WalletConnect Security: What You're Actually Approving When You Scan That QR Code

WalletConnect is the technology that lets desktop DeFi sites communicate with mobile wallets. The QR code you scan is a connection URI — an encrypted handshake that establishes a channel between the site and your wallet app. The protocol itself is legitimate and open-source.

The vulnerability is not in the protocol. It's in the fact that any site can display a WalletConnect QR code, and the familiar interface creates a sense of legitimacy. When you've scanned WalletConnect codes hundreds of times on real DApps, the UI pattern itself becomes a trust signal — which scammers exploit.

What WalletConnect actually does

When you scan a WalletConnect QR code, your wallet connects to a relay server specified in the URI. The DApp and your wallet can then exchange signed messages through this relay. This is how a desktop site — which can't directly access your mobile wallet — can request signatures and receive them.

Legitimate DApps use this to request token approvals, trade confirmations, and other on-chain actions. Your wallet shows you the request and asks for your confirmation before signing anything. The connection itself grants no permissions — only your explicit signature does.

How attackers use WalletConnect as a vector

The standard attack: a phishing site displays a real-looking WalletConnect QR code. When you scan and connect, the site immediately sends a transaction request to your wallet — typically a setApprovalForAll for your entire NFT collection, or a token transfer for your full balance. The request appears in your wallet just like a legitimate one.

Because the WalletConnect flow is familiar, and because the transaction request comes from within the wallet app where you feel in control, the social engineering is more effective than a standard phishing page.

A related attack uses QR code images distributed in Discord or Telegram. Someone posts a WalletConnect QR code in a server, claiming it's for a token claim or airdrop. Scanning it connects your wallet to a drainer. No fake website required — just an image.

What to verify before scanning any QR code

Check the URL before you scan. The QR code comes from the page you're on. Verify that the browser URL is exactly the DApp you expect — not a similar-looking domain, not a search result, not a link from Discord. Bookmark the real URLs and always navigate via bookmarks.

Never scan a WalletConnect QR from an image. Legitimate DApps generate QR codes on their sites in real time. A QR code posted as a screenshot in a chat is always suspicious. No real airdrop or token claim requires scanning a static image.

Close existing sessions before starting a new one. WalletConnect sessions can stack. If you already have an open session from a previous visit, a new connection from a phishing site can coexist with it — and both can request signatures.

Revoking WalletConnect sessions you no longer need

Most wallets list active WalletConnect sessions in their settings. Trust Wallet: Settings → WalletConnect. Rainbow: Connected apps section. MetaMask Mobile: Settings → Experimental → Connected Sites. Disconnect any session you don't recognize or no longer use.

Sessions don't automatically expire. A connection you made six months ago to a DApp you no longer use may still be active. While the connection itself can't drain your wallet, it's good hygiene to keep your active sessions minimal.

For managing token approvals granted through DApp connections, see our guide on revoking token approvals. For a broader overview of DeFi phishing techniques, read our DeFi phishing attacks guide.

Frequently asked questions