How wallet drainers and approval phishing work
A link leads to a site that looks like a real crypto project, mint page, airdrop claim, or investment app. When you connect your wallet, the site asks you to sign a transaction or approval. Instead of what it claims, the approval gives the scammer permission to move your tokens, sometimes in unlimited amounts. The drainer then empties the wallet, often within minutes. Because you signed the approval, the wallet treats the transfers as authorized.
Warning signs of approval phishing
- A link from a direct message, reply, or hacked account urging you to claim, mint, or verify quickly.
- A site asks you to connect your wallet before you can see anything.
- A signature or approval request you do not fully understand, especially 'unlimited' spending.
- A pop-up asking you to 'approve' access to receive rewards.
- Promises of daily returns from connecting your wallet to a 'mining' or 'liquidity' app.
- A web address that differs slightly from the project's official site.
How to avoid wallet drainers
- Do not connect your wallet to sites reached through unsolicited links.
- Read every signature and approval request; reject anything you cannot explain.
- Keep most funds in a separate wallet that never connects to new sites.
- Review and revoke old token approvals regularly using a reputable allowance checker.
- Check the project's official website and verified channels before claiming anything.
Signed a malicious approval? What to do now
- Revoke any active approvals and move remaining assets to a brand-new wallet with a new recovery phrase.
- Follow the step-by-step checklist at /guidance/crypto-stolen-first-72-hours.
- Preserve evidence before anything disappears: screenshots of chats, profiles, websites and app screens, plus receipts, emails, and a written timeline. Do not delete conversations or the app. Record the malicious site address and your transaction hashes.
- Contact any exchange that received the stolen funds and ask them to flag the deposit.
- Report it to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov, even if the amount is small. Include wallet addresses, transaction IDs (hashes), amounts, dates, and every website, app, username, and phone number involved. See /guidance/report-crypto-theft-fbi-ic3.
- Watch for recovery scams. Anyone who contacts you offering to get your crypto back for an upfront fee, or who claims to work with the FBI or IC3, is likely a scammer. IC3 says it will never ask for payment to recover lost funds or refer you to a company that does. See /guidance/can-stolen-crypto-be-traced.
Wallet drainers: common questions
What did I actually sign?
Most likely an approval: a permission that lets another address move your tokens, sometimes in unlimited amounts. Because you signed it, your wallet treats the scammer’s transfers as authorized.
Will revoking approvals get my tokens back?
No. Revoking stops the attacker using that approval to take more. Getting stolen funds back depends on freezes, seizures or court action.
How do I revoke token approvals?
Use a reputable approval checker to see and revoke what your wallet has approved. Our first-72-hours checklist lists tools for each chain.
Can drained funds be frozen?
Sometimes, if they reach an exchange or a stablecoin issuer that can freeze them. Law enforcement does act: a U.S. Secret Service-led operation against approval phishing announced in April 2026 that it froze $12 million.
Approval phishing: by the numbers
- A U.S. Secret Service-led international effort against approval phishing, Operation Atlantic, disrupted more than $45 million in losses and froze $12 million (announced April 2026). (source)
This guide is general information, not legal or financial advice. ChainWatch is not a law firm and does not guarantee fund recovery.
Sources
- secretservice.gov/newsroom/behind-the-shades/2026/04/multi-national-operation-atlantic-tar
- ic3.gov/PSA/2022/PSA220721
- dfpi.ca.gov/consumers/crypto/crypto-scam-tracker/
- justice.gov/usao-edva/pr/canadian-cybercriminal-sentenced-year-prison-nft-theft-scheme
The information on this page was checked against the sources listed in September 2026. Laws, agency guidance, company policies and contact details change, so please verify the current information with the original source before you act.