How "approval phishing" drains wallets without stealing a key (and how to check it in 10 lines)
Most people picture a crypto theft as "someone got my seed phrase". A large share of wallet drains we see in scam reports works differently: the victim signs one innocent-looking message, and the attacker never touches the key. This post explains the mechanism and shows a short script that checks whether a token approval is unlimited. What an approval is ERC-20 tokens let you give another address…
Approval phishing is a method used by scammers to drain crypto wallets without directly stealing the private keys. Instead of targeting the key itself, they trick the victim into signing a seemingly harmless message that triggers an approval transaction. This allows the attacker to move funds to their own address without needing further authorization.
This article explains how approval phishing occurs and provides a simple script to check if a token approval is unlimited. An approval is a permission granted by an ERC-20 token contract, allowing another address (the spender) to move the token holder's tokens up to a specified amount. Exchanges, decentralized exchanges (DEXs), and games commonly use approvals to simplify transactions.
The risk arises when a dapp requests an unlimited approval, granting the spender full control over the token holder's funds. Scammers exploit this by tricking victims into approving unlimited amounts to their own addresses. Once approved, the spender can withdraw the tokens at any time, long after the initial interaction. To protect yourself, revoke any unused approvals, use exact amounts instead of unlimited, and be cautious of suspicious requests.
Scammers often use fake airdrop sites, claim pages, and cloned mint pages to lure victims into signing approval requests. You can check your wallet's token approvals using the provided script and online tools. Additionally, there is a free quiz available to test your knowledge of scam vectors, including approval phishing.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
