Approval phishing tricks a user into signing a token approval that gives a malicious contract or address permission to move their tokens. The danger is that the attacker can then drain the wallet later, at a time of their choosing, with no further action from the victim.
What is approval phishing, in plain English?
On most token standards, spending a token you hold requires you to approve a contract to move it on your behalf. That approval is a normal, necessary part of using an exchange or a DeFi app. Approval phishing abuses this: the attacker builds a convincing site or prompt that asks you to sign an approval, but the spender you are authorizing is a malicious contract or address.
The critical detail is that an approval is not a one-time transfer. It is a standing permission that lasts until you revoke it, and it is often requested as an unlimited allowance. So a single signature can hand over the right to move your tokens now or at any point in the future. The victim signs once, sees nothing leave immediately, and assumes all is well.
The theft comes later. Using the approval, the attacker calls transferFrom to sweep the wallet whenever it suits them, often when the balance is highest. On-chain the pattern is an approval granted to a fresh or already-flagged spender, followed by transferFrom pulls that empty the tokens.
How an approval phishing attack works
- Lure — Bait the victim. A fake airdrop, mint, or support page draws the user to connect their wallet.
- Prompt — Request the approval. The site asks the user to sign what looks like a routine approval, often for an unlimited amount.
- Grant — Standing permission set. The signature authorizes a malicious spender to move the token, and it stays live until revoked.
- Immediate — Sweep now. The attacker drains the balance in the same session.
- Delayed — Sweep later. They wait until the wallet holds more, then empty it in one call.
- Drain — Call transferFrom. Using the approval, the attacker pulls the tokens out with no further action from the victim.
Who is involved?
Who | Their role |
The attacker | Deploys the malicious spender and runs the phishing site or campaign that harvests approvals. |
The victim | Signs the approval, granting a standing permission they may not realize they gave. |
The malicious contract | Holds the allowance and executes transferFrom to sweep the tokens when triggered. |
The wallet or analytics tool | Can warn on risky approvals and surface old allowances the user should revoke. |
What it looks like in practice
In practice
A user sees an ad for a token airdrop, connects their wallet to claim it, and is prompted to sign a transaction to be eligible. The prompt is an approval granting an unlimited allowance to a contract they have never seen. Nothing appears to leave, so they move on.
Three weeks later, after they bridge a larger balance into that same wallet, the malicious contract calls transferFrom and empties the tokens in a single transaction. The victim took no action that day; the permission they signed weeks earlier was all the attacker needed. Revoking the approval the day after signing would have closed the door.
Why it is dangerous for operators
Approval phishing decouples the moment of consent from the moment of loss. A user can sign a bad approval and see no immediate harm, so nothing prompts them to react. The permission then sits quietly, meaning the wallet is compromised long before any funds move. For a monitoring team, this gap is the whole problem: the risky event is the approval, not the eventual sweep.
Because one signature can enable repeated theft, the exposure is larger than a single transaction. The defense is to treat approvals as first-class risk events: warn users at signing, prefer bounded spend limits over unlimited allowances, and routinely surface and revoke old, unused approvals before an attacker gets around to using them.
What to watch in the data
- Approval to a fresh spender. An allowance granted to a newly deployed or low-reputation contract deserves scrutiny before the sweep.
- Unlimited allowances. Max-value approvals carry far more risk than a bounded amount and are a hallmark of drainer prompts.
- Approval then transferFrom. A grant followed by a transferFrom that empties the balance is the completed attack signature.
- Delayed sweep after a deposit. A dormant approval firing right after a wallet is topped up suggests the attacker was waiting.
- Reused spender across victims. One malicious contract collecting approvals from many wallets points to a campaign, not a one-off.
Quick questions
How is an approval different from a transfer?
A transfer moves funds once and is done. An approval grants ongoing permission for a contract to move your tokens, and it stays live until you revoke it. That is why a single approval can enable repeated theft long after you sign it.
Why does nothing leave my wallet when I sign?
Approving does not move funds; it only grants permission. The attacker triggers the actual sweep later with transferFrom. The delay is what makes the attack feel harmless at the moment of signing.
What is an unlimited approval and why is it worse?
An unlimited or max approval lets the spender move any amount of that token, now and in the future. A bounded approval caps the exposure to a set amount. Drainer prompts favor unlimited because it maximizes what they can take.
How do I protect myself after signing a bad approval?
Revoke it. Use a revoke tool or your wallet's permissions screen to cancel the allowance before the attacker uses it. Making revocation of old, unused approvals a habit sharply limits the damage.
How does this relate to crypto drainers?
Drainer kits frequently use approval phishing as their mechanism. The drainer's fake site harvests the malicious approval, and the kit then automates the transferFrom sweep. Approval phishing is the technique; the drainer is the packaged tooling.
Can analytics catch it before the sweep?
Yes, if approvals are monitored. Flagging allowances to fresh or flagged spenders, especially unlimited ones, gives a window to warn the user and revoke before any funds are pulled. Watching only for transfers misses the real risk moment.
Go deeper
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.
- OFAC, US Treasury ↗ — Administers US sanctions programs, the SDN list, and licensing.