Approval Phishing & Signature Traps
They don't want your keys. They want your permission — granted once, used forever.
Approval phishing is the polite robbery. Nothing is broken into. You are asked, in language that sounds procedural, to grant a contract permission over a token balance — and then the contract exercises that permission at a time of its choosing.
It works because approvals are invisible after the fact. The wallet shows a successful transaction, the balance stays put, and the drain arrives days later when nobody is watching the screen.
Documented cases in detail
The rented-kit end of this vector is documented in our investigation into wallet drainers and approval-phishing attacks that use Permit2 signature traps — Permit2 traps, blind signing and a $1,500/month Telegram subscription.
For the law-enforcement side of the same signature abuse, read Operation Atlantic, the approval-phishing network taken down after months of token-allowance theft and how the approvals were harvested at scale.
The reward-bait version of this trap is broken down in fake airdrop phishing campaigns that drained $100M from 18,200 wallets — 47 campaigns, $400 drainer kits, one malicious signature each.
The full catalogue of fake wallet scams — cloned MetaMask extensions, pre-seeded hardware, signature traps — is in our breakdown of crypto wallet scams and how seed phrases actually get stolen with the damage-control sequence for after you signed.
How it works
The pretext
A security alert, a migration notice, an airdrop claim, a support call. Anything that makes signing feel like the safe option.
The signature
An unlimited allowance, a Permit2 blob, or setApprovalForAll on an NFT collection. Human-readable only if the wallet decodes it — many do not.
The delay
The drainer waits. Time between signature and theft breaks the victim's mental link between the two events.
Investigations in this vector
Wallet Drainers and Approval Phishing Explained
ScamSniffer data: $494M lost in 2024, $83.85M in 2025 to approval phishing and Permit signatures. What's confirmed, how it works.
Read the investigationOperation Atlantic: $83M Scam 3 Governments Are Hunting
142 cloned DeFi sites. 14,847 wallets drained. $83M stolen with one 'Approve' button. 3 governments. 6 arrests. 94% of funds unrecoverable.
Read the investigationFake Binance Phone Scam: SMS Alerts That Steal All
Scammers send fake Binance security alerts by SMS to push victims into calling fraudulent support lines. How to spot and stop the call.
Read the investigationFake Ledger CEO Letters: The Counterfeit Wallet Scam
Letter from "Ledger CEO" with QR code and new hardware wallet? It's fake. The seed phrase pre-loaded drains your real funds instantly.
Read the investigationRed flags
- A signature request that grants an allowance instead of moving a fixed amount.
- The wallet cannot decode what you are signing and shows raw hex.
- Urgency framed as safety: 'migrate now', 'verify to protect your funds'.
- Inbound contact — a call, DM or email you did not initiate.
- The claim page needs an approval before it will show you anything.
If it already happened
- 1.Revoke the approval immediately; revoking after the drain still stops the next one.
- 2.Check every other approval on the same address — drainer kits request several.
- 3.Move remaining balances to a fresh address rather than trusting the cleaned one.
- 4.Keep the signature hash: it identifies the drainer kit, and kits get attributed.
Related vocabulary
Got a suspicious message, link or token?
Paste it into the free detector. No signup, no cost, answer in seconds.