Wallet Drainers and Token Approvals: How Wallets Actually Get Emptied
Most stolen crypto is not stolen by breaking cryptography. It is signed away by the owner. Here is what the signature does and how to avoid giving it.
Last reviewed 2026-09-14
The mechanism
To let a decentralised exchange trade your tokens, you grant it an approval — permission for that contract to move a specific token from your address. The approval is unlimited by default in most interfaces, and it does not expire.
That is the whole attack. A malicious site asks for an approval that looks routine, you sign it, and the contract drains that token whenever it chooses. Your seed phrase was never involved. The cryptography was never broken. You authorised it.
What the dangerous signatures look like
approve with an unlimited amount. Standard practice on legitimate DEXs, which is exactly why it does not look alarming. Grant it only to contracts you actually intend to trade with.
increaseAllowance. The same thing under a different name.
Permit / Permit2 signatures. These do not appear as transactions at all — they are off-chain signatures, so there is no gas fee to make you pause. A signature request with no gas cost is not automatically safe; it is often the more dangerous kind.
setApprovalForAll. For NFTs. One signature hands over an entire collection.
A blind-signed hex blob. If your wallet cannot decode what you are signing and you do not know precisely why, the answer is no.
Where the requests come from
- Fake airdrop claim pages, usually promoted through hacked social accounts.
- Search advertisements for real protocols, pointing at lookalike domains. Bookmark the real ones.
- Support staff in Discord and Telegram who message first. Real support never does.
- Scam tokens airdropped into your wallet. They appear with an enticing value and a website name. Interacting with them is the trap.
Practical defences
Revoke old approvals. Every approval you granted years ago is still live. Review them periodically at revoke.cash or Etherscan’s token approval checker. It costs gas and it is worth it.
Set a spending cap. MetaMask lets you edit the amount on an approval. Setting it to roughly what you are trading limits the damage to that amount.
Use two wallets. A “hot” wallet holding only what you are actively using, and a separate wallet that never signs anything on a website. Most losses would be survivable with this split alone.
Hardware wallet for the balance you cannot afford to lose. It does not prevent a bad approval — you can sign one on a hardware wallet too — but it does prevent a compromised computer from signing without you.
Read the domain, every time. Drainer sites are typographically near-identical to the real thing.
Nobody legitimate wants your seed phrase
Not support. Not a wallet “migration”. Not a validator. Not a firmware update. There is no situation in which a person or a website needs those twelve or twenty-four words. Anyone asking is stealing from you, without exception.