Wallet Drainers: What You Really Approve When You Confirm, and How to Take It Back

The information provided in this article is for informational purposes only and does not constitute financial advice. Investing in cryptocurrencies carries a high level of risk. Most emptied wallets were never hacked. Nobody guessed the seed, nobody broke into a device. The owners tapped "confirm" themselves, and in doing so allowed a stranger's contract to move their tokens whenever it likes. That is the decisive difference from everything you have read about wallet security: a wallet drainer does not need your private key. All it needs is an approval you granted once. It does not expire, it is often unlimited in amount, and it does not show up in your transaction history. It only becomes visible when you go looking for open approvals on purpose. The key points at a glance Token approvals under the ERC-20 standard have no expiry date, because the standard provides for none. How large the approval is set is decided by the application, and many enter a practically unlimited ceiling by default.A wallet drainer exploits exactly that: it needs no seed, only a confirmed approval.Since EIP-2612 ("Permit"), a signature without a transaction of your own is enough for this. It costs you no ...