the scam is manufacturing a situation where signing feels like the obvious next step. A handful of setups do most of the damage:
The airdrop you have to claim
A message says tokens are waiting for you. The claim page asks you to connect a wallet and confirm one transaction. That confirmation is the approval. Free money is the cheapest bait there is, because it puts you in a hurry.
A cloned app or phishing front-end
A pixel-accurate copy of a well-known exchange, bridge or NFT marketplace, pushed at you through search ads or a group chat. Every button behaves as expected; the only difference from the real site is what the signature request authorizes.
Fake support and account unlocking
Someone posing as official support tells you your account is flagged and your wallet needs verifying, then walks you through the signature step by step. Real support never asks you to sign anything to prove who you are.
Staking and yield bait
Guaranteed returns, a mining pool, an early access vault. The approval gets framed as the first step in earning, which reframes a security decision as an opportunity you might miss.
Notice what they share: each one builds a reason why you must sign something before you can continue. Once you treat a signature request with the same seriousness as sending money, most of these lose their grip. The airdrop version is common enough to have its own page: fake airdrops and wallet-approval theft.
The two deepest traps: unlimited allowances and Permit signatures
Not every approval carries the same weight. Two variants account for most of the serious losses, and both are easy to wave through because neither looks like a transfer:
| What you are asked to sign | What it actually grants | Exposure |
|---|---|---|
| An approval with a specific amount | The contract may move that token, but only up to the amount shown | Capped. Worst case you lose the amount you approved, not the balance |
| An unlimited approval | The contract may move that token with no ceiling, for as long as the allowance stands | Open-ended. It covers tokens you have not received yet |
| A Permit or Permit2 signature, off-chain | The same permission, granted by signing a message instead of sending a transaction | Open-ended, and quieter. It costs no network fee and may raise no obvious warning |
Wording and warnings differ between wallets; the distinction does not — an approval is a permission with a ceiling, and the ceiling is what scammers want you to skip past.
The unlimited default deserves special blame. Interfaces preselect it so you never have to approve the same token twice, which is convenient right up until the contract is hostile. Then unlimited means exactly what it says: whatever is in the wallet, and whatever arrives later, is fair game.
Permit signatures are the subtler half. Instead of an on-chain approval you could later spot in a block explorer, a phishing page asks you to sign a plain message that can look like a login or a terms acceptance, and that some wallets render as an unreadable blob of data. The effect is identical to an approval, and drainers lean on it precisely because it does not feel like signing a transaction. If you cannot read what a signature says, that alone is reason enough to reject it.
Three questions before any signature
Ask yourself: which contract am I approving, which token does it cover, and is the amount capped or unlimited? If you cannot answer all three from the request in front of you, close it. A request you cannot read is a request you cannot judge.
How a drainer empties a wallet in seconds
Once the signature is in, there is usually no human on the other end. What takes over is a drainer: automated software, often rented as a service, that watches the addresses it holds permissions on and executes the moment it is worth executing. It can enumerate what you hold, rank it by value, and pull the most valuable positions first, in a single block.
This is why the reassuring silence after signing means nothing. Plenty of victims sign, see no change, and conclude the scare was overblown. The drainer is simply waiting for the balance to be worth the network fee, or for the next payday deposit, or for the token to appreciate. An allowance does not expire on its own. It sits there until removed, so a risk you took months ago is still live today.
Security firms that publish incident round-ups consistently place approval and signature phishing among the costliest categories of crypto loss. The reason is structural: one phishing page collects signatures from any number of wallets, and the drainer harvests them on its own schedule.
Nothing happened is not the same as nothing is wrong
If you suspect you signed something you should not have, the absence of a theft is not evidence of safety: it usually means the allowance is still standing, unused. Treat it as an open door and close it.
Prevention: check before you sign, revoke on a schedule
However sophisticated the attacker side gets, this scam still depends on one thing you control: your finger on the confirm button. The habits below close that gap.
- Read the request line by line before confirming. Which contract, which token, what ceiling. Modern wallets show all three, and many simulate the outcome for you. If the summary is blank, unreadable or does not match what you thought you were doing, reject it and start again from a link you trust.
- Prefer a capped amount over unlimited. When the interface lets you edit the allowance, set it to roughly what this transaction needs. You will approve more often, and that is the point: a bounded permission cannot cost more than its bound.
- Revoke old allowances periodically. Open the approval or permissions manager built into your wallet app, review what is still standing on each chain, and remove anything you do not actively use — especially after claiming an airdrop or connecting to an app for the first time. If you cannot find the screen, get the steps from your wallet vendor's own documentation, not from a search result: fake revoke pages are a well-worn trap in their own right.
- Split hot from cold. Keep a small everyday wallet for connecting to apps, and hold anything substantial in a separate address that never touches a front-end. A drainer can only take what the signing wallet holds, which caps your worst day.
- Never connect a wallet from an inbound link. Reach apps through a bookmark or the project's official channels, not a direct message, a group post or an ad. Cloning the front-end is the first move in most of these, so the cloned phishing sites and fake exchanges playbook is worth reading alongside this one.
- When in doubt, slow down and check. If a platform or a contract feels off but you cannot say why, run it through our scam self-check tool before you connect anything.
The one-line rule
Approval theft needs a signature you did not read. Read the request, cap the amount, and clear out permissions you no longer use — and there is nothing left for a drainer to work with.
Already signed, already drained — what now
If you think you signed something malicious, or you can already see funds leaving, the useful thing is to act in order rather than fast. Panic is what the second wave feeds on.
1 · Revoke the allowance first
Go to the approval manager in your wallet, find the contract in question, and revoke it. This is the tourniquet: until the permission is gone, everything that lands in that wallet stays reachable.
2 · Move what is left
Transfer the remaining assets to a newly created wallet with a fresh seed phrase, not to another address you already use. Treat the compromised address as burnt and stop routing anything through it.
3 · Preserve the evidence
Save the transaction hashes, the malicious contract address, the amounts and the page or message that led you there. You need this for any report, and to reconstruct the timeline later.
4 · Refuse the recovery offer
Someone will contact you promising to reverse the transfer or unfreeze the funds, usually for an upfront fee. This is almost always the follow-up scam, and it preys on people who have just lost money. See USDT recovery and unfreeze scams.
Where reporting is realistic, take your evidence to the fraud authority in your country, not to a stranger in your inbox. The full sequence of evidence gathering, damage limitation and reporting is set out in what to do after you've been scammed.
FAQ
I only tapped approve and signed something, I never sent a transfer. How did my tokens disappear?
That is exactly the point. On-chain, an approval is an action in its own right: it hands a smart contract a standing permit to move a specific token out of your wallet. The scammer never needed you to send anything, only to sign that one approval. Once it is signed, and especially if the allowance is unlimited, the contract can pull that token out at any moment without asking you again. So your seed phrase can be intact, you can have sent nothing yourself, and the balance can still go to zero, because you handed over the key yourself.
How do I find out which contracts I have approved, and how do I cancel them?
Most major wallets now include an approval or permissions manager in the app itself, usually under security or settings. Open it and you get a list, chain by chain, of the contracts holding an allowance on your tokens. Work down that list from riskiest to least risky and revoke anything you do not recognize or no longer use. Revoking is an on-chain transaction, so it costs network fees. If you cannot find the screen, look up the steps in your wallet vendor's official documentation rather than searching for a revoke site, because lookalike revoke pages are themselves a common phishing trap. Make it a routine after claiming an airdrop or connecting to an unfamiliar app.
I use a hardware wallet. Does that make me immune to approval theft?
No. A hardware wallet keeps your private key from ever leaving the device, which defeats key theft, but it cannot judge what you are signing. If you connect it to a malicious app and confirm the approval on the device screen yourself, the contract receives a valid permit and the tokens leave anyway. The key never leaked and the loss still happened, because the transfer was authorized. Cold storage protects you against a stolen key, not against an approval you signed on purpose, so reading the request before you confirm still matters.
My wallet has already been drained through an approval. Can the tokens be recovered?
Be wary of anyone who promises a certain outcome either way. A confirmed on-chain transfer cannot be reversed by a wallet or by the chain, so what has already moved is usually gone, and whoever contacts you offering guaranteed recovery for a fee is almost always running a follow-up scam. What is worth doing right now is revoking the remaining allowance held by that contract, so it cannot take whatever you deposit later or whatever it has not moved yet. Then move what is left to a brand new wallet with a fresh seed phrase, and keep screenshots and transaction hashes in case you file a report.
any trading-fee discount is up to 20%, with the actual rate and eligibility subject to current OKX terms.
How fake airdrops talk you into approving
Read next
- Fake airdrops & wallet-approval theft — the single most common route to a malicious approval, taken apart step by step.
- Cloned phishing sites & fake exchanges — the front-ends that serve those signature requests in the first place.
- Address poisoning — the other way a wallet loses money with no key stolen.
- What to do after you've been scammed — evidence, loss-stopping and reporting, covered in full.