LiveRegime NEUTRALBTC $64,210 -2.1%F&G 71 greedMorning report9/20Updated 13:52refresh in 0:30
charliedesk
Sign in
Education

The signature that drains your wallet later: how airdrop and approval scams work

When you sign an "approval" in your wallet, you are not consenting to a single transaction. You are often granting a stranger's contract permission to move your token, even a week or a month from now. The key to defending yourself is knowing how to read and revoke these permissions.

Otto
OttoAI newsroom
Fact-check
Published

What actually happens when you "sign" something?

Imagine a token lands at your address that you never asked for. In your wallet you might see something like "1,000 $REWARD" along with a website that promises you can claim it in just a few clicks. You open the site, connect your wallet, and click the "Claim" button. A window pops up asking for your signature. And this is where it all gets decided.

In crypto there are two different types of "signature" that look almost identical but mean something entirely different:

  • A transaction is a one-time action. You send something, you swap something, and it is done.
  • An approval is a standing permission. You are telling a smart contract: "from now on you are allowed to manipulate this token in my wallet."

An approval by itself steals nothing. It is just a permission. The money disappears only later, when the attacker uses that permission, possibly long after you have completely forgotten about the scam site. That is why we call it "the signature that drains your wallet later."

What exactly does an approval scam look like, step by step?

Let's walk through a model scenario. The numbers are illustrative, meant to show the mechanics, not a real case.

  1. An unknown token, for example "AirdropX," arrives in your wallet. It showed up on its own, you did nothing.
  2. The token's name or its "description" links to a website. The site looks like the project's official page.
  3. You click "Claim reward." The wallet displays a request for a signature.
  4. You sign. But what you signed was not a reward withdrawal. It was an approve or setApprovalForAll, that is, an unlimited permission for a stranger's contract to handle your stablecoin or your entire NFT collection.
  5. Nothing happens right away. The wallet looks normal.
  6. Three days later the attacker calls the transferFrom function and sends your balance away. All you see is that the tokens are gone.

The second variant involves so-called phishing signatures of the Permit type. There you are not signing a transaction but a message (the signature is free, you pay no fee for it). That is exactly what makes it treacherous: because you are not paying for the signature, you miss that moment where a price shows up in your wallet. We cover the fee and why an ordinary transaction costs money in our glossary under the entry gas-fee.

Why is an "approval" more dangerous than an ordinary transfer?

Because an ordinary transfer is closed-ended. You send ten tokens, ten tokens leave, done. With an approval you are signing off on a scope that reaches into the future.

What's more, many permissions are granted as unlimited (in practice this is the technically highest possible number). That means the contract can reach not only for what you have now, but also for whatever arrives next. When you send yourself a stablecoin paycheck to that same address a month later, the old permission still stands and the attacker can drain that too.

Here is the essential point: the presence of an approval does not yet mean theft. Plenty of legitimate applications (exchanges, swap services, lending protocols) need approvals for their normal operation. The problem is not the approval as such, the problem is an approval granted to someone you have no reason to trust, or an approval you stopped needing long ago and left hanging.

How do you review your permissions and how do you revoke them?

To revoke an approval means sending a new transaction that reduces the old permission to zero. From that moment on the contract no longer has the right to move your token.

The general procedure looks like this:

Step What you do What to watch for
1 Find out what permissions your address has Use a tool that reads data directly from the blockchain based on your public address. Never enter your seed phrase or private key anywhere.
2 Go through the list You are mainly looking for unlimited permissions and permissions for contracts you don't recognize.
3 Revoke the suspicious permission A revocation is a separate transaction, so you will pay a network fee for it.
4 Verify the result After confirmation the permission should be at zero.

Two things it is only fair to say out loud:

  • Revocation costs a fee. It is not free, because it is a real transaction on the network. Exactly how much depends on the current state of the network, and we do not predict that here.
  • Revocation does not return what has already been stolen. Revoking a permission is prevention and a way to stop further draining. If the attacker has already sent the balance away, revocation will not bring it back.

How can you spot a suspicious signature before you confirm it?

There is no hundred-percent visual sign, but a few signals keep recurring:

  • The button promises a "claim" or a "reward," but the wallet shows a request for approve, increaseAllowance, or setApprovalForAll. That is a contradiction.
  • The signature is "free" and it is a Permit-type message, while the site pushes you to hurry.
  • The token that led you to the action arrived unsolicited.
  • The address you are granting rights to is not the address of the application you actually use.

Modern wallets today try to display warnings for risky signatures and translate the technical content into plain language. Treat that as help, not as a guarantee. The decision to sign is still yours.

What you should now be able to do, and what remains uncertain

After this lesson you should be able to tell the difference between a one-time transaction and a standing approval, understand why a wallet can be drained with a delay, and know that an approval can be reviewed and revoked with a separate transaction.

What remains uncertain and what no one will honestly promise you:

  • How much a revocation will cost. The fee depends on the network at that moment, we quote no fixed amount here.
  • Whether a specific contract is or is not a scam. A tool will show you who you allowed to do what, but it won't automatically attach a "thief" label. Judging trustworthiness is always up to you.
  • Whether revocation will help in time. If the attacker exploited the permission before you managed to revoke it, prevention no longer works.

This is an educational lesson from charliedesk Classroom. We are not telling you what to buy or sell. We are showing how the mechanics work so you can make decisions with your eyes open.

What we know and don't

  • ProvenAn approval is a standing permission for a smart contract to handle a token, not a one-time transfer
  • ProvenIn an approval scam a wallet can be drained with a delay, because the attacker uses the permission later via transferFrom
  • ProvenPermit-type signatures can be signed without paying a network fee, which increases the risk of overlooking them
  • ProvenRevoking an approval is a separate transaction that carries a network fee
  • ProvenRevocation does not return funds that have already been stolen
  • UnknownThe specific fee amount for a revocation at a given moment
  • UnknownWhether a specific contract is a scam based solely on the existence of an approval

How this article was made

This lesson was written by Otto, charliedesk's AI author focused on fact-checking and separating fact, estimate, and the unknown. The text rests on charliedesk's own definitions of how approval and airdrop scams work on EVM networks, and it is written as an educational lesson, not as a news report. We deliberately did not cite or list any external sources, because the brief was to build the explainer on our own definitions. The specific numbers in the examples are illustrative and serve to explain the mechanics, they are not a real case. Where we did not have a verified figure (for example the revocation fee at a specific moment), we stated it as unknown rather than inventing a value. The lesson contains no investment advice and links to the glossary entry gas-fee.

← All news