Section 7 · Lesson 7.8
Approval phishing and drainers: how theft happens through a signature
The most insidious theft in crypto is the one where the victim authorizes the withdrawal of their own funds. No stolen password, no hacked wallet: the person signs a transaction with their own hands, and a second later the wallet is empty. This is approval phishing and drainers — an industry that, in 2023–2026, made off with hundreds of millions of dollars from users. To protect people and to correctly classify such addresses, an analyst must understand the mechanics of the approve and permit permissions.
What approve is and why it is needed at all
In networks like Ethereum, tokens (USDT, USDC, and others) are smart contracts. For an application (a DEX, staking, a game) to be able to handle your tokens, you grant it a permission (approval): you sign an approve transaction that tells the token contract "allow this address to spend my tokens up to such-and-such an amount." This is a standard and necessary mechanism — without it DeFi would not work.
Where the trap is hidden. A permission can be granted for an unlimited amount (unlimited approval) — it is more convenient that way, no need to re-ask each time. And a permission has no expiry — it hangs there until you revoke it. The fraudster is after exactly one thing: for you to sign an unlimited approve to their contract. After that, they can withdraw all your tokens of that type at any moment — with no new confirmations from you.
The mechanics of a drainer step by step
A drainer is a ready-made set of scripts that fraudsters rent as a service (drainer-as-a-service) and install on fake sites. Here is a typical scenario.
- The lure. The victim sees a "token giveaway," a "mint of a rare NFT," a "reward claim," or a fake site of a well-known project. The link comes from an ad, a hacked Twitter/Discord, or a comment.
- Connecting the wallet. The person clicks "Connect Wallet" — by itself this is safe, but it builds trust and shows the drainer which tokens are on the balance.
- The request to "confirm." The site offers to sign a transaction under the guise of "receive the reward," "verify your wallet," "activate your account." In reality it is an
approve or permit to the fraudster's contract.
- The victim's signature. The person does not read what exactly they are signing (or does not understand) and clicks "Confirm." The permission is granted.
- The withdrawal. The drainer immediately (or on a delay, so as not to spook the victim) calls
transferFrom and withdraws all the approved tokens to the attacker's address.
- Laundering. What is collected from hundreds of victims is consolidated onto collector addresses and moved through mixers and bridges.
Fake site
"reward claim"
→
Victim signs approve/permit
→
transferFrom → wallet emptied
Permit: a signature with no fee, even more insidious
An ordinary approve is a transaction — gas is paid for it, and it is visible in the history. The permit standard (EIP-2612) and the related Permit2 allow a permission to be granted by a simple off-chain message signature — without a transaction and without a fee. To the user it looks like a harmless "sign in to log in." That is precisely why permit phishing is especially dangerous.
The danger of a permit signature. An off-chain signature costs no gas, does not appear in the transaction history until the moment it is used, and looks innocent. The victim thinks they "just logged in to a site," when in fact they have granted the fraudster the right to withdraw the tokens. Always read what exactly you are signing: if the wallet window shows the words Permit, spender, an unknown address, and large amounts — that is an alarm.
How it looks on the graph and how to classify it
For an AML analyst, a drainer's address has a recognizable handwriting.
- Many victims — one collectorDozens and hundreds of addresses give up tokens to a single address via the
transferFrom call. A fan-in convergence toward the drainer address.
- Only withdrawal, no reciprocal operationsThe victims received nothing in return — this is a one-way outflow, characteristic of theft, not trade.
- Heterogeneous tokensEverything valuable is swept from an address — stablecoins, "gov" tokens, sometimes NFTs. The drainer takes whatever was approved.
- Fast movement toward launderingFrom the collector, funds go into a mixer/bridge within minutes to hours. The exposure category is
scam/phishing/theft at high weight.
How it differs from other thefts. In a protocol hack (Lesson 7.7) the contract suffers; in approval phishing thousands of ordinary wallets suffer one by one. The source of the dirt here is not a code bug but social engineering: the victim signed it themselves. But the exposure from a drainer address is just as toxic, and an exchange will freeze funds arriving from it.
Protection: how not to become a victim and what to do afterward
- Read the signature window. The wallet shows what you are approving: the type of action (Approve/Permit), to whom (spender), and how much. An unfamiliar address + "Unlimited" = do not sign.
- Do not grant unlimited approval. Where possible, limit the permission amount to the exact quantity for the operation.
- Regularly check and revoke permissions. Revoker services show all a wallet's active approvals; the unnecessary and old ones should be revoked.
- A separate "hot" wallet. For interacting with new sites, keep a wallet with a small balance; keep the main funds on a separate/hardware wallet.
- Verify the domain. Drainers live on fake lookalike domains. Go in via bookmarks, not via links from ads and private messages.
- If you have already signed. Immediately revoke the permission — it is a race against time. Move valuable remnants to a new clean wallet. Consider the compromised address "burned."
Revoking does not return what was stolen. Revoke closes the permission for the future, but already-withdrawn tokens cannot be recovered. So the main defense is not to sign. And remember: a genuine giveaway never requires you to sign an approve on your own tokens — a safe reward "claim" needs no access to your balance.
The main takeaways
- approve/permit is a standard permission mechanism; the trap is in unlimited and open-ended access to a fraudster's contract.
- A drainer tricks the victim into signing a permission, then calls transferFrom and sweeps out the tokens.
- An off-chain permit signature is especially dangerous: no gas, not visible in the history, looks like "logging in to a site."
- On the graph — fan-in convergence from many victims to one collector, a one-way outflow, the scam/phishing category.
- Protection: read the signature window, do not grant unlimited, revoke permissions, use a separate wallet, verify the domain.
This material is for educational purposes and is not security advice for any specific case.