Wallet drainers and token approvals: how they work and what to do

Approvals: permission now, transfer later

Token standards separate permission from movement. An approval transaction grants a specified contract the right to move a specified amount of a specified token from your wallet, at any point in the future, without asking again. Legitimate applications need this to function — a decentralised exchange cannot swap your tokens without it.

The abuse is in the amount. Many interfaces request an unlimited allowance by default so the user is not prompted repeatedly. A malicious contract requests the same thing, and once granted, it can empty that token balance whenever it chooses. The delay is deliberate: it separates the drain from the signature in the victim's memory.

Signature requests that are not transactions

Not every wallet prompt costs gas. Off-chain signature schemes let you sign a structured message that a contract will accept later. Wallets often display these as harmless verification requests, which is precisely why drainers favour them: the prompt looks like a login, and the signed message authorises a transfer.

The practical rule is that a signature request you do not fully understand should be rejected. There is no cost to declining and no way to revoke a signature once it has been given away.

How victims usually arrive at the page

• An airdrop or mint page promoted through a compromised or impersonated social account.
• A search advertisement for a well-known protocol pointing at a near-identical lookalike domain.
• A support 'validation' or 'wallet sync' page shared in a Discord or Telegram direct message.
• A QR code or link that pre-fills a connection request on mobile, where the prompt shows far less detail than on desktop.

Checking and revoking what you have approved

Every approval you have ever granted is public and permanent until revoked. Approval management tools built into major wallets and available from established explorers list them per network. Review each one and revoke anything you do not recognise or no longer use.

• Revocation is an on-chain transaction and costs gas — one per token, per contract, per network.
• Check every network you have used, not just the one where the loss occurred.
• Revoking does not reverse a transfer that has already happened; it only prevents further ones.
• If a seed phrase or private key was exposed, revocation is not enough — move remaining assets to a wallet generated from a new seed.

If it has already happened

• Move any remaining assets to a fresh wallet first, before doing anything else.
• Record the transaction hash of the drain, the address that received the funds, and the approval transaction if you can find it.
• Save the URL of the site you connected to, and screenshot it if it is still live.
• Report to your national fraud body and obtain a reference number.
• Do not respond to anyone who contacts you offering to reverse the transaction — it cannot be reversed, and second-stage approaches are common.

What tracing can and cannot add

Drainer proceeds are usually consolidated quickly into a small number of collection addresses shared across many victims. That consolidation is useful: it shows scale, links your loss to a wider operation, and often terminates at a recognisable service deposit address. Documenting that is what makes a report actionable for a bank, an exchange compliance team or the authorities.

What tracing cannot do is identify the operator from on-chain data alone, or undo the transfer. Anyone claiming either is not describing forensics.