You click "Claim" on an airdrop page. Your wallet pops up a box full of letters and numbers you can't really read, with a blue "Confirm" button at the bottom. You click it. The page spins for two seconds, says success, and your balance hasn't dropped by a cent. You close the tab and get on with your day. A few days later you open your wallet and one of your tokens is gone. And your seed phrase? You never told anyone, never took a screenshot of it, never pasted it into any chat.
This isn't a seed phrase leak. It's a different way in: token approvals. The "Confirm" you just clicked didn't send your coins anywhere. It agreed that some address "may take this token out of your wallet from now on." Another piece on this site covers how seed phrases and private keys get stolen, which is about losing the key. This one is about the key still being safe in your hand while you've opened the door a crack yourself, and the door stays open.
People who get drained this way aren't stupid. Approvals were never designed to be understood at a glance by ordinary users: one looks exactly like any other confirmation, and nothing moves while you sign. In how crypto "vanishes into thin air", approval phishing gets a single section; here it gets taken apart properly. If you hit an unfamiliar term, keep the glossary open alongside.
- An approval is not a transfer. Not a cent moves when you sign, but from that moment on, the other side can take your tokens whenever it wants.
- Many interfaces ask by default for an allowance you could never use up in a lifetime. Agree once, and it stays valid indefinitely.
- Off-chain signatures, the kind that cost no gas and leave no visible trace in your wallet, are exactly what phishers like best.
- Approvals can be revoked, and revoking is an on-chain transaction that costs gas, though it can't cancel an off-chain signature that hasn't been used yet. To check your approvals, start with your wallet's built-in tool; don't go searching for one.
You clicked "Confirm," and nothing happened
Think back to that moment. The pop-up appears, you glance at it and it makes no sense, but the page says this step is required to claim, so you confirm. Your balance doesn't change, there's no outgoing transfer, maybe a little gas gets deducted, and sometimes not even that. All the feedback you get is "nothing happened." That is exactly what makes it so hard to notice.
What actually happened on-chain: inside a token's contract, a new record appeared under your address. Roughly, it says "address so-and-so may take up to this many of this token from me." That record doesn't disappear when you close the page, doesn't stop working when you switch phones, and has no built-in expiry. It just sits there until you go back and change it yourself.
Approval vs. transfer: where they part ways
A transfer is a one-off: the coins leave now, and once they're gone, that's the end of it. An approval trades one action for an ongoing permission: you hand nothing over right now, but from then on the other side can take whenever it likes.
Here's another way to picture it. A transfer is counting cash out of your wallet and handing it over. An approval is handing someone a card that can charge your account, with the limit printed on it; when they swipe it, and how many times, isn't up to you.
Nobody invented this mechanism as a trap. When you swap on a decentralized exchange, deposit into a pool or list an NFT for sale, the contract has to be able to pull tokens from your wallet at the moment you confirm, and a contract can't just reach in on its own. It needs your approval first. So approvals are a prerequisite for this kind of activity. The malice was never in the mechanism itself; it's in the address that ends up holding the allowance.
| Action | Do coins move when you sign? | On-chain? Costs gas? | What the other side can do afterwards |
|---|---|---|---|
| Ordinary transfer | Sent immediately | On-chain, costs gas | This one is done; no ongoing permission is left behind |
| Token approval (approve) | Nothing moves | On-chain, costs gas | Take this token at any time, up to the allowance |
| Off-chain signature | Nothing moves | Not on-chain, no gas | Depends on what you signed: it can amount to an approval, or even hand over control of several assets at once |
The column to remember is the second one: money not moving doesn't mean nothing happened.
How "unlimited" became the default
An approval contains a number: the most the other side is allowed to take. In theory you'd approve exactly what you're swapping, but many interfaces pre-fill a number so large you'll never hold that much in your life. That's what people call an unlimited approval.
The reason is less sinister than it sounds. Every allowance you set is an on-chain transaction with its own gas fee. Approve the maximum once, and future trades in that app need no new approval and no extra fee, so everything runs more smoothly. The designers chose smooth, and you carry the cost.
The cost is that the record stays live. The project later hands control of the contract to someone else, a bug turns up in the contract, a developer's private key gets stolen: any of these could happen six months from now, long after you've forgotten the site, and the allowance will still recognize you. That's why the approvals most worth clearing first usually aren't the one you signed yesterday, but the ones from last year whose names you can't even recall.
You approve an address, not a website
The domain in the pop-up only tells you who is asking. What gets written on-chain is a contract address starting with 0x. People treat the two as the same thing all the time, but the difference is very real.
The same website can ask you to approve contract A today and contract B tomorrow. If its front-end script gets swapped or its DNS gets hijacked, the address bar looks exactly the same, yet the address you're being asked to approve now belongs to someone else. Turn it around and "I revoked that website's approval" doesn't hold up either: you can only revoke the allowance of a specific address, and one app may use several.
So "I've used this site for six months, it should be fine" isn't evidence. The only evidence is the address in this particular pop-up. To be honest, an ordinary user can't verify whether an unfamiliar address is a malicious contract, and there's no point pretending otherwise. What you can do is something else: don't interact with unknown campaigns for a handful of airdrop tokens; only sign in apps you opened yourself and use regularly; and keep the wallet you connect to websites completely separate from the wallet where your coins are stored. For spotting counterfeit pages themselves, our piece on fake apps and fake support walks through a more detailed set of checks.
Two kinds of signature request, and the gasless one looks the most harmless
What your wallet pops up falls roughly into two kinds. One is a transaction: it costs gas, goes on-chain, and shows up later in your activity history. The other is a message signature, also called an off-chain signature: no gas, nothing on-chain, and usually nothing left in your wallet's activity list.
Phishers love the second kind, because it looks the least like anything is happening. No money spent, no record, and the page says "Sign to verify your identity" or "Confirm you own this wallet," which sounds no different from logging in. But a signature can be an approval voucher: once you sign, the other side submits it on-chain, and the effect is the same as if you'd gone through an approval yourself. Some formats can even hand over control of several assets in one go.
The tell is in the content. A signature that really is just a login is usually short text containing a domain and a random string, with nothing to do with your assets. If you see token names, amounts, allowances, a deadline, or an address you don't recognize, it's more than a login. If you can't understand it, don't sign it. That rule always holds, and there's nothing embarrassing about not understanding.
The lines in a pop-up worth stopping for
You don't need to understand all of it. Keep your eyes on the items below and you'll block a good share of these attempts. Different wallets word things differently, but the meaning doesn't change.
| In the pop-up | What it's really saying | When to stop |
|---|---|---|
| Requesting domain | Who is making the request, which is not necessarily who gets approved | It doesn't match the site you think you opened: close it |
| Approved address (spender) | The contract address that actually receives the permission | It came from a campaign you never went looking for: don't sign yet |
| Token and allowance | Which token, and how much of it, the other side gets control over | You only want to swap a small amount, but the allowance has no cap |
| Action type (approve, setApprovalForAll and the like) | This is an approval, not a transfer. setApprovalForAll has no amount: it covers every NFT you hold in that collection, including ones you get later. | You think you're claiming, but you see an approval action; setApprovalForAll on a claim page is a hard stop. |
| Gas required? | None usually means an off-chain signature | The more "free" a confirmation is, the more carefully you should read it |
| Validity / deadline | A deadline in a signature usually only sets how long the signature can be used; once it's submitted, the allowance it creates normally has no expiry. Only some systems, such as Permit2, put an expiry on the allowance itself. | Don't read a deadline as how long the approval lasts; unless the pop-up says the allowance itself expires, treat it as permanent. |
The pattern we've seen most often isn't someone beaten by sophisticated hacking. It's someone clicking three confirmations in a row during a "claim in three steps" flow: connect wallet, sign, confirm again. The danger isn't in which step it is, but in what each pop-up actually says. Connecting a wallet only lets the page read your address, but the signing step can easily be an off-chain approval, and every row of the table above has to be read on its own. By step three your hand is running on habit, while the page's countdown timer and progress bar keep pushing you. So we suggest breaking the actions apart: every time a wallet pop-up appears, take your hand off the mouse first, and read those few lines before you decide. It sounds a bit clumsy, but it breaks exactly the rhythm the page was built to create.
How to check approvals, and how to revoke them
The good news first: approvals can be revoked. Revoking cancels the approval on-chain: for a token, it sets the allowance back to zero; for an NFT approval made with setApprovalForAll, it switches off access to that whole collection. It's an on-chain transaction in its own right, so it costs gas, and how much depends on the network you're on and how congested it is at the time. Don't believe anyone who offers "one-click free revocation." If gas is new to you, start with what a gas fee is. There is one thing revoking can't reach: an off-chain Permit signature that hasn't been submitted yet. It isn't an approval on-chain, so it won't show up in any approval list, and setting the allowance to zero doesn't cancel it. Whoever holds it can still submit it and the allowance comes right back, until the signature's deadline passes. If you think you've signed one, don't rely on revoking: move your assets to a new address.
A sensible order for checking: start with your wallet's built-in approval manager, which most mainstream wallets now put in their settings or on the token detail screen. If you really can't find one there, use an approval-checking page you already trust. When clearing, start with the chain and token where you hold the most, then clear the apps you no longer use, and finally deal with the ones you can't remember signing at all.
One more thing needs saying plainly: revoking isn't a cure, it's stopping the bleeding. Assets already taken won't come back because you revoked; revoking only stops further withdrawals. If you suspect you're being drained right now, reverse the order: first move what's left to a brand-new address that has never approved anything, then come back and clean up the old address at your own pace. Revoking goes one approval at a time, and the other side only needs to succeed once. For what to do once the damage is done, see got scammed in crypto: can you get the money back?
Habits that narrow the gap
No set of habits makes you "completely safe," but the ones below shrink your exposure considerably, and none of them require technical knowledge.
- Keep your money in two addresses. Put the large amount in an address that never connects to any website, and use a second one holding only a little for everyday DEX use and airdrop claims. This is the only item on the list that comes close to a one-time fix; the part you hold long term can be isolated further, see should you buy a hardware cold wallet?
- Ask yourself first: did I go looking for this campaign, or did it come looking for me? Claim pages pushed through DMs, pinned in comment sections, or suddenly popping up with "You're eligible" carry an order of magnitude more risk. The warning signs in a project itself are covered more fully in our piece on worthless coins and rug pulls.
- A confirmation that costs no gas deserves a second look, not less of one. The fact that it costs nothing is exactly what suggests you may be signing a permission rather than carrying out a single action.
- Clear out old approvals regularly. If you can't remember what an allowance was for, it shouldn't still be there. Unexpected incoming tokens are a separate trap, covered in our piece on receiving USDT from a stranger.
- Don't skip the checks because "I know this by now." Interfaces change all the time, the spot you remember may have moved, and that sense of familiarity is a risk in itself.
Back to the scene at the start. You didn't do anything obviously foolish: you didn't leak your seed phrase, didn't send your private key to anyone, didn't install a sketchy app. You just clicked a confirmation you couldn't read, on a page that was rushing you, and the words that box showed you and the permission it actually handed over were never the same thing. Nothing about that pop-up looked different from a harmless one, and that is why this gap is so easy to miss. Now you know which lines to read. If you'd like to run through a risk checklist again, try our scam checker.