Don't Get Drained: The Approval Scam Every New Wallet Connects To
Learn how approval-drain scams work and the three rules that keep your wallet safe when connecting to any site.
The Trap That Looks Like A Game
You find a memecoin that's pumping. The website looks clean — tokenomics table, roadmap, a countdown timer. You click "Connect Wallet." A pop-up asks you to sign a transaction. You approve.
A few minutes later, every token in your wallet is gone. No hack. No virus. You gave them permission to take everything.
This is an approval-drain scam. It is the most common way beginners lose money in crypto. It doesn't matter if you are on Solana or Ethereum — the mechanics are the same. Here is how to spot it, avoid it, and keep your wallet safe.
How Approval Drains Work
When you connect your wallet to a decentralized exchange like GMGN, the site asks for a token approval. This is a smart-contract permission that allows that site to move a specific token on your behalf. Legitimate sites ask for exactly the token you want to trade, and only the amount you approve.
Scammers do the opposite. They ask for approval on all your tokens — or they use a malicious contract that can drain any token you hold. The transaction looks like a normal "approve" request, but the underlying code gives them unlimited access.
On Solana, this often comes disguised as a "set account authority" or "delegate" request. On EVM chains, it is usually an ERC-20 approval with a max uint256 value. Either way, once you sign, your funds belong to them.
Three Rules To Never Get Drained
Rule 1: Never approve a connection from a link you didn't seek out
If someone sends you a link in a Telegram group, Discord DM, or Twitter reply — and it leads to a site that asks you to "connect wallet" before showing anything useful — do not connect. Scammers use fake dashboards, fake airdrop claim pages, and fake presale sites. The only way to win is to never play.
Only connect to sites you navigated to yourself, or that are linked from a trusted source you already use. If you are on GMGN to check a chart, you are already on a legitimate site. If someone DM's you a "chart link," assume it is a drainer until proven otherwise.
Rule 2: Read what you are signing
When your wallet asks you to approve a transaction, it shows a preview. On Phantom, Rabby, MetaMask, or any decent wallet, you can see:
- What token is being approved
- How much is being approved (look for "unlimited" or very large numbers)
- Which contract is requesting the approval
If the approval is for a token you don't own, or for an amount that says something like "115792089237316195423570985008687907853269984665640564039457584007913129639935" (the maximum uint256 value), do not sign. That is a drainer.
Most drainers hide behind a pop-up that says "Sign to connect" or "Confirm wallet." They rely on you clicking without reading. Don't be that person.
Rule 3: Use a burner wallet for everything new
Never connect your main holding wallet to a site you don't trust completely. Create a separate wallet — a burner — that holds only what you are willing to lose. Transfer a small amount of SOL or ETH for gas, and keep the rest of your funds in cold storage or a wallet you never connect.
Even experienced traders get fooled. The only defense that works 100% of the time is: the wallet you connect cannot contain anything you cannot afford to lose.
What To Do If You Already Approved A Scam
If you realize you approved a malicious contract, act immediately:
- Revoke the approval. Use a revoke tool like the one built into GMGN's dashboard or a dedicated revoke dApp. Search for "token approval revoker" on your chain. Find the contract you approved and revoke it.
- Move your funds. If you are unsure whether the revoke worked, transfer all tokens to a fresh wallet. Do this before the scammer does.
- Do not interact with the scam site again. Even if you revoke, the site may have other malicious code. Close the tab. Move on.
The Bottom Line
Approval-drain scams work because they exploit speed and trust. Beginners are in a hurry to buy before the next candle. Scammers know this. They build fake sites that look real, and they rely on you clicking "Approve" without thinking.
Every time you connect your wallet, ask yourself: Did I come here on purpose? Do I know what I am signing? Is this wallet disposable?
If the answer to any of those questions is no, disconnect and walk away. The memecoin will still be there — or it won't. Either way, your wallet will still have your money.
Memecoins are extremely high risk and most go to zero. But losing your entire wallet to a drainer is worse than buying a bad coin. Protect yourself first. Trade second.