Wallet drainer / approval scam: revoke approvals and secure funds

On Ethereum and other EVM chains, ERC-20 tokens use an allowance model. A spender contract you approve can transferFrom your balance up to the allowance. Malicious sites disguise that approval as a mint, claim, or “security check.”

Once unlimited allowance is granted, the attacker can wait and drain tokens when convenient. Native ETH can also leave via malicious contract calls or phishing that tricks you into a straight transfer.

1. Disconnect the wallet from the suspicious site; do not sign anything else.
2. From a known-good device and browser profile, check allowances with a reputable approvals tool for your network.
3. Revoke allowances to unknown spenders — especially unlimited approvals.
4. Move remaining assets to a freshly generated wallet (new seed, offline backup).
5. Save the approval and drain transaction hashes from the explorer.

Never paste your seed into a “revocation helper” website. Revocation is a normal on-chain transaction you sign with your wallet — it does not require exporting the seed.

Use well-known explorers or established revocation interfaces for the chain you are on. Verify the URL. Pay network fees from a small amount of native gas token. After revocation, confirm allowances read zero for the malicious spender.

If the device itself is malware-infected, revoking from that same device may be unsafe. Prefer a clean environment. When in doubt, abandon the compromised seed after sweeping what you can through a careful, verified flow.

• Solana and others have different permission models; “approvals” terminology differs, but malicious signatures still exist.
• Bitcoin does not use ERC-20 allowances; theft patterns differ (seed theft, malware, fake PSBTs).
• Tron USDT theft often involves TRC-20 transfers and phishing — still preserve tx hashes.

Once remaining funds are secure, treat the drain like any other theft for reporting: time, network, source, hash. On-chain tracing can follow where the drained tokens went — including toward exchange deposits — without claiming recovery.

MBTrace can produce that PDF after analyst acceptance and payment. It will not ask for your seed. See also our recovery-scam and first-24-hours guides.

• Prefer hardware wallets for meaningful balances; verify receive addresses on the device screen.
• Avoid blind-signing unknown permits; read wallet simulation warnings when available.
• Separate a “degen” hot wallet with small balances from long-term storage.
• Revoke stale unlimited approvals periodically on chains you use.
• Bookmark official dApp URLs; phishing domains often differ by one character.

No habit removes all risk. The goal is reducing blast radius: one bad signature should not empty years of savings.

If a friend is mid-panic after a drain, help them revoke and migrate before debating tracing vendors. Sequence matters: stop pulls, then document, then report.

Drainers evolve. Some use Permit2 or operator approvals for NFTs and tokens. The principle stays the same: you signed a permission that lets another contract move assets. Revoke the permission, move assets, keep the signature/tx evidence.

Wallet UIs differ. If you cannot find an approvals screen, use the chain’s block explorer token-approval views from a clean device, or a widely known revocation tool whose URL you typed carefully. When confused, pause — confusion is where phishing thrives.

• The approval or permit transaction hash (or signature evidence if your wallet logs it).
• Every drain / transferFrom hash that moved value out.
• Token contract address, spender address, and amounts.
• UTC timestamps and the network name spelled out (Ethereum mainnet vs a lookalike L2).
• Screenshots only as backups — primary evidence is the hash you can re-open later.

After you move remaining funds, that pack becomes the starting point for tracing, police filing, or exchange contact. Do not wipe browser history until exports are saved offline. See also our first-24-hours and recovery-scam guides before you accept “help” in DMs.

Sometimes approvals remain while native gas is gone, so you cannot revoke or move ERC-20s. In that case, send a small amount of the native token from a clean wallet you control to the compromised address — only enough for fees — then revoke and sweep immediately. Do not fund a wallet you no longer trust with more than the fee needed for exit.

Partial drains happen when allowance is limited or when the attacker waits. Unlimited approvals are especially dangerous because a later price pump can empty a balance you thought was “safe.” Treat any unknown spender as urgent even if nothing moved yet.