Token Approval Security: The Permission That Drains Wallets

In 2022, the Wintermute hack cost $160 million. In 2023, approval-based drainers stole over $300 million from individual users — most of whom never even realized they'd signed anything dangerous. Token approval exploits are now one of the most common attack vectors in crypto, and they work because the permission system is genuinely confusing.

When you use a DeFi protocol, you sign a transaction granting it permission to move your tokens. Uniswap needs that permission to pull your USDC during a swap — legitimate. What catches people off guard is that the approval is usually for an unlimited amount, it never expires on its own, and it stays active whether or not you still use that protocol. Most wallets don't surface this clearly, which is why people are often surprised to find they've handed out dozens of these permissions.

How approval-based attacks actually work

The attack flow for a wallet drainer looks like this:

• 1.You visit a phishing site — a fake Uniswap, a fake NFT mint, a compromised Discord link
• 2.The site asks you to sign an "approval" transaction — it looks routine
• 3.The approval is for a drainer contract, not the real protocol
• 4.Once signed, the contract calls transferFrom() and moves your tokens immediately
• 5.The drain is complete in the same block — no second chance

The BadgerDAO exploit in 2021 worked differently — attackers injected malicious approval requests into the legitimate site itself. Users approved what looked like normal protocol interactions. $120 million drained.

What to look for before you click Approve

Most approval requests show you three things: the token being approved, the spender address, and the amount. Read all three.

• —Spender address — does it match the protocol you're using? Paste it into Etherscan and check
• —Amount — is it unlimited (usually shown as a very large number)? If you only need to trade $100, approve $100
• —Is the approval for a contract you've heard of? Unknown contracts asking for token approvals are a red flag

Safer approval habits

You don't need to stop using DeFi. You need a few habits that reduce your surface area:

• —Set a spending limit instead of approving unlimited — most protocols let you input a custom amount
• —Revoke approvals from protocols you no longer use (revoke.cash makes this easy)
• —Run a monthly approval audit — an active DeFi wallet often has 50+ active approvals
• —Use a hardware wallet for large holdings — approval exploits require your private key to sign, and hardware wallets make phishing much harder

Frequently asked questions