Terenval Answers · P1 safety · Русская версия

How Do Token Approval Scams Drain Crypto Wallets?

A token-approval scam does not always need your seed phrase. It can trick you into authorizing a spender contract to move a token from your wallet later.

Last reviewed: 2026-10-05.

Key takeaways

• Approval is a permission, not merely a login step.
• An unlimited allowance can remain valid until it is changed or revoked.
• The approval generally applies to a specific token and spender, not automatically every asset.
• Disconnecting the dApp does not erase an on-chain allowance.
• A compromised spender contract can turn an old approval into future risk.

1. The ERC-20 allowance model

ERC-20 defines approve(spender, value), allowance(owner, spender) and transferFrom. This enables legitimate workflows such as DEX swaps where a contract needs permission to pull tokens from the user's account.

The same mechanism becomes dangerous when a user is tricked into granting permission to an attacker-controlled or compromised spender.

2. How the drain happens

A phishing site or malicious dApp can present an approval as part of a claim, swap or verification flow. If the user approves a very high amount, the spender receives durable on-chain permission for that token.

The attacker can then trigger transfers up to the approved amount. A wallet password prompt at the time of the later token movement is not necessarily required because the token contract is honoring the permission that was already signed.

3. What to check before approving

• Exact blockchain network.
• Token contract.
• Spender contract.
• Allowance amount.
• Whether the requested action actually needs an approval.
• Whether the domain and contract match official dApp documentation.

Prefer the smallest practical allowance when the application and wallet support it. Be cautious when a simple claim or verification asks for unlimited spending power.

4. What to do after a suspicious approval

Use a trusted block-explorer approval checker or an independently verified revoke tool on the correct network. Revoke or reduce the allowance with an on-chain transaction and verify the result after confirmation.

If unauthorized transfers have already started or the seed/private key may also be compromised, approval revocation alone may not be enough. A migration to fresh recovery material may be required.

Common mistakes

• Treating Approve as a harmless connection button.
• Signing an unlimited allowance for a one-time action without reading it.
• Disconnecting WalletConnect and assuming the allowance is gone.
• Clicking an unsolicited “revoke your wallet now” link after a scare message.
• Leaving old unlimited approvals indefinitely on high-value accounts.