Malicious token and NFT approvals
A transaction that looks like a mint, claim or swap actually gives the attacker unlimited permission to spend your tokens or move all your NFTs.
How it works
On EVM chains, a contract can only move your tokens after you approve it (approve or increaseAllowance), and only move your NFTs after setApprovalForAll. Legitimate dapps use these all the time, which is why the trick works.
A drainer site dresses an approval up as something else, or batches it next to a real action. Once approved, the attacker's contract can pull the tokens whenever it likes, even weeks later.
Old approvals you forgot about are just as dangerous: if a dapp you once approved is compromised, the attacker inherits that permission.
Red flags
- An 'approve' or 'set approval for all' prompt on a site that shouldn't need one
- Unlimited (max) approval amounts
- A spender address your wallet can't name or flags as new
- NFT 'mint' pages that ask to approve your whole collection
Protect yourself
- Approve only the exact amount you need when your wallet lets you
- Check the spender address before confirming
- Clean up old approvals every few weeks with an approval checker
- Use a separate burner wallet for mints and new dapps
If you already signed
- Revoke the approval immediately; it costs a little gas but stops further pulls
- Move remaining tokens and NFTs to a fresh wallet
- Check every chain the wallet uses, not just Ethereum
Incidents using it 2
-
High✕Still active
Ethereum user loses 999,999 USDT after signing a phishing token approval
On 8 July 2026 an Ethereum user signed a phishing token approval and lost 999,999 USDT, nearly $1M, according to Scam Sniffer. The attacker used multicalls and pulled the funds out in three transactions. One signature on a fake site was enough to empty the stablecoin balance.
Ethereum USDT holder·Ethereum·$1000K stolen·Since Jul 8, 2026·
-
Critical✕Still active
Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange
In early July 2026 a crypto wallet holder connected to a fake exchange site and signed a malicious contract approval that gave the attacker unlimited spending rights. An automated sweeper then emptied the wallet of about $1.65 million. Anyone who signs approvals on unfamiliar trading sites is at risk; check and revoke token approvals you do not recognise.
A crypto wallet holder using a fake exchange site·Multiple EVM chains·$1.6M stolen·Since Jul 3, 2026·