Wallet Drainers: What You Really Approve When You Confirm, and How to Take It Back

The information provided in this article is for informational purposes only and does not constitute financial advice. Investing in cryptocurrencies carries a high level of risk.

Most emptied wallets were never hacked. Nobody guessed the seed, nobody broke into a device. The owners tapped "confirm" themselves, and in doing so allowed a stranger's contract to move their tokens whenever it likes.

That is the decisive difference from everything you have read about wallet security: a wallet drainer does not need your private key. All it needs is an approval you granted once. It does not expire, it is often unlimited in amount, and it does not show up in your transaction history. It only becomes visible when you go looking for open approvals on purpose.

The key points at a glance

• Token approvals under the ERC-20 standard have no expiry date, because the standard provides for none. How large the approval is set is decided by the application, and many enter a practically unlimited ceiling by default.
• A wallet drainer exploits exactly that: it needs no seed, only a confirmed approval.
• Since EIP-2612 ("Permit"), a signature without a transaction of your own is enough for this. It costs you no gas and does not appear in your history.
• An approval in the sense described here exists only for tokens. That does not make your ETH safe: since EIP-7702, a single signature delegates your address to a stranger's contract, which then moves native ETH as well.
• Old approvals can be revoked individually, through the token approval checker of the relevant block explorer or a revocation tool.
• After an incident the order matters: revoke every approval first, then move what is left into a fresh wallet.

What an approval is and why the wallet drainer needs it

When you swap a token on an exchange, two things happen. First you allow the exchange's contract to take that token out of your wallet. Then it carries out the swap.

Step one is the approval, and it is the operation that actually matters. How high it is set is not prescribed by the ERC-20 standard; the interface you are using decides that. Many enter a ceiling by default that is effectively infinite, so that you do not have to confirm again on your next swap. Convenient, as long as the contract on the other side does what it is supposed to.

The catch: the permission remains in place even if you never visit the site again. Should the contract turn malicious later, or have been malicious from the outset, it can reach in at any moment it chooses. Weeks later, long after it has left your mind.

A wallet drainer is therefore not a burglary tool but a form. It gets you to hand over the permission voluntarily.

The wallet drainer via the signature: invisible and free

Until a few years ago an approval was always a transaction. It cost fees, appeared in the history and was verifiable afterwards.

The EIP-2612 standard changed that. A "permit" approval is signed off chain: you sign a message, and the other side submits that signature itself later. For you that means no fee, no entry in the transaction history, and no sense of having just done something consequential.

That is exactly why the signature request is the more dangerous of the two. A transaction looks like a decision. A signature looks like a login.

A permit signature does carry a time limit, the deadline field. That protects less than it sounds: the value can be set freely, and the specification itself notes the option of setting it so that the signature practically never lapses. Above all, the limit only bounds how long the signature can be submitted; the approval that results from it is an ordinary open-ended one afterwards.

How to recognise an approval: not by the absence of a gas amount. A harmless login is also signed free of charge. What matters is the content of the message, which any serious wallet can expand for you.

• A pure login names the domain, your address, a random number and a timestamp. Nothing else.
• A disposal names a recipient (spender), an amount (value) and a limit (deadline), or carries a message type such as Permit, PermitSingle or PermitBatch.

When in doubt, cancel. A genuine login can be repeated without risk.

Spotting a wallet drainer: the three questions before you confirm

Before you confirm, answer three questions. Together they cost twenty seconds.

1. Did I open this site myself? Almost every drainer reaches its victim through a link, from a direct message, a comment under a post, a search ad. Type the address in yourself and half the category never touches you.
2. Does the action match what I set out to do? You wanted to mint an NFT, but the window is asking for a token approval? Then something is wrong.
3. What does the detail section say? Any serious wallet will show on request which contract is getting which permission. An unlimited amount for a contract you do not know is a reason to cancel.

A hardware wallet helps further here, because it shows the content on its own display, and no malware on the computer reaches that display. Which wallets break approvals down intelligibly at all varies a great deal; our comparison of software wallets goes into it.

Locking the wallet drainer out: checking and revoking old approvals

What you once allowed, you can take back. It simply does not happen by itself.

Every major block explorer runs a token approval checker for this: enter your address and you see every open approval with contract, token and amount. Alongside them there are specialised revocation services that show the same across several chains.

In practice:

• Revoking costs gas. It is a transaction on the chain in question. With many old approvals it pays to do it in one batch at a moment when fees are low.
• Each chain separately. Approvals on Arbitrum are not visible on Ethereum and the other way round.
• Twice a year is enough as a routine. More important is doing it after every encounter with a new application.

Anyone working regularly with new applications is better off separating things straight away: one wallet for holdings, a second for anything experimental. Whatever sits in the second one is the maximum damage.

If it has happened: the order decides

If you notice tokens disappearing, the order is not arbitrary. Transfer first and you may be transferring into a wallet whose approvals are still open.

1. Revoke every approval, starting with the highest-value tokens.
2. Check whether your address is delegated to a stranger's contract (EIP-7702) and reset the delegation. Revoking approvals is not enough here: a delegation reaches native ETH as well. In the block explorer you recognise it by code being stored under your address.
3. Disconnect from every application.
4. Only then move the remaining holdings into a newly generated wallet, not into an existing one.
5. If the seed itself is compromised, no revocation helps. The wallet is then lost as a whole and only moving out fast still counts.

And as with every report of a loss: anyone offering to retrieve your coins for an advance payment is part of the problem. These offers seek out their victims deliberately under posts by people who have been hit.

The second scheme aimed at the same good faith consists of forged requests from the exchange to move funds "to safety". How to take those apart is set out in our guide to phishing messages after the MiCA cut-off.

Frequently asked questions

Can a wallet drainer steal my seed? No. It works exclusively with permissions you granted. That is why better storage of the backup is no defence against it, only attention at the moment of confirming.

Is my ETH safe if I hold no tokens? Not automatically. There is no approval for ETH in the sense described here, but since EIP-7702 a single signature can delegate your address to a stranger's contract. The specification itself warns that a poorly built delegate could give an attacker near-complete control over the address, and that includes the balance.

Is my Bitcoin affected? Bitcoin itself does not have the construct of a standing approval. Two qualifications belong with that: tokenised Bitcoin on Ethereum, such as WBTC or cbBTC, is an entirely ordinary token and fully affected. And on Bitcoin too there are blindly signed transactions on trading venues where the other side inserts the recipients afterwards.

Why do I not see the approval in my transaction history? Because a permit approval is signed off chain. It appears only when the other side submits it, and then as their transaction, not yours.

Is deleting the wallet app enough? No. The approval sits on the blockchain, not in the app. It remains in place whatever software you use.

Is an unlimited approval always wrong? Not necessarily. With an application you use daily it saves fees. What is wrong is granting it and then forgetting it.

Sources

• Ethereum Improvement Proposals: EIP-20 – Token Standard (approvals without an expiry mechanism)
• Ethereum Improvement Proposals: ERC-2612 – Permit Extension for EIP-20 Signed Approvals (off-chain signature, deadline)
• Ethereum Improvement Proposals: EIP-7702 – Set EOA account code (security considerations on delegation)
• Ledger Academy: Ethereum Token Approvals Explained