Approval Phishing Walkthrough: How It Works and How to Defeat It

When a new or casual user loses crypto to an attack, the culprit is usually a phishing site that asked them to enter their seed phrase. When an experienced user loses crypto, the culprit is almost always an approval phishing attack. The victim never typed their seed phrase anywhere. They never exposed a private key. They clicked "sign" on what looked like a harmless transaction and the tokens were drained days, weeks, or months later.

The asymmetry of this attack is what makes it so effective: the victim does not see the theft happen. They sign the approval, the wallet shows no change, and they continue using the wallet. Only when a later drain executes do they realize anything is wrong.

The Underlying Mechanic: ERC-20 Approvals

To understand the attack, you need to understand a specific part of how EVM tokens work. Most tokens on Ethereum, Base, Arbitrum, Polygon, BSC, and similar chains follow the ERC-20 standard. ERC-20 defines a function called approve(spender, amount).

When you call approve, you authorize another address — the "spender" — to transfer up to amount of your tokens out of your wallet at any time in the future. The spender does not need to ask you again. They already have permission.

This is a legitimate and widely-used mechanic. Every DEX, lending protocol, and DeFi application on EVM chains relies on it. When you swap USDC on Uniswap, you first approve Uniswap's router to spend USDC, then you execute the swap. The approval is standard.

The problem is that the approval call does not specify a limit by default. The attacker's UI sets amount to type(uint256).max — effectively infinity. And nothing about the approval transaction makes the spender address visibly hostile to a non-technical user.

The Attack Flow, Step by Step

Step 1: Lure

The victim arrives at the attacker's site through one of several vectors:

• A Google Ads placement impersonating a real wallet, exchange, or DeFi protocol.
• A phishing email or DM promising an airdrop, claim, or reward.
• A Discord or Telegram link posted by a compromised project account.
• A malicious NFT airdrop linking to a claim site.
• A hijacked Twitter account of a known project or influencer.

Step 2: Wallet Connection

The site uses a standard WalletConnect or window.ethereum provider and asks the user to connect their wallet. Connection itself is harmless — it only reveals the wallet's address. No funds can move yet.

Step 3: Transaction Prompt

The site prompts the user to sign a transaction. Depending on the attack variant, this is one of:

• A direct approve call with the attacker's drainer contract as the spender.
• A setApprovalForAll call for NFTs.
• An EIP-712 permit signature — an off-chain signed message that serves as an approval without requiring a transaction at all.
• An increaseAllowance or proxy-delegate call.

The wallet displays the transaction. On older wallets, the display is cryptic: a hex-encoded function signature, the target contract, and the gas estimate. On newer wallets, approval warnings are shown, but users have learned to click through warnings when they are trying to claim a free token.

Step 4: Signature

The user clicks approve. The transaction is mined. The drainer contract now has permission to transfer up to infinity of the specified token from the victim's wallet.

Step 5: The Drain

The attacker monitors the wallet. When the balance of the approved token reaches a profitable level — or when a large transfer is detected — the drainer contract executes transferFrom, pulling the tokens out of the victim's wallet and into the attacker's consolidation address.

For particularly high-value wallets, the drain is often coordinated with MEV-boosted transactions that front-run any defensive action. For typical retail wallets, the drain happens hours or days later, when the victim is no longer paying attention.

Step 6: Laundering

Stolen tokens are typically swapped to ETH or another base asset and then routed through a mixer or cross-chain bridge. By the time the victim discovers the loss, the funds have usually moved through several hops.

Permit and Permit2 Attacks

A newer and more dangerous variant uses EIP-2612 permit signatures, or Uniswap's Permit2 pattern. These allow approvals to be granted via an off-chain signed message rather than an on-chain transaction.

The attack here is more insidious because there is no transaction for the victim to see. They sign a message that looks like a login or verification. The message is in fact a permit granting unlimited spending rights, which the attacker submits on-chain themselves.

Wallets increasingly warn about these signatures, but because permit is also legitimately used by major protocols, users have learned to sign them.

Defense

Before You Sign

• Read the transaction details. If a wallet is asking you to approve unlimited spending of USDC, USDT, or WETH and you did not come to the site to perform a swap, stop.
• Check the spender address. Known protocol contracts (Uniswap Router, Aave, etc.) are safe. Unfamiliar contracts, especially freshly deployed ones, are not.
• Check transaction simulation. Modern wallets (MetaMask Security Alerts, Rabby, Phantom) simulate the transaction and show what it would do. Heed the warnings.
• Never sign blindly in a panic. Support scams work by getting you anxious enough to sign without reading.

Routine Hygiene

• Use a dedicated "hot wallet" with small balances for sites you do not fully trust. Your main holdings live in a separate cold wallet that never connects to untrusted sites. See hot wallet vs cold wallet for how to split your holdings.
• Audit approvals quarterly. revoke.cash and Etherscan's approval checker list every active approval per chain. Revoke anything you do not actively use.
• Set approval caps where possible. Some wallets (Rabby, Frame) let you cap approval amounts rather than accepting unlimited.
• Use hardware-wallet confirmation. The on-device display of a hardware wallet makes it harder to miss the approval call, even if you still need to read it carefully.

After a Suspected Approval

If you realize immediately after signing that a site was malicious:

1. Go directly to revoke.cash for the relevant chain.
2. Revoke the approval you just granted. You have a window — sometimes minutes, sometimes hours — before the drain executes.
3. Move remaining high-value tokens to a fresh wallet created from a new seed.
4. Document the transaction hashes for a forensic case. See what happens inside a forensic investigation to understand how investigators use this data.

Why This Attack Is So Hard to Stop

The deepest reason approval phishing persists is that the legitimate and malicious uses of the approve function are indistinguishable at the protocol level. Ethereum cannot prevent a user from granting infinite spending rights to a malicious contract because that same mechanism is what powers every DeFi application the user relies on. Defense is entirely at the wallet UI and user behavior layer. That is why even experienced users fall for these attacks — the underlying permission system is unforgiving.