Malicious Token Approval Drain
A malicious dApp or contract tricks you into signing a token approval that gives it unlimited access to drain specific tokens from your wallet.
How This Scam Works
You visit a fake or compromised dApp that asks you to connect your wallet and sign a transaction. The transaction appears to be a normal swap, claim, or mint, but hidden in the approval is an unlimited token spending allowance for a malicious contract address. Once approved, the attacker can drain the approved tokens from your wallet at any time — even days or weeks later. More sophisticated versions use permit signatures (gasless approvals) that don't even show as on-chain transactions until funds are drained.
Red Flags to Watch For
- A dApp asks to approve spending for tokens you're not actively trading
- Approval amount is set to 'unlimited' or an astronomically high number
- The contract address doesn't match known, verified protocol contracts
- Wallet shows a permit or signature request you don't fully understand
- The dApp was shared via DM, ad, or unknown link rather than an official source
- Transaction simulation shows unexpected token movements
Common Phrases Scammers Use
“Approve this transaction to claim your tokens”
“Sign this message to verify your wallet”
“Connect wallet and approve to mint your NFT”
“One-time approval needed for this swap”
What to Do Right Now
- 1Revoke suspicious token approvals immediately using Revoke.cash or Etherscan's token approval checker
- 2Transfer remaining tokens to a new wallet if you suspect compromise
- 3Use a wallet with built-in transaction simulation (like Rabby) to preview approvals
- 4Report the malicious dApp URL to phishing databases
- 5Check your approvals regularly — at least monthly
What NOT to Do
- Do not approve unlimited token spending for unfamiliar contracts
- Do not sign transactions you don't understand — 'reject' is always an option
- Do not interact with dApps shared via unsolicited messages or ads
- Do not assume a dApp is safe just because it has a professional-looking interface
How to Report It
- Revoke.cash — https://revoke.cash (check and revoke approvals)
- Etherscan Token Approval Checker
- Google Safe Browsing Report
- ScamSniffer
Frequently Asked Questions
How common are malicious token approval drain scams?+
Can I get my money back after falling for a malicious token approval drain scam?+
How do I know if a message is legitimate?+
What should I do if someone I know is being targeted by a malicious token approval drain scam?+
This information is for educational awareness only. It does not constitute legal, financial, or professional advice. If you have been the victim of a scam, contact law enforcement and consider consulting a licensed attorney.
Quick Facts
- Severity
- Critical Severity
- Category
- Technical Exploit
- Prevalence
- Very Common
- Who Is Targeted
- DeFi users, NFT collectors, anyone who connects wallets to dApps, airdrop hunters
- Red Flags
- 6 identified
Need Help Now?
If you are being scammed right now, stop all contact and payments immediately.