# How do wallet drainers steal crypto through token approvals, and how do I revoke them?

Source: https://pausebeforesend.com/blog/wallet-drainer-token-approvals/  
Published: 2026-10-24  
Last updated: 2026-10-24  
By: J  
AI-assisted, human-reviewed by J (2026-10-24).

**Short answer:** A wallet drainer is a phishing site that gets you to sign something that hands over your tokens: an approval that lets a contract spend them, a gasless "permit" signature, or a transfer disguised as "Claim." Revoke unknown approvals right away, bookmark the sites you use, and read every signing prompt before you approve. ([Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-scammed))

## Key facts

- A token approval lets a smart contract spend your tokens "at any time." If that contract is malicious or hacked, your tokens can be stolen. ([Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-approvals))
- Approvals you don't revoke "stay active indefinitely." ([Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-how))
- Chainalysis found crypto drainer revenue grew nearly 170% year over year in 2024. ([Chainalysis, Feb 13, 2025](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-chainalysis))
- A drained approval is not the same as a stolen seed phrase. An approval covers specific tokens on one network and can be revoked. A leaked seed phrase cannot. ([Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-seed))

## How does a wallet drainer actually take my tokens?

Revoke.cash describes three common ways. All of them start with you visiting a phishing site. ([Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-scammed))

| What you signed | What it does | Typical clue afterward |
| --- | --- | --- |
| A token approval or permit to a malicious contract | Lets the attacker's contract move that token from your wallet | One token gone; a recent approval to an unknown contract |
| A gasless marketplace signature (for example to OpenSea, Blur or Permit2) | Lets the attacker "buy" all your already-approved assets for nothing | Several tokens or NFTs gone at once on one network |
| A direct transfer disguised as "Security Update," "Claim" or "Claim Rewards" | Sends the asset straight to the attacker | One asset gone; no unexpected approval |

(All rows: [Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-scammed).)

## Why can a "gasless" signature be dangerous?

> "So it may look like you're simply signing into a website, but you're actually granting an approval."
> Revoke.cash, [What Are EIP2612 Permit Signatures?](https://revoke.cash/learn/approvals/what-are-eip2612-permit-signatures)

Permit signatures are signed off-chain, so no transaction fee prompt appears. Revoke.cash notes that many wallets warn you about on-chain approvals, but those warnings are often absent for permit signatures. ([Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-permit))

## How do I check and revoke token approvals?

1. **Revoke.cash:** enter your wallet address or connect your wallet, pick the network, and sort by "Newest to Oldest" if you think you just signed something bad. Click Revoke on anything you don't recognize. ([Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-how))
2. **Etherscan:** open the Token Approvals page from the More menu, enter your address, choose the token type, turn on "Show all approvals," and click Revoke. Use the matching explorer for other chains. ([Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-how))
3. **Revoke even if the theft already happened.** Revoke.cash says an approval left in place "could be used again in the future." ([Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-how))

Revoking means sending a transaction that calls `approve()` again with the amount set to 0, so expect a network fee. ([Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-approvals)) Only use a revoke tool you reached by typing its address or from a bookmark. Fake "revoke" sites exist too. [The fake-revoke-site warning is our advice, consistent with Trezor's guidance to "review and revoke permissions only with a trusted tool."] ([Trezor](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-trezor))

## How do I avoid signing a drainer in the first place?

- **Bookmark the crypto sites you use** and open them only from the bookmark. ([Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-scammed))
- **Never connect your wallet to sites you don't trust,** and never approve token allowances you don't fully understand. ([Trezor](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-trezor))
- **Read the prompt.** MetaMask says a pop-up asking you to sign with "very little context" is most likely fraudulent, and the real MetaMask never pops up unless you started an action. ([MetaMask](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-metamask-real))
- **Keep approvals to a minimum** and revoke the ones you no longer use. ([Revoke.cash](https://pausebeforesend.com/blog/wallet-drainer-token-approvals/#src-revoke-approvals))

## Frequently asked questions

### Does revoking an approval get my stolen tokens back?

No. Revoking stops future theft through that approval. Tokens that were already moved are gone, and Revoke.cash says anyone who promises to recover them is likely a scammer.

### How do I know if it was an approval or my seed phrase?

If assets disappeared across several networks or wallets, or new deposits are taken right away, Revoke.cash says your seed phrase is likely compromised. If one token went to a contract you recently approved, it was likely an approval.

### Is it safe to keep using my wallet after a drainer?

After an approval or a one-time marketplace signature, Revoke.cash says you can keep using the wallet once you revoke the bad approvals. After a seed phrase leak, you cannot. Move to a new wallet.

### Why didn't my wallet warn me?

Permit signatures are signed off-chain. Revoke.cash notes that many wallets warn about on-chain approvals but not about permit signatures, so a drainer prompt can look like a simple sign-in.

No affiliate links on this page, by policy. Revoke.cash and Etherscan are named because they are the tools the cited guides describe. We have no relationship with either.

## Sources

1. Revoke.cash, "What Are Token Approvals?" (undated). [revoke.cash](https://revoke.cash/learn/approvals/what-are-token-approvals) (accessed 2026-10-24)
2. Revoke.cash, "How to Revoke Token Approvals and Permissions" (undated). [revoke.cash](https://revoke.cash/learn/approvals/how-to-revoke-token-approvals) (accessed 2026-10-24)
3. Revoke.cash, "What Are EIP2612 Permit Signatures?" (undated). [revoke.cash](https://revoke.cash/learn/approvals/what-are-eip2612-permit-signatures) (accessed 2026-10-24)
4. Revoke.cash, "You've Been Scammed, Now What?" (undated). [revoke.cash](https://revoke.cash/learn/security/what-to-do-when-scammed) (accessed 2026-10-24)
5. Revoke.cash, "Seed Phrase Compromise - Why It's Game Over" (undated). [revoke.cash](https://revoke.cash/learn/security/seed-phrase-compromise) (accessed 2026-10-24)
6. Chainalysis, "2024 Pig Butchering Crypto Scam Revenue Grows 40% YoY as Industry Increases Sophistication," 2025-02-13. [chainalysis.com](https://www.chainalysis.com/blog/2024-pig-butchering-scam-revenue-grows-yoy/) (accessed 2026-10-24)
7. Trezor, "Common scams and phishing affecting Trezor users" (undated). [trezor.io](https://trezor.io/learn/security-privacy/personal-security-standards/scams-and-phishing) (accessed 2026-10-24)
8. MetaMask Help Center, "How to verify the real MetaMask wallet" (undated). [support.metamask.io](https://support.metamask.io/stay-safe/safety-in-web3/how-do-i-recognize-the-real-metamask-/) (accessed 2026-10-24)

## Changelog

- 2026-10-24: First published.