Approval Phishing & Signature Traps

Approval phishing is the polite robbery. Nothing is broken into. You are asked, in language that sounds procedural, to grant a contract permission over a token balance — and then the contract exercises that permission at a time of its choosing.

How this vector actually works

It works because approvals are invisible after the fact. The wallet shows a successful transaction, the balance stays put, and the drain arrives days later when nobody is watching the screen.

  • The pretext — A security alert, a migration notice, an airdrop claim, a support call. Anything that makes signing feel like the safe option.
  • The signature — An unlimited allowance, a Permit2 blob, or setApprovalForAll on an NFT collection. Human-readable only if the wallet decodes it — many do not.
  • The delay — The drainer waits. Time between signature and theft breaks the victim's mental link between the two events.

Red flags you can check in a minute

Any single item below is enough to stop and verify before you sign, send or install anything. They don't want your keys. They want your permission — granted once, used forever.

  • A signature request that grants an allowance instead of moving a fixed amount.
  • The wallet cannot decode what you are signing and shows raw hex.
  • Urgency framed as safety: 'migrate now', 'verify to protect your funds'.
  • Inbound contact — a call, DM or email you did not initiate.
  • The claim page needs an approval before it will show you anything.

If it already happened

Order matters more than speed of panic: contain the wallet first, preserve the evidence second, report third. Recovery services that contact you after the fact are the follow-up scam.

  • Revoke the approval immediately; revoking after the drain still stops the next one.
  • Check every other approval on the same address — drainer kits request several.
  • Move remaining balances to a fresh address rather than trusting the cleaned one.
  • Keep the signature hash: it identifies the drainer kit, and kits get attributed.

Related vectors and tools

Most real cases mix two vectors, so read the neighbouring hubs, and run anything suspicious through the detector before you act on it.