Security

Token Approvals: The Quiet Way Wallets Get Drained

By Gurjeet Singh, developer of CoinPriceAlert · Published 13 August 2026 · 6 min read

Short answer

Most drained wallets were not hacked. The owner signed something that granted permission, and the drain happened later, sometimes months later. Check your approvals on a tool such as Etherscan's approval checker or Revoke.cash, revoke the ones you do not recognise or no longer use, and never sign a request you cannot read.

What this covers

What you are actually agreeing to
Why the delay makes it hard to spot
Signatures that grant approvals without a transaction
How to check what you have approved
Revoking, and what it cannot undo
Approval drain or stolen key? Tell them apart
The habits that prevent it

What you are actually agreeing to

Tokens on Ethereum and similar chains follow a standard, ERC-20, that lets you give another address permission to spend your tokens: an approval, stored on-chain as an allowance. Every decentralised exchange, lending market and bridge needs one, because a smart contract cannot pull your tokens without it.

Many interfaces ask for an unlimited allowance by default. It saves you a transaction the next time you use the site, which is why it became normal. It also means that contract can move every unit of that token you hold, now or at any point in the future, without asking again.

NFTs have their own version. Approving a marketplace or contract "for all" on an NFT collection lets it transfer every item you own in that collection, including ones you acquire later.

Why the delay makes it hard to spot

An approval does not expire. It stays valid after you stop using the site, after the team moves on, and after the contract is exploited or its admin keys are stolen. A protocol that was safe when you used it can become the route by which your wallet is emptied a year later.

Because the drain can happen long after the approval, the connection is invisible to the victim. People conclude their wallet was "hacked" when in fact they authorised the transfer months earlier on a site they no longer remember visiting.

This is why "only connect to sites you trust" is not enough on its own. Trust at the moment of signing does not cover what the contract, or whoever controls it, becomes later.

Signatures that grant approvals without a transaction

The newer and more dangerous version needs no on-chain transaction at all. Some tokens support "permit" signatures (defined in EIP-2612), and several protocols use similar signed messages, so that approving a spender costs you nothing but a signature. That is convenient. It also means a wallet pop-up that looks like a harmless "sign in" or "verify" message can hand someone permission to spend your tokens.

Phishing sites rely on exactly this. You connect a wallet to claim an airdrop or mint something, you are asked to sign a message, you see no gas fee and assume nothing is at stake, and the signature is used to move your tokens minutes later. Because no approval transaction ever appeared in your wallet history, the drain can look like it came from nowhere.

The practical rule: treat any signature request as a potential transaction. If your wallet shows structured data with words like permit, spender, value or deadline, you are being asked to authorise spending.

How to check what you have approved

Approval checkers read your address's allowances from the chain and list them with the contract each one belongs to. Etherscan has a token approval page covering ERC-20, ERC-721 and ERC-1155 approvals, and Revoke.cash does the same across many networks. Both only need your public address to show the list.

Look for three things: unlimited allowances to contracts you no longer use, approvals to contracts you do not recognise at all, and "approve for all" permissions on NFT collections. Anything in the second group deserves immediate attention; anything in the first is worth cleaning up.

Checking is free and read-only. Revoking is an on-chain transaction, so it costs a network fee and must be signed from the wallet that granted the approval.

Revoking, and what it cannot undo

Revoking sets the allowance back to zero, so that contract can no longer move that token. It takes effect as soon as the transaction confirms. It does nothing about tokens already taken: a revocation protects what is still in the wallet, it does not reverse a transfer.

Be careful where you revoke. Scammers run fake "revoke" and "wallet validation" sites that ask for a new signature, which is simply another approval. Type the address of the tool yourself rather than following a link from a direct message or a reply to your post about being drained.

Approval drain or stolen key? Tell them apart

If only specific tokens left the wallet, each moved by a contract rather than by a plain transfer from your address, an approval or permit signature is the likely cause. Revoking the relevant approvals and moving the remaining assets is usually enough.

If the network's native coin (ETH, BNB, POL and so on) was sent out directly, or everything left in one sweep, assume the private key or recovery phrase itself is compromised. Revoking approvals will not help, because the attacker can sign anything you can. Create a new wallet with a new recovery phrase on a clean device and move whatever is left there. Do not reuse the old phrase anywhere, and expect automated "sweeper" bots to take any gas you send to the old address.

The habits that prevent it

Set a spending cap instead of an unlimited approval when the interface or your wallet allows it, sized to the trade you are making. Revoke approvals when you finish with a protocol, and review the whole list every few months.

Split your wallets. Keep long-term holdings in a wallet that never connects to websites at all, ideally a hardware wallet, and use a separate wallet with limited funds for new protocols, mints and airdrops. A drained experiment wallet is a bad day; a drained savings wallet is a disaster.

Read before you sign. A request that does not clearly match what you are trying to do is the moment to stop, not the moment to click through. Wallets increasingly simulate transactions and warn about known drainer contracts; keep those warnings switched on and take them seriously.

And keep monitoring separate from signing. Watching a price needs no wallet connection at all: price alerts like CoinPriceAlert work from public market data and never ask to connect a wallet or sign anything.

CoinPriceAlert

Never miss a move in the markets you follow

Name the price that would change your mind, set it once, and get told when it happens rather than watching a chart for it.

Fires about a second after the price hits
Runs on our servers, so it reaches you with the app closed
Free for 3 alerts — no card, no account

Download the app for real-time notifications

Frequently asked questions

Do token approvals expire?

No. An ERC-20 allowance stays valid until it is used up or you revoke it, even if you never visit the site again. That is why old unlimited approvals are a common route to a drained wallet.

Is it safe to check my approvals?

Yes. Checkers such as Etherscan's token approval page or Revoke.cash read public data from your address. Only revoking needs a signed transaction, and you should reach those tools by typing their address yourself.

Can a signature with no gas fee drain my wallet?

Yes. Permit-style signatures grant spending permission off-chain, so they cost nothing to sign. If a signature request mentions a spender, a value or a deadline, it is authorising spending.

I revoked the approval. Will I get my tokens back?

No. Revoking stops future transfers by that contract; it cannot reverse tokens already moved.

Price alerts that never need an exchange key or wallet access: crypto price alerts, or every market and alert type. Choosing an app? How the alert apps compare, from their own pricing pages.

Related terms

crypto app permissions — what an app should and should not ask for
exchange API key drains — the exchange-side version of a standing permission
hot vs cold wallets — keeping savings away from anything that signs
seed phrases — what to do when the key itself is exposed

Sources

Written by

Gurjeet Singh · developer of CoinPriceAlert

Gurjeet Singh builds CoinPriceAlert: the alert engine, the coin pages and the threshold planner on this site. Gurjeet also built the offline-first Expense Tracker: Income Manager app. How this site is built and where its data comes from →

Keep reading