Dealing with token approval scams
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 6 min
In short
An approval grants a third-party contract permission to move your tokens. Once given, it stays until you revoke it. Review and revoke approvals for services you have finished using.
Key points
- An approval is not a transfer, so nothing leaves your wallet at the time — which is why it goes unnoticed
- An unlimited approval also covers tokens you acquire later
- It stays valid until you revoke it, so revoke once you are done with a service
- Even for an approval manager, open the official URL from your own bookmark
Definition
Abusing the token standard's approval mechanism — which lets a named contract move your tokens — to drain assets at a later time.
The first thing a decentralised exchange or DeFi app asks you to sign is an approval. It is a legitimate, necessary step that lets the service's contract move your tokens. The catch is that it is not a one-time permission but a standing one, valid until revoked — and because nothing leaves your wallet when you sign it, a dangerous approval is easy to miss.
The classic abuse is a fake site or fake airdrop page requesting an unlimited approval to the attacker's contract. Unlimited covers not just what you hold now but whatever arrives later. Attackers sometimes wait, doing nothing, and drain the wallet once the balance has grown. 'Nothing happened at the time, so it was fine' is the wrong conclusion.
Defend at both ends. On the way in, read who is being authorised, for which token, and for how much, before approving — and if your wallet lets you cap the amount, cap it at what you need. On the way out, list your live approvals in an approval manager (block explorers offer these) and revoke what you no longer use. Revoking costs gas; treat it as an insurance premium.
One caveat: fake versions of approval managers exist. Get the URL from a source you trust, bookmark it, and use only that. And no such tool ever needs your seed phrase — the moment a site asks for it, it is fake.
Watch out for
- · Signing without reading is the core risk — refuse any request you cannot explain
- · Revoking an approval does not recover assets already taken
- · No service, approval managers included, ever needs your seed phrase or private key
Frequently asked questions
An unknown token appeared in my wallet. Is it dangerous if I never approved anything?
Merely receiving it moves nothing. The danger is trying to sell it and signing something on the site it steers you to. Leave unknown tokens alone and hide them.