Wallet Drainers and Approval Phishing: How They Work
Wallet drainers do not steal your keys, they get you to sign an approval. How token approvals, permit signatures and setApprovalForAll are abused, how to read a signature request, and how to revoke.
Last updated: 28 July 2026
The most common way experienced crypto users lose funds has nothing to do with stolen private keys. Their security is fine. Their seed phrase never left paper. They simply signed something, and a contract they had never heard of moved their tokens out an hour later.
This is approval phishing, and the tooling built around it is called a wallet drainer. Understanding it requires understanding one mechanic that most people use daily without examining: the token approval.
Why approvals exist
Token standards separate holding from spending. To let a decentralised exchange swap your USDC, you first grant its contract permission to move USDC from your wallet. That grant is an approval, and it is a separate transaction from the swap itself. It is why interacting with a new protocol usually takes two signatures rather than one.
This design is sensible and unavoidable. It has two properties that make it dangerous:
- Approvals are often unlimited. For convenience, most interfaces request permission for an effectively infinite amount, so you never have to approve again.
- Approvals persist. The permission remains until you explicitly revoke it. A protocol you used once in 2023 may still be able to move that token today.
A drainer exploits both. It does not need your key; it needs one signature granting it spending rights, after which it can take the approved token whenever it chooses.
The signature types being abused
| What you sign | What it grants | Risk |
|---|---|---|
approve | Permission to spend one token, often unlimited | That token can be taken at any time |
permit / permit2 | The same, via an off-chain signature | High: costs no gas, so nothing looks like a transaction |
setApprovalForAll | Control of an entire NFT collection | Every NFT in that collection at once |
increaseAllowance | Raises an existing spending limit | Often overlooked as routine |
| Ownership or delegation transfer | Control of an account or its voting power | Severe, chain-dependent |
The permit family deserves particular attention. Because it is an off-chain signature, there is no gas fee and no pending transaction. Nothing about the interaction feels like moving money, which is exactly why it has become the preferred vector.
How you get to the malicious page
The signature is the mechanism; the traffic is the business. The recurring delivery routes:
- Fake airdrops. A token appears in your wallet with a website in its name or metadata. Claiming it requires a signature.
- Compromised official channels. A project's own social account or Discord is taken over and posts a mint link. The account is genuine, which defeats the usual checks.
- Search and paid ads. Sponsored results for popular protocol names pointing at cloned front ends.
- "Your wallet is at risk, migrate now." Fear framing that inverts the victim's caution into compliance.
- Fake support. Anyone who replies to a public help request offering to assist is hostile by default.
- Malicious NFTs. Airdropped assets whose marketplace listing or transfer flow routes through an approval prompt.
How to read a signature request
Wallets have improved considerably at translating requests into plain language. The discipline is to actually read the translation.
- Identify the action. Is this a swap, a deposit, or a permission grant? If the words "approve", "permit" or "allowance" appear when you expected to be depositing, stop.
- Check the spender. Which address is receiving permission? It should be the protocol's contract. If your wallet or a simulation tool flags it as unverified, stop.
- Check the amount. Unlimited approval to a protocol you are trying for the first time is not necessary. Most wallets allow you to edit the figure to what you are actually depositing.
- Be most careful when there is no gas fee. A gasless signature request is the highest-risk category, not the lowest.
- Use simulation. Wallets that preview net balance changes catch drainers reliably, because the preview shows assets leaving with nothing returning.
- Verify the URL from your own bookmark. Not from a search result, an advertisement or a message.
Revoking old approvals
Every protocol you have ever used likely still holds an approval. Auditing and revoking them is a short piece of maintenance with a large effect: it removes permissions that a compromised contract could later use.
Do it periodically, and immediately if you suspect you signed something you should not have. Revoking costs a transaction fee per approval, so prioritise: large balances first, then unlimited approvals, then anything granted to a protocol you no longer use or that no longer exists. Note that revocation is chain-specific, so an audit on one network says nothing about your positions on another.
If you have already signed
- Move remaining assets first. Send anything not yet taken to a newly created wallet. Do this before attempting revocation; a drainer may be watching and will race you.
- Then revoke the approval on the compromised wallet.
- Treat the wallet as permanently untrusted. Retire it rather than reusing it.
- Record the transaction hashes and report to your national fraud body.
- Refuse every recovery offer that follows. They will arrive quickly. See crypto recovery scams.
The structural defence: wallet separation
Behavioural vigilance fails eventually. Everyone eventually signs while tired or distracted. The defence that survives that is architectural: use separate wallets so no single mistake can reach everything.
- Vault wallet: hardware-backed, long-term holdings, never connected to a decentralised application.
- Active wallet: holds only capital currently deployed in protocols you have used before.
- Burner wallet: for mints, airdrops and anything unfamiliar, funded only with what you would accept losing.
This is the single highest-value change most users can make, and it converts a catastrophic outcome into an annoying one. Our self-custody guide covers the wider setup.
Using DeFi without accumulating risk
Interacting with legitimate protocols still requires approvals, so the goal is not avoidance but hygiene. Approve what you are depositing rather than an unlimited amount, reach applications through bookmarks you created yourself, and keep protocol activity in the active wallet.
JewelSwap is non-custodial across MultiversX, Sui and Radix, meaning assets stay in wallets users control. That property protects against a company failing; it does not protect against a signature the user authorised. Institutionally, this is the same problem blockchain analytics firms such as Crystal Intelligence work on from the other end, tracing drained funds and flagging the addresses that receive them.
Frequently asked questions
What is a wallet drainer?
A wallet drainer is malicious software, usually behind a convincing website, designed to obtain a signature that grants it permission to move your tokens. It does not steal private keys. Once approved, it transfers the assets, often minutes or days later.
What is approval phishing?
Approval phishing tricks a user into signing a token approval or permit signature that authorises an attacker's contract to spend their tokens. Because approvals are a normal part of using DeFi, the request looks routine, which is precisely what makes the attack effective.
Can someone drain my wallet without me signing anything?
Not through approval phishing, which requires your signature. Funds can be taken without a signature only if your private key or seed phrase has been compromised, or through a vulnerability in a contract you already interact with.
Why is a gasless signature more dangerous?
Permit-style signatures happen off-chain, so there is no fee and no pending transaction to review. The interaction feels weightless and unlike moving money, while granting the same spending rights as an on-chain approval.
How often should I revoke token approvals?
Audit periodically, and always after using an unfamiliar application. Prioritise unlimited approvals, wallets holding large balances, and permissions granted to protocols you no longer use. Revocation is per-chain, so repeat it on each network you are active on.
Does a hardware wallet protect me from drainers?
Partly. It protects the private key, but it will faithfully sign a malicious approval if you confirm one. Its real benefit is forcing you to review the request on a separate screen. Wallet separation, keeping the hardware wallet away from unfamiliar applications, is what actually protects it.
Keep reading
