Don't Get Drained: The Approval Scam You'll Meet in Your First Week
Learn how approval-drain scams work and the one simple rule that keeps your wallet safe from them.
The fastest way to lose everything in crypto
You connect your wallet to a site. You sign a transaction. Ten seconds later, every token you own is gone — swapped, transferred, sent to an address you've never seen.
No password was stolen. No seed phrase was leaked. You gave them permission. That's the approval-drain scam, and it's the most common beginner trap in memecoin trading.
How the scam works
Every token you hold on Solana or EVM is protected by something called an approval — a permission you grant to a smart contract that allows it to move that specific token on your behalf. When you trade on a legitimate platform like GMGN, you approve only the exact token you're swapping, and only for that transaction.
Drainers abuse this system. They ask you to approve a token — often a fake "claim rewards" or "verify wallet" prompt — but the approval is for all of your tokens, and the permission doesn't expire. Once signed, the attacker can drain every token you hold via that contract, instantly or over time.
The one rule that protects you
Never sign a transaction you cannot read. This is not a slogan. It is the single most effective defense against drains.
Before you tap "Confirm" in your wallet, look at what you are signing:
- On Solana (Phantom, Backpack): The popup shows a list of token accounts being approved. If you see more than one token, or if the approval says "unlimited" or "max," stop. Legitimate swaps approve only the token you are trading.
- On EVM (MetaMask, Rabby): The approval shows the spender address and the amount. If the amount says "unlimited" or a number that looks like a random huge integer, that's a drainer. A real swap will show exactly the amount you're trading, nothing more.
Never sign blind. Do not rush. If the transaction details are empty, garbled, or ask for permissions you don't understand, close the tab.
Other red flags to watch for
- Fake verification prompts. A site that asks you to "verify wallet" to "claim" a fake airdrop is almost certainly a drainer. Real platforms never ask for an approval to verify your address.
- Popups that open outside the main dApp. Many drainers open a separate browser window that looks like your wallet's approval screen but is actually a phishing page. Always check the URL.
- Contracts with no code or unknown names. On GMGN, you can hover over the token contract address to see its label. If it says "Unknown" or is a fresh deploy with no interaction history, treat it with extreme suspicion.
- Pressure tactics. "Claim now or lose it." "Only 10 spots left." Scammers create urgency so you skip reading. Real opportunities don't expire in 30 seconds.
What to do if you already approved a drainer
If you realize you signed a malicious approval:
- Revoke immediately. Use a revoke tool (like the one built into your wallet or on GMGN's token approval page) to cancel the permission. This removes the scammer's ability to move your tokens.
- Move your remaining tokens to a fresh wallet. Even after revoking, some drainers use secondary contracts. Transfer your assets to a new wallet that has never interacted with the scam site.
- Do not interact with the scammer. They may send you a "refund" NFT or message asking you to visit another site. That's a second drain attempt.
The mindset that keeps you safe
Memecoin trading is high risk. Most tokens go to zero. The worst outcome, however, is not losing money on a trade — it's losing everything because you signed the wrong transaction.
Treat every wallet connection like a stranger asking for your keys. If the site doesn't feel right, if the prompt looks weird, if you're being rushed — walk away. There will always be another token. There won't always be another chance to recover your stolen funds.
Read every signature. Every time. No exceptions.