Token Approvals and Wallet Drainers: What to Check

A site that asks you to connect a wallet and approve something "to run an AML check" can take your tokens. One approval or one signed permit gives a contract the right to move them later, without asking again. A real AML check reads public blockchain history, so it needs only your public address: no wallet connection, no signature, no approval.

How token approvals work

ERC-20 is the standard behind most tokens on Ethereum, including USDT and USDC there. It has a function called approve. It lets a spender withdraw from your account many times, up to an amount you set. A second function, allowance, shows how much that spender may still take. The spender then uses transferFrom to move tokens on your behalf.^[1]

This is how decentralised exchanges and other apps work. You approve once, and the app can pull tokens when you trade. The same feature is what a drainer uses. Once a malicious contract holds an allowance, it can call transferFrom whenever it wants, up to the limit.

The limit is often "unlimited". Ethereum.org explains that many apps ask for an unlimited allowance so you do not have to approve and pay fees again each time. It warns that approvals do not expire. A malicious or backdoored platform can use them years later and keep spending your tokens.^[2]

Permits: approvals by signature

An approval is normally a transaction you pay for. EIP-2612 added permit, which does the same job with a signed message. You sign it off-chain. Any address can then submit that signature to the token contract, which sets the allowance as if you had called approve.^[3]

Two details matter for safety:

• You do not pay gas. The point of the standard is that the owner does not need ETH to approve. So a permit request may not look like a payment at all.^[3]
• Deadlines can be very long. A permit has a deadline. Set to the maximum value, it effectively never expires.^[3]

Uniswap's Permit2 extends the idea to any ERC-20 token. You give the Permit2 contract a one-time standard approval for a token; the docs often suggest the maximum amount. After that, spenders get permissions through signatures. Its AllowanceTransfer module keeps a standing allowance with an expiry time. Its SignatureTransfer module allows a single transfer per signature.^[4]

In plain terms: a wallet pop-up that asks you to sign, not send, can still hand over spending rights.

What a drainer is

The FBI described this pattern in an August 2023 alert. Criminals hijacked or cloned the social media accounts of NFT projects and posted links to fake mints. Victims who connected their wallets to the spoofed sites were linked to a "drainer smart contract". It moved their crypto and NFTs to wallets the criminals controlled.^[5]

The bait changes; the mechanism stays. A fake AML checker is a good bait. People who are worried about tainted funds want an answer quickly. A page that says "connect your wallet to verify your funds" sounds reasonable. It is not. Our guide to fake AML checkers lists the warning signs.

Why a real AML check needs only an address

An AML or KYT service looks at where funds came from and where they went. That data is public. It needs your address and nothing else. It has no reason to:

• ask you to connect a wallet;
• ask you to sign a message or a permit;
• ask for an approve or any other transaction;
• ask for your recovery phrase.

Ethereum.org is blunt about the last one: never share your recovery phrase or private keys, for any reason.^[6] See how free AML checks work and how to check USDT before you receive it.

How to review and revoke approvals

Etherscan's Token Approval Checker lists the contracts allowed to spend your tokens. It covers ERC-20, ERC-721 and ERC-1155 approvals and shows a total "value at risk". You connect your wallet, select approvals and revoke them; Etherscan says revoking stops those contracts or addresses from spending your assets.^[7]

Here a wallet connection is normal, because you are changing your own permissions. The danger is a fake revoke page. Type the address yourself or use a bookmark.

Ethereum.org's guide sets out the steps:^[2]

1. Open a revoke tool and connect your wallet.
2. Make sure the wallet and the tool are on the same network. Only that network's approvals appear.
3. Choose what to revoke. If unsure, you can revoke everything and approve again later.
4. Confirm the revoke transaction. It costs a network fee.

Ethereum.org lists Etherscan, Blockscout, Revoke.cash, Unrekt and EverRevoke as tools.^[2] Revoking does not bring back tokens already taken. Transactions on Ethereum are irreversible.^[6]

What to do

1. Never connect a wallet to an AML checker. Paste the address instead.
2. Read every wallet prompt. "Approve", "Permit" and "Sign" can all grant spending rights.
3. Avoid unlimited allowances. Approve only what one transaction needs, as ethereum.org advises.^[6]
4. Review approvals regularly and revoke the ones you no longer use, on every network you use.
5. If you signed something suspicious, revoke at once and move remaining funds to a new wallet.
6. Report the site to the FBI's IC3 at ic3.gov, as the FBI alert asks, or to police where you live.^[5]

This is general information, not legal or security advice for your situation. Compare checkers that work from an address alone on our services page.