Most crypto scam advice stops at “never share your seed phrase.” This one is about the attack that does not need it. Here is what a token approval actually authorizes, why the dangerous version now arrives as a signature rather than a transaction, and how to audit and revoke what you have already granted. Part ofKnow the Scam by SimpleSwap.

You can lose every token in a wallet without ever revealing your seed phrase, without your private key leaving your device, and without anyone breaking a single piece of cryptography.

You approve it. That is the entire attack.

Wallet drainers took $83.85 million from 106,106 victims in 2025 alone, and among incidents exceeding $1 million, 38% involved Permit-style approvals. The mechanism is not exotic. It is a standard, legitimate feature of how tokens work, pointed at the wrong contract.

What an approval actually is

ERC-20 tokens do not move the way ETH does. A contract cannot simply take your USDC; you have to permit it first, and that permission is called an approval or allowance.

The flow has two steps:

1. You call approve(), naming a spender contract and an amount. This does not move anything. It writes a permission into the token contract: this address may move up to X of my tokens.

2. The spender calls transferFrom(), pulling tokens up to that limit, whenever it likes, with no further confirmation from you.

Step two is the part people miss. The approval is not a one-time consent for the swap you were doing. It is a standing authorization that persists until you actively remove it.

Why “unlimited” is the default, and why that matters

Most applications request an unlimited allowance, because it means the user approves once instead of before every single interaction. It is a genuine usability decision, not a trick.

But it creates asymmetric risk. A contract with an unlimited allowance on your USDC can move your entire USDC balance, now or in two years, whether or not you ever use that application again. If the contract turns out to be malicious, or if a legitimate one is later compromised, the permission you granted for a $50 trade covers everything you hold in that token.

And these permissions accumulate silently. Anyone who has used DEXs for a couple of years is carrying a list of live allowances they have entirely forgotten about.

The dangerous evolution: approvals that arrive as signatures

Here is the part that makes current attacks so effective, and it is where the “just read the transaction carefully” advice quietly breaks.

Newer standards, EIP-2612 permit and Uniswap’s Permit2, let you authorize a spender by signing an off-chain message instead of sending an on-chain transaction. No gas, no confirmation screen showing a token contract, no pending transaction. Your wallet shows what appears to be an ordinary “sign this message” request.

That is a real difference in how it looks to you. A traditional approval is a transaction, and wallets display transactions prominently, with the contract being approved and often the amount. A Permit signature is typed data, and wallets have historically presented it as a wall of fields or as a benign-sounding prompt to “verify your wallet” or “sign in.”

Then the attacker calls transferFrom(). Your tokens leave. The only thing you did was sign something.

This produces a counterintuitive tradeoff worth understanding, because most guides get it exactly backward:

• Permit2 is safer against stale approvals. Instead of dozens of forgotten unlimited allowances scattered across contracts, you approve one universal contract per token, and everything after that is a bounded signature with a deadline.

• Traditional approvals are safer against signature phishing, precisely because they require a transaction your wallet makes a fuss about.

Neither is better. The risk moved rather than disappeared.

The industry behind it

None of this is artisanal. Drainer kits are rented as a service, with the developer maintaining the malicious contracts and laundering pipeline while affiliates run the phishing and keep 75% to 95% of what they steal. That is why the same trick appears on hundreds of unrelated sites at once, and why the average victim lost $790: this is a volume business, engineered for scale rather than for whales.

How to audit and revoke, concretely

This takes about ten minutes and is the single highest-value piece of wallet hygiene most people have never done.

1. Open a revocation tool. Revoke.cash is the most widely used free and open-source platform, covering 100+ EVM networks. Etherscan’s token approval checker and MetaMask Portfolio do the same job. Type the address by hand or use a bookmark: phishing clones of revocation tools exist, which is a special kind of irony worth avoiding.

2. Review in read-only mode first. You can paste your public address without connecting a wallet. Sort from newest to oldest. If you suspect you recently signed something you should not have, do so.

3. Look for two things. Any allowance marked unlimited, and any contract you no longer recognize or use. Both are candidates for removal.

4. Revoke. This is an on-chain transaction and costs gas. As of March 2026, Etherscan supports batch revocation for EIP-7702 wallets, which substantially reduces the cost of clearing many approvals at once.

5. Check every chain you have touched. An approval on a network you used twice in 2023 is still live. Attackers deliberately route victims to less-monitored chains for exactly this reason.

6. Repeat quarterly. Treat it like changing a password. Approvals accumulate whether or not you are paying attention.

On Solana, the equivalent concept is a delegated token account, and Revoke.cash’s Solana mode or Sol Incinerator will show and clear them.

Three traps in the fine print

Disconnecting is not revoking. Removing a site from your wallet’s connected list stops it reading your address. It does nothing to the allowance, which lives in the token contract and remains active.

Revoking does not reverse anything. It removes future permission only. If a drainer already pulled your tokens, revoking prevents further loss but recovers nothing, because no one can undo a confirmed on-chain transfer.

Approving exact amounts is better where offered. Some interfaces let you set a custom allowance instead of an unlimited one. It costs an extra approval later. It also caps your maximum loss at the amount you actually intended to spend.

If you think you have already signed something

Move fast, in this order: revoke all approvals on the affected wallet, then transfer remaining assets to a completely fresh wallet that has never connected to any site, then stop using the compromised one. Preserve transaction IDs and screenshots, and report to your local cybercrime authority.

And treat anyone offering guaranteed fund recovery for an upfront fee as the follow-up scam, because that is reliably what it is.

Is SimpleSwap safe from this? Where our flow sits

A fair question to ask of any service, so here is the structural answer rather than a reassurance.

Approval phishing requires a wallet connection and a signature. A standard SimpleSwap exchange requires neither. You choose a pair, enter a receiving address, and then send funds from your wallet to a deposit address. There is no approve() call and no Permit signature, so no allowance is granted over your balance. So a standard swap adds nothing to your approval surface, and no allowance you hold is related to us.

That is a genuine structural property rather than a security promise, and the limits deserve to be said plainly. Any allowances you are carrying came from DEXs and dApps and will still be there after any number of swaps. And a swap that has confirmed on-chain cannot be reversed by us or anyone else, which is why the checks on this page belong before you sign, not after.

If a page claiming to be SimpleSwap asks you to connect a wallet and sign an approval, it is not our flow. Our only official domain is simpleswap.io.

What comes next

Each entry above will get its own breakdown in “Know the Scam by SimpleSwap“ over the coming months. Follow #KnowTheScam to catch every new one as it drops - phishing kits, fake support DMs, drainer contracts, the whole map: new scam, same hashtag, one place to check.

FAQ

What is a token approval in crypto? A permission you grant a smart contract to move a specific token from your wallet, up to a set amount. It is required for ERC-20 tokens to function in DeFi, and it persists until you revoke it, rather than expiring after a single use.

Can someone drain my wallet without my seed phrase? Yes, and this is the most common way it happens now. If you approved a malicious contract, or signed a Permit message on a phishing site, the attacker moves your tokens using the permission you granted. Your seed phrase is never involved.

How do I revoke token approvals? Use Revoke.cash, Etherscan’s approval checker, or your wallet’s built-in allowance manager. Connect or paste your address, find approvals marked unlimited or belonging to contracts you no longer use, and revoke them. It costs gas, and you need to check each chain separately.

Does disconnecting my wallet remove approvals? No. Disconnecting only stops a site from seeing your address. The allowance stays live on-chain until you explicitly revoke it.

Is SimpleSwap safe from approval phishing? A standard SimpleSwap exchange does not involve connecting a wallet or signing an approval, so it does not add to your approval surface. It also cannot remove allowances you granted elsewhere, and a confirmed transfer cannot be reversed. Our only official domain is simpleswap.io.

This article is for educational purposes only and is not financial or security advice. SimpleSwap’s only official domain is simpleswap.io.