Read Before Claiming: How to Avoid Malicious Signature / Approval Scams
A lot of people think: "I never gave anyone my seed phrase or private key, so my wallet is safe." That thinking is missing a piece — and that piece is exactly where the most people come unstuck. In the decentralized world, you don't have to hand over your keys; you only have to tap "confirm" in a window a malicious site designed, and they can legally move your coins out. It's not that the hacker is so skilled — it's that you "authorized it yourself." Binance Academy's explainer on token approvals and revoking them also lists this as a key part of wallet security.
Claiming airdrops, playing DeFi, interacting with any smart contract — nearly all of it runs through the two actions of signing and approving. Understand them, and know which kind to be especially careful with, and you can call a stop before you tap confirm. This guide spells it out from the top.
No private key given, so how are you still drained
Set up one key idea first: on a blockchain, there are two paths to "moving your assets." One is you initiating a transfer yourself; the other is you approving some smart contract so it "can move a certain token on your behalf later." That second path is the very foundation that lets DeFi work — you approve the exchange contract to spend your USDT, and only then can it swap coins for you; but bad actors use the same path, and one tricked approval lets them move coins out without your knowledge.
So here's the crux: being drained isn't necessarily because you leaked your keys — often it's because you "signed the wrong thing." The keys are still in your hands, but the approval permit you issued has given the other side the right to touch your assets.
An analogy makes it clearer. A private key is like the key to your house — give it away and the whole place is gone; an approval is more like signing a letter of authorization that lets someone "come into a certain room later and carry things out." You think you're signing "let the system claim my airdrop," but what you actually sign is "permit this stranger to come move this kind of coin out whenever they like." You've kept the key the whole time, but a letter of authorization handed to the wrong person ends just as badly. This is why so many victims are baffled afterward: "But I never told anyone my password!" — the problem isn't the password, it's that letter of authorization you signed with your own hand.
Signing vs. approving — what's the difference
The windows your wallet pops up fall roughly into two big categories, with very different danger levels:
| Type | What it's doing | Risk |
|---|---|---|
| Sign a message (signature / sign message) | Mostly logging in or proving you own this address; doesn't directly move on-chain assets, and usually costs no gas | Generally lower, but there's one "off-chain approval signature" exception — see the note below |
| Approve a transaction (approve / transaction) | Authorizes a contract to "spend a certain token of yours," or sends a transaction directly; costs gas | High. A malicious approve is the most common way coins get moved out |
What to be most alert to is approve (authorization). When the window says "allow such-and-such contract to use your USDT / USDC / a token," and the amount is "unlimited," you've effectively written a blank check. With that approval in hand, the other side can move all of that coin out at any time later. To understand more about how token approval works and its risks, ethereum.org's security page has a plain-language rundown.
How a malicious approve moves your coins out
Let me lay out the full script, and you'll see why this needs so much care:
- You're drawn in by a fake airdrop or fake site and connect your wallet (this step is still fine).
- The site pops up a window, the interface written to look like "claim airdrop" or "verify eligibility," but the actual content is to approve a contract it controls to spend a certain token of yours, with an unlimited amount.
- You hit confirm without looking closely and pay gas. On the surface "nothing happened," and you might even think the airdrop didn't come through.
- But the other side now holds the approval. They can call that contract — immediately, or days later once you've forgotten about it — and move your coins out in one go.
The insidious part is step three: at the time your balance hasn't dropped, there's no sense of being robbed, and almost no one notices — by the time the coins are actually gone it's usually after the fact. This is exactly why "check and revoke approvals regularly" matters so much, which we'll come to.
There's an even sneakier play: some attacks don't strike at the time but "farm" your approval, waiting until your wallet builds up to a certain amount, or until you've long forgotten about it, to clear it in one sweep. The moment you approve, it's like fitting yourself with a switch they can flip whenever they want. Which is precisely why "don't approve carelessly when there's no need, and clear out the approvals you have regularly" is the basic skill of wallet safety.
Two of the most common scam scenarios, unpacked
Now that the principle's covered, let me unpack the two most common in practice, so you'll recognize them next time.
Scenario one: the "unlimited approve" on a fake airdrop claim page. You see a project airdrop in a community, click into a very official-looking site, connect your wallet, and hit "Claim." The wallet pops up a window — you think you're claiming coins, but the actual content is an approve, authorizing the contract behind the site to "spend a certain token of yours, unlimited amount." You confirm without looking closely and pay a little gas; the screen shows success, but you've "received no airdrop," and you assume the project just hasn't sent it yet. In fact you just handed over the right to withdraw that coin — a few days later, when you've forgotten, one command from the other side empties it. The key to spotting it: claiming an airdrop normally only needs you to sign a message to verify your address; it shouldn't ask you to approve spending a token — the instant you see approve, see "spend your USDT/USDC," stop.
Scenario two: the Permit / Permit2 "off-chain signature" trap. This one is sneakier and doesn't even cost gas. A phishing site asks you to "just sign to verify," the window showing a signature rather than a transaction, and you think "signing doesn't cost anything" and sign. But there's a standard called Permit, Permit2, that lets you authorize the other side to spend your tokens with an off-chain signature — that harmless-looking slip is, in essence, a letter of authorization. It doesn't go on-chain, costs no gas, and leaves no trace even a block explorer can see at the time; only when the other side takes your signature and executes it on-chain do the coins disappear. The key to spotting it: whether the window is called "sign" or "approve," the moment it mentions allowing some address to spend a certain token of yours, or shows Permit or an amount, treat it as high-risk; being rushed to sign something you don't understand is itself a signal.
What the two scenarios share: you "think" you're doing something harmless, but you actually hand over the right to withdraw your assets. The thing to judge by is always the window's actual content.
Reading the window your wallet pops up
Stop reflexively hitting confirm. When a window pops up, take ten seconds for these few checks:
- Is this signing a message, or approving a transaction? Claiming an airdrop usually only needs a message signed; the moment you see approve, see a request to authorize spending one of your tokens, stop.
- What's the approval amount? Unlimited (unlimited / a long string of huge digits) is the most dangerous. Even if you do need to approve, prefer "approve only the amount needed this time."
- Which contract address is the other side? Paste that string into Etherscan or BscScan to check whether it's verified and whether it has a pile of suspicious records.
- Is the URL right? The source of many malicious approvals is a phishing site. Check the domain before entering, following the habit in wallet address check.
- If you don't understand it, cancel. This is the most useful one. Not understanding but being rushed to tap is itself a danger sign. MetaMask also has a safe-use guide worth reading.
Newer wallets often flag "this is an approval transaction" for you, or warn about suspicious sites, but tools are only an aid — the one tapping confirm at the end is you. Keep the judgment in your own hands.
Revoke regularly: take back old approvals
Even if you're careful, as long as you've played DeFi or claimed airdrops, your wallet has probably built up a pile of old approvals you've long forgotten. Any one of them, if the party originally approved turns out to be a problem, is a potential breach. The good news: approvals can be revoked.
The common method is to use an approval manager to list everything your address currently "has approved — which contracts, which coins, what amounts" — then revoke the ones you no longer need or that look shady, one by one. Revoking itself costs a little gas, but compared with being drained one day, that's a cost well worth it.
In practice you can use a tool like Revoke.cash to view and revoke approvals — connect your wallet (remember to check the URL first) and you'll see the list. I'd suggest building the habit: every so often, or after every new project you play with, go back and check once, and clear out the approvals you don't use.
How to self-audit? Two routes. One is to use an approval manager and paste your address in to view (you only need to connect the wallet when revoking, not to view the list); it lists which contracts your address has approved, which token each can spend, and the amount — focus on anything marked "unlimited," and any contract you don't remember or that looks dubious. The other is to use a block explorer: paste the address into Etherscan (Ethereum) or BscScan (BSC), which mostly have a "Token Approvals" page showing the same list, and let you check whether the contract is verified while you're there. Spot anything off, go back to the manager and revoke it.
If you do get drained, what to do first
A blunt but necessary fact first: blockchain transactions are irreversible, and coins already moved out are basically unrecoverable. So this section is about "stopping the bleeding" — saving what hasn't been taken yet.
- Immediately move the assets still in the wallet to another brand-new, safe wallet. Move fast — you're racing the other side.
- Go revoke the suspicious approvals. Use an approval manager to revoke every shady approve you can find, blocking its path to keep moving coins.
- Stop using this drained wallet from now on. Its private key or approvals may already be exposed — don't put anything back into it.
- Keep records, and report it if needed. Note down the transaction hashes, the other side's address, and the times. The odds of recovery are low, but keeping evidence is always right.
- Check your other wallets. If you derived multiple addresses from the same seed phrase, confirm whether the others are safe.
The worst thing to do when drained is to freeze or sign randomly in a panic. Remember the order: move out what's still there, then revoke approvals, then abandon the old wallet. Review which step went wrong afterward.
Editor's test: walking through approving and revoking
What actually broke us of a bad habit was the time we, on a whim, ran the main wallet we'd used across several projects through an approval manager. The moment it pulled the list up, we were a little stunned: a long row of entries, several contracts we couldn't even recognize by name, and the amount written after every single one was "unlimited." In other words, these contracts we'd long forgotten could in theory move the matching tokens out at any time — they just (so far) hadn't.
The first thing we realized that day: the information the wallet window gives you at the time of approving is actually enough to judge by — it's just that no one stops to read it line by line in that moment. The line "allow contract X to spend your token Y, amount unlimited" is written perfectly clearly; the problem was never that you can't see it, it's that you weren't looking. The second thing: revoking those unused approvals one by one, watching the list go from a long row to clean, costs a little gas, but the peace of mind is real. From then on we set a rule: after every new project we play with, we go back and clear the approvals once — don't leave "unlimited" hanging somewhere unguarded.
What you really need to take away is just three things: don't sign what you don't understand, approve only the minimum amount, and revoke when you're done. Do those three and you've avoided the most common and most costly class of on-chain disaster. It doesn't take coding skills or extra cleverness — just a willingness to slow down a few seconds before you hit confirm.
Approval scams are the easiest place to wreck yourself and the costliest when claiming airdrops, so they're worth the time to understand. To see what a fake airdrop looks like and how to spot one at a glance, carry on to 5 signs of a real vs. fake airdrop; for a systematic picture of the cons a wallet meets, see the 5 most common wallet scams; and since keeping your seed phrase safe is the bedrock of all of it, don't skip the seed-phrase storage guide. Walk the whole safety flow first, then go back to the complete airdrop guide to claim — it'll be much steadier.
If you're still in the prep stage and want an environment with support, where there's someone to ask if something goes wrong, you can start on an exchange. Use invite code BNB3311 to sign up for Binance and pick up the fee rebate while you're at it (the actual percentage is whatever Binance shows on its page and may change with their policy), then take this wariness about approvals into the on-chain world once you're comfortable.