NEWBIES

Your Wallet Is Not a Login: How to Spot and Stop Approval-Drain Scams

A beginner's guide to the most common wallet-emptying trick in crypto: the malicious token approval, and how to check, revoke, and avoid it.

· 6 min read · Blackhat Empire

The Scam That Doesn't Need Your Seed Phrase

Most beginners think the only way to lose crypto is by leaking their seed phrase. Not true. There's a quieter attack that empties wallets every day, and it works even if you never share a single word of your recovery phrase. It's called an approval drain, and if you connect your wallet to the wrong site, you can hand over access to your tokens without realizing it.

This is beginner-level stuff, but it's the stuff that matters most. Read it once, then read it again.

What an Approval Actually Is

When you interact with a token or a contract, your wallet sometimes asks you to "approve" it. In plain terms, you're telling the contract: this address is allowed to move some of my tokens.

That's normal for legitimate trading. Swapping on a decentralized exchange requires an approval — otherwise the contract couldn't take your token to complete the trade.

The problem is what you approve and how much. A malicious site can ask you to approve unlimited spending of a token. Once you sign, that contract — controlled by the scammer — can move that token out of your wallet whenever it wants. No further signature needed. That's the drain.

How the Trap Is Set

It usually looks like one of these:

  • A token you've never heard of appears in your wallet, and a site or message tells you to "claim" or "unlock" it by connecting your wallet.
  • A fake airdrop page asks you to connect and "verify" to receive free tokens.
  • A copycat site that looks like a real trading platform, with a slightly wrong URL.
  • A direct message from a "support" account offering to fix a problem if you just connect here.

The common thread: you're asked to connect and approve, and something is offered for free. Free is the bait. The approval is the hook.

The Rules That Keep You Safe

Treat these as non-negotiable.

  • Never connect your main wallet to a site you found through a DM, a random token in your wallet, or a comment. If you didn't navigate there yourself, close it.
  • Check the URL character by character. Scam sites copy layouts perfectly and swap one letter. Bookmark the sites you actually use so you never have to search for them.
  • Read the approval request. Your wallet will show what you're approving. If a token you don't care about is asking for unlimited access, stop.
  • Use a burner wallet for anything experimental. Keep the bulk of your funds in a separate wallet that never touches unknown sites.
  • Reject "unlimited" approvals when you can. Some wallets let you set a specific amount. If a site insists on unlimited, that's a signal.
  • No legitimate support person will ever ask you to connect your wallet to help you. Ever.

For a deeper breakdown of the metrics and warning signs worth knowing, see our metrics reference.

How to Check What You've Already Approved

If you've been in crypto for a while, you've probably approved more than you remember. That's normal. What matters is checking.

Most wallets and several reputable tools let you review token approvals — a list of which contracts can spend which of your tokens. Go through it. Anything you don't recognize, anything tied to a site you no longer use, anything asking for unlimited access on a token you hold — revoke it. Revoking costs a small network fee, which is a bargain compared to losing the token entirely.

Do this review periodically, not just after something goes wrong. It's the crypto equivalent of checking your bank statements.

Where Scams Spread Fast

Approval-drain links spread through group chats, fake airdrop announcements, and impersonation accounts. The best defense is being in the right rooms and knowing who's actually posting. Our public groups and alert channels are listed in the channel directory, and you can join the community through the Telegram folder. If someone claiming to be from us DMs you asking to connect a wallet — that's not us. See the alerts reference for how our real channels work, and the rules reference for the baseline.

The Honest Part

Memecoins are extremely high risk. Most go to zero. That's not a warning tacked onto the end — it's the starting condition. An approval drain just makes the loss faster and more complete, and it can hit you even on a coin that was going to moon. Protecting your wallet is the one part of this game fully in your control.

When you're ready to look at charts and do your own research, do it on GMGN: gmgn.uk (or the mirror, gmgn.fr). That's where the on-chain picture lives. But no chart matters if your wallet's already been drained.

Slow down on the connect button. It's the cheapest habit you'll ever build.

Community

Stay connected across the chains:

Charts and on-chain research: https://gmgn.uk.