← Back to Blog

Approval phishing in crypto: how signature drainers work

By Al Jobson · 10 min read · September 2026

Approval phishing does not steal your keys. It gets you to hand over the right to spend your tokens, then does it later. Scam Sniffer counted $494 million drained from about 332,000 addresses in 2024 through signature-based scams alone, a 67 percent jump over the prior year^[1]. Almost none of those victims lost a seed phrase. Almost all of them clicked "Sign" on something they did not understand.

The primitive: allowances

ERC-20 tokens do not know who is allowed to move them. That job is delegated to a small piece of state called an allowance. When you approve a decentralized exchange to swap 100 USDC for you, you call approve(spender, 100) on the USDC contract and it records that the exchange contract can move up to 100 USDC out of your address. When the trade fires, the exchange calls transferFrom(you, buyer, 100) and the allowance is spent^[2].

It saved gas and made composable DeFi possible. It also left behind a persistent grant that survives long after the transaction that created it. If the spender turns hostile, or if the approved amount was type(uint256).max (an infinity approval, still the default in many wallets and dApps), the whole balance sits exposed until someone revokes it^[3].

Every attack in this article ends the same way: some contract you signed something for calls transferFrom and empties the token.

Four flavours of the attack

Each step moved from cheap and visible (approve) to gasless and opaque (permit, Permit2). The honest UX got faster; the phishing UX got worse. A permit signature costs $0 to produce, never appears on-chain until the attacker submits it, and stays invisible to block explorers until the drain fires. That is why 2023 and 2024 signature-phishing losses kept climbing even as fake-token airdrops fell off.

The playbook

A modern drainer kit sold on Telegram runs the same sequence every time^[7]:

1. Lookalike site. A clone of a well-known dApp, staking dashboard, airdrop claim page, or NFT mint. Usually served from a homoglyph domain (paraded as uniswap-io.com, opeensea.io) or promoted through a compromised X account.
2. Wallet connect. The site prompts for a wallet connection. This step reveals your address and token holdings to the attacker's backend. Nothing has been signed yet.
3. Scan and pick the fattest target. The backend enumerates your token balances. The drainer chooses the token or NFT with the highest USD value that matches its list of drainable assets.
4. Craft the ask. A signature request. If the target is a fungible token with EIP-2612 support (USDC, DAI, most modern tokens), it is a permit. If the wallet supports Permit2 for the chain, it is a Permit2 batch. If it is an NFT collection, it is setApprovalForAll. Rarely, it is a straight transferFrom that requires an existing infinite approval, which many wallets already have.
5. Cash out. An attacker address submits the signature and pays the gas. Funds move into a laundering path, usually Tornado Cash or a chain of freshly created addresses, within one block of the drain.

The whole sequence takes under two minutes from connect to drain. The victim gets one signature prompt. Everything else happens off-screen.

Scale, 2023 to 2025

Chainalysis and Elliptic both flag approval phishing as the fastest-growing crypto-theft category, ahead of exchange hacks and DeFi exploits in 2024 by loss volume^[9][10]. The FBI's IC3 attributed the majority of retail crypto losses to signed-transaction fraud in its 2023 and 2024 annual reports^[11].

Why the wallet UI keeps losing

A drainer's signature prompt looks legitimate because the wallet UI has no idea what the signature means. Every wallet shows the same generic text ("Sign this message from example.com") for any EIP-712 typed payload it does not recognize. Faced with an opaque struct, the user either signs or gives up and misses the airdrop. Most sign.

Three specific UI failures compound:

• No default simulation. Only a handful of wallets ship transaction simulation by default. Most require an extension (Wallet Guard, Blockaid, Fire) or a manual toggle. If the wallet does not compute the state change before signing, the user cannot see that the drainer is about to move 10,000 USDC.
• Infinite approvals as default. Uniswap, PancakeSwap, and most first-generation DEXes default to type(uint256).max approvals to save gas on future trades. This leaves an open door for years after the trade is done^[3].
• Permit and Permit2 shown as "Sign message". A permit is not a message. It is an off-chain authorization that becomes an on-chain drain when the attacker submits it. The wallet's "Sign message" label is technically true and practically dangerous.

Defenses that work in 2026

Wallet-by-wallet, in one table

Practical guidance

• Audit approvals monthly. Go to revoke.cash, connect the wallet in read-only mode first, and revoke anything you do not actively use. Aim for zero infinite approvals older than 30 days.
• Refuse infinite approvals on new tokens. When a dApp asks for type(uint256).max, either edit the amount to the exact trade size or use a wallet that does it for you.
• Never sign a "message" you cannot read. If the payload is a struct of hex, treat it as hostile. Copy the domain and check it against Blockaid or Scam Sniffer's public feed before doing anything else.
• Separate hot and cold. The wallet you connect to random dApps should hold spending money only. A drainer that hits a $200 hot wallet is annoying; one that hits your holdings is life-changing.
• Use a wallet with default simulation. The list above narrows it. If your current wallet does not, install an extension that does or switch.
• Watch for the specific tell. The dApp prompts a "gasless" signature to "verify your wallet" before letting you claim an airdrop, mint an NFT, or restake. There is no legitimate need for that signature. It is the drainer.

What the industry still needs to fix

ERC-20 approvals are a 10-year-old design that assumed the honest case would dominate. That stopped being true around the time DeFi crossed $50B TVL. Fixes exist. They ship slowly.

• Time-bounded approvals as a token standard. Permit2 has this per-token but requires opt-in at the spender side. A token-level default would help.
• Session keys via ERC-4337. Grant a dApp a scoped, time-limited signing key rather than a persistent allowance. Uniswap V4 and Safe are moving in this direction^[17].
• Wallet-level clear signing for every EIP-712 struct. Ledger's Clear Signing initiative is the right idea; making it mandatory across all mobile and hardware wallets closes the "opaque message" gap^[16].
• Public infrastructure for drainer detection. Blockaid and Scam Sniffer maintain useful feeds; a shared, open feed would compound faster^[14].

Bottom line

Approval phishing is now the single largest loss vector in retail self-custody. It works because ERC-20 allowances are opaque, because permit and Permit2 look like harmless messages, and because most wallets ship a UI that cannot tell users what they are signing. The fixes are all client-side: default simulation, bounded approvals, human-readable permit parsing, and a monthly approval audit. Every one of those is available in production wallets today. Use them.

Sources

1. Scam Sniffer, "2024 Wallet Drainers Report." drainer.io
2. ERC-20 Token Standard, EIP-20. eips.ethereum.org
3. OpenZeppelin, "Infinite approvals and their risk." blog.openzeppelin.com
4. EIP-2612, "permit, ERC-20 Approval via secp256k1 signatures." eips.ethereum.org
5. Uniswap Labs, "Permit2 documentation." docs.uniswap.org
6. EIP-721, "Non-Fungible Token Standard." eips.ethereum.org
7. SlowMist, "Anatomy of a wallet drainer kit." slowmist.medium.com
8. PeckShield alert stream, Aug 2024 $69M drain. x.com/peckshieldalert
9. Chainalysis, "2025 Crypto Crime Report." chainalysis.com
10. Elliptic, "Signature phishing analysis." elliptic.co
11. FBI IC3, "Cryptocurrency Fraud Report 2023." ic3.gov
12. Blockaid, transaction simulation. blockaid.io
13. Rabby wallet, security features. rabby.io
14. Scam Sniffer, drainer feed. scamsniffer.io
15. Revoke.cash, allowance dashboard. revoke.cash
16. Ledger, "Clear Signing initiative." ledger.com
17. EIP-4337, "Account Abstraction using entry point." eips.ethereum.org
18. MetaMask, "Blockaid integration announcement." consensys.io
19. Trail of Bits, "Permit and Permit2 threat model." blog.trailofbits.com
20. CertiK, "Approval phishing case studies." certik.com
21. TRM Labs, "2025 Crypto Crime Mid-Year." trmlabs.com
22. Wallet Guard, phishing signature detection. walletguard.app
23. Etherscan Token Approvals. etherscan.io
24. Safe, session keys documentation. docs.safe.global

Al Socrates Jobson, Co-Founder and CTO, Veyrnox LTD · ← Back to Blog