Wallet Drainers: What You Really Approve When You Confirm, and How to Take It Back
The information provided in this article is for informational purposes only and does not constitute financial advice. Investing in cryptocurrencies carries a high level of risk.
Most emptied wallets were never hacked. Nobody guessed the seed, nobody broke into a device. The owners tapped "confirm" themselves, and in doing so allowed a stranger's contract to move their tokens whenever it likes.
That is the decisive difference from everything you have read about wallet security: a wallet drainer does not need your private key. All it needs is an approval you granted once. It does not expire, it is often unlimited in amount, and it does not show up in your transaction history. It only becomes visible when you go looking for open approvals on purpose.
The key points at a glance
- Token approvals under the ERC-20 standard have no expiry date, because the standard provides for none. How large the approval is set is decided by the application, and many enter a practically unlimited ceiling by default.
- A wallet drainer exploits exactly that: it needs no seed, only a confirmed approval.
- Since EIP-2612 ("Permit"), a signature without a transaction of your own is enough for this. It costs you no gas and does not appear in your history.
- An approval in the sense described here exists only for tokens. That does not make your ETH safe: since EIP-7702, a single signature delegates your address to a stranger's contract, which then moves native ETH as well.
- Old approvals can be revoked individually, through the token approval checker of the relevant block explorer or a revocation tool.
- After an incident the order matters: revoke every approval first, then move what is left into a fresh wallet.
What an approval is and why the wallet drainer needs it
When you swap a token on an exchange, two things happen. First you allow the exchange's contract to take that token out of your wallet. Then it carries out the swap.
โฆ Continue reading the full article at the original source below.
