NEWBIES

Don't Sign That: How Approval-Drain Scams Steal Your Wallet

Approval-drain scams trick you into giving attackers unlimited token spending rights. Here's how they work and how to stop them.

· 5 min read · Blackhat Empire

What Is an Approval-Drain Scam?

An approval-drain scam is a contract that asks you to sign a transaction that grants it unlimited permission to spend a specific token from your wallet. Once you approve, the scammer can drain that token instantly — or wait weeks and do it when you least expect it.

You never "send" them anything. They just take it.

How Beginners Get Tricked

Most victims fall for it when they connect their wallet to a random dApp or Telegram bot. The site looks legit, maybe promises an airdrop, a presale, or a free mint. You click "Connect" and then a wallet prompt appears asking you to approve a spending limit.

Key red flags:

  • The approval requests unlimited spending — often written as unlimited or max for a token like USDC, SOL, or ETH.
  • You don't recognize the dApp or website — it was shared in a Telegram group or DM.
  • The site asks for approval before showing any real content or letting you interact with it.

The Two-Step Trap

Step 1: Connect your wallet to the fake site. This only reveals your public address — harmless.

Step 2: The site asks you to sign an approval transaction. This is the dangerous part. If you sign it, you give the scam contract the right to move your tokens.

Once approved, the scammer can call the transferFrom function and move your tokens to their wallet. No further action from you needed.

How to Spot an Approval-Drain Request

Before you sign anything on your wallet, check these details:

  • Spending cap: If it says "unlimited" or a very large number, stop. Legitimate dApps often ask for small, specific amounts (e.g., the exact cost of the transaction).
  • Contract address: If you're on GMGN, you can check the token contract's approval history. A brand-new contract with no prior transactions is a strong warning sign.
  • dApp reputation: Never connect to a site you found through a random DM or a Telegram group that looks like a pump-and-dump circus. Scammers love those channels.

What to Do If You Already Approved

If you think you've approved a malicious contract, act immediately:

  1. Revoke the approval using a token approval checker. If you're on Solana, you can use GMGN's token approval tool (it's built into the platform). For EVM chains, services like Revoke.cash work.
  2. Move your remaining funds to a new wallet immediately. This is the safest option — even after revoking, some drainers can still exploit other approvals.
  3. Never reuse that wallet for anything important until you've verified no suspicious approvals remain.

How to Stay Safe Going Forward

  • Never sign an approval for an unknown dApp. Always verify the contract address and the dApp's URL.
  • Use a separate "hot" wallet for low-stakes interactions — only keep small amounts there for testing.
  • Set alerts on GMGN for approvals on your wallet address. You'll get notified if a new contract gets permission.
  • Learn the difference between "approve" and "send" — an approval doesn't move tokens, but it gives someone the power to move them later.

One Hard Truth

Memecoins are high risk. Most go to zero. But approval-drain scams don't care about the token's value — they steal whatever you have, including SOL, ETH, USDC, or any token you've approved. Protecting your wallet is more important than chasing the next 100x.

Never sign what you don't understand. If a site asks for unlimited approval, walk away.

Read more: /v2/dyor/reference.html#alerts and /v2/dyor/reference.html#rules