What Is a Wallet Drainer? How to Check and Revoke Token Approvals (2026)

Most crypto losses from phishing do not happen because someone "hacked" a wallet. They happen because the owner signed something. A wallet drainer turns a single click on Approve, Sign or Claim into permission to empty your wallet, and the blockchain treats that permission as fully legitimate.

We see the same pattern around token sales: every popular IDO, airdrop or token claim attracts copycat pages within hours. Below we explain how wallet drainers work, which signatures they abuse, how to check and revoke token approvals step by step, and the habits we recommend for anyone who joins launchpad sales.

What Is a Wallet Drainer?

A wallet drainer is phishing infrastructure, usually sold or rented as a "drainer-as-a-service" kit, that is deployed on a malicious website. Scam Sniffer, a Web3 anti-scam firm, defines it in its 2025 annual report (published December 2025) as infrastructure "that induces users to sign harmful transactions, enabling rapid asset extraction."

The kit does three things:

• Reads your wallet as soon as you connect, ranking your tokens and NFTs by value.
• Builds the most profitable request for what you hold: an approve for a large ERC-20 balance, a setApprovalForAll for an NFT collection, or an off-chain Permit/Permit2 signature for tokens that support it.
• Sweeps the assets automatically the moment you sign, often within seconds, and splits the proceeds between the kit operator and the affiliate who ran the phishing page.

Because you signed the permission yourself, there is no bug to patch and no transaction to reverse. That is what makes drainers different from smart contract exploits.

How Big Is the Wallet Drainer Problem? (2023–2025 Data)

Scam Sniffer tracks drainer phishing on EVM-compatible chains. Its figures are a lower-bound estimate because they only cover trackable drainer activity:

• 2023: about $295M stolen from roughly 324,000 victims.
• 2024: about $494M stolen from 332,000 addresses, with the largest single theft at $55.48M (Scam Sniffer 2024 report). In large cases that year, Permit signatures caused 56.7% of losses.
• 2025: $83.85M stolen from 106,106 victims, down 83% year over year. The largest single theft was $6.5M through a Permit signature in September 2025.

The drop sounds like good news, and partly it is: more wallets now warn before risky signatures. But Scam Sniffer itself warns that "lower losses ≠ gone threats." Losses in 2025 rose and fell with market activity (Q3 2025, the strongest ETH rally, was also the worst quarter at $31.04M), and new attack types appeared, including malicious EIP-7702 batch signatures after Ethereum's Pectra upgrade. When the market heats up and token sales get busy again, drainers follow.

What Is a Token Approval and Why Do Drainers Target It?

A token approval is permission you give a smart contract to move your tokens on your behalf. Revoke.cash explains it simply: if you want to trade on a decentralized exchange, you first allow the exchange contract to spend that token. The token contract stores this allowance and checks it every time the spender tries to move your funds.

Approvals are normal and necessary. The danger comes from two design choices:

• Unlimited amounts. To save users gas on repeat approvals, many apps request an unlimited allowance. If that spender is malicious, or a legitimate contract is later hacked, your whole balance of that token is exposed, not just the amount you meant to trade.
• No expiry. Standard ERC-20 approvals never expire. As Revoke.cash notes, established projects have been hacked and users who never revoked old approvals were "vulnerable even years after" they last used the project.

The four signatures drainers abuse most

• approve / increaseAllowance (ERC-20): an on-chain transaction that sets a spending allowance. Your wallet usually shows it as a request to spend a specific token.
• setApprovalForAll (NFTs): gives an operator control over every NFT you hold in one collection, not just one item. Marketplaces use it legitimately, which is why it does not always look suspicious.
• Permit (EIP-2612): an off-chain, gasless signature of structured EIP-712 data that authorizes a spender and an amount. Whoever holds the signature can submit it on-chain later and activate the allowance. Because it is "just a signature," many users sign without reading.
• Permit2 (Uniswap): a shared contract that brings permit-style approvals to any ERC-20 token. Per Uniswap's documentation, you first approve the Permit2 contract for a token, then grant spenders time-bound allowances (AllowanceTransfer) or one-time transfers (SignatureTransfer) by signature. If you have approved Permit2 for a token, a phishing page only needs one malicious Permit2 signature to take it. Scam Sniffer recorded a $1M loss through a Uniswap Permit2 signature in January 2025.

The same "you signed it, so it is valid" problem is behind the blind-signing trap we covered in our explainer on the Drift hack and Solana durable nonces, where pre-signed transactions were used long after the signer had forgotten about them. Different chain, same lesson: never sign data you cannot read.

How to Check Your Token Approvals

Before you can revoke anything, you need to see what you have already approved. Two free tools cover almost every EVM chain.

Option 1: Etherscan Token Approval Checker

1. Go to etherscan.io and open the Token Approvals page from the "More" menu in the top navigation (the route Revoke.cash describes in its guide).
2. Paste your wallet address or ENS name.
3. Choose the token type you want to inspect: ERC-20, ERC-721 (NFTs) or ERC-1155.
4. Turn on "Show all approvals" so limited approvals are not hidden.
5. Review each row: the token, the spender (the contract you approved) and the approved amount. Pay most attention to unlimited amounts and spenders you do not recognize.

Etherscan's checker only covers the chain you are browsing (Etherscan for Ethereum, BscScan for BNB Chain, Polygonscan for Polygon, and so on). If you are active on several chains, you need to repeat the check on each explorer, or use a multichain tool.

Option 2: Revoke.cash

1. Open revoke.cash and connect your wallet, or paste your address/ENS into the search bar.
2. Select the network you want to check; Revoke.cash supports 70+ chains from one interface.
3. Sort the approval list by "Newest to Oldest" if you suspect you recently signed something malicious, so the riskiest entries surface first.
4. Use the filter/search options to look up a specific spender address if you already have one flagged by a security alert.

Option 3: Your wallet's built-in approval manager

Some wallets, such as Rabby, include their own approval manager, and many show a warning before you sign a risky approval. Menu names and coverage change between versions, so check your wallet's official help docs for the current location. Treat a built-in manager as a quick extra check, not a replacement for a full scan on Etherscan or Revoke.cash.

How to Revoke a Token Approval, Step by Step

1. Identify the approval to remove. In Etherscan's checker or Revoke.cash, locate the row for the spender/token you want to cut off.
2. Click Revoke (Etherscan and Revoke.cash both use this label directly on the row).
3. Confirm the transaction in your wallet. Revoking is an on-chain transaction for standard approvals, so you pay a small gas fee, even though you are removing permission rather than granting it.
4. Wait for confirmation and refresh the approval list to confirm the entry is gone or its amount is now zero.
5. Repeat per chain. An approval on Ethereum does not affect the same token's approval on Arbitrum, Base or BNB Chain; each chain has its own allowance mapping.

If you only want to reduce risk on an app you still use, Revoke.cash also lets you edit the approved amount (the pencil icon next to the amount, per its own guide) instead of revoking it outright, for example lowering an unlimited approval to what you actually need.

Red Flags That Signal a Wallet Drainer Site

• A page claims to be a "claim," "airdrop" or "IDO allocation" portal and asks you to connect your wallet before showing any project-specific detail.
• The transaction your wallet previews is approve, setApprovalForAll or a Permit/Permit2 signature when the page only promised to let you "claim" or "check eligibility."
• The requested spender or approved amount looks unrelated to the token you are claiming, or the amount field shows an extremely large or "unlimited" number.
• Urgency language: countdowns, "limited slots," or warnings that the airdrop expires in minutes.
• The domain is a lookalike (extra word, different TLD, or a copy hosted on a generic subdomain) rather than the project's verified domain linked from its official X/Telegram/Discord.
• A fake CAPTCHA or "verify you are human" step appears right before the wallet signature request; Scam Sniffer's 2025 report notes drainers increasingly add these to dodge security extensions.

Kommunitas Angle: Verifying Claim and IDO Pages Before You Connect

Fake IDO, claim and airdrop pages are one of the most common bait patterns drainers use, because token sale participants are already expecting a page that asks them to connect a wallet and interact with a contract. That expectation is exactly what a copycat page exploits.

Before connecting your wallet to any claim or IDO page, including Kommunitas sales:

• Start from an official channel, not a search result or DM link. Navigate from the project's verified X/Telegram account or from kommunitas.net/launchpad directly, rather than clicking a link someone sent you.
• Check the domain carefully. Compare it character by character against the one posted in the project's official announcement; drainer sites commonly use extra hyphens, swapped letters, or an unfamiliar top-level domain.
• Read the wallet prompt before signing. If a "claim" page triggers a Permit/Permit2 signature or an unlimited approve instead of a simple claim transaction, stop and verify with the project team first.
• Treat urgency as a warning, not a reason to rush. A legitimate claim window rarely closes in the next five minutes.

This builds on the rug-risk checks we cover in How to Spot Rug Risks on Launchpads and the Crypto Presale Scam Checklist: verifying the page and the signature you are about to send is just as important as vetting the project itself.

After an IDO ends: revoke the sale contract approval

Once a token sale is complete and you have claimed or received your allocation, we recommend revoking the approval you granted to that sale contract if you no longer plan to interact with it. A completed sale contract does not need standing access to your funds, and leaving the approval active provides no benefit while keeping a theoretical attack surface open if that contract is ever compromised later. Make this a habit after every IDO you join, the same way you would clean up old subscriptions: check your approvals with Etherscan or Revoke.cash, revoke what you no longer use, and move on.

If you are still getting your wallet set up safely before your first sale, see our guide on backing up and recovering your seed phrase, and check how to get whitelisted for an IKO on Kommunitas for the legitimate steps a real Kommunitas sale actually asks for.

Limitations: What Revoking Cannot Do

Revoking approvals is a prevention and damage-control tool, not a recovery tool. Be clear-eyed about its limits:

• It does not return stolen funds. If a drainer already executed a transfer, revoking the approval afterward cannot reverse that specific theft; blockchain transactions are final.
• It can still prevent a second theft. Scam Sniffer documented a case where a victim who did not revoke after an initial theft of about $4M in Aave ETH later lost more funds through the same leftover approval: the drainer moved another 95 ETH, which triggered a liquidation and a further 158 ETH loss, even though Etherscan and security researchers had sent on-chain warnings to revoke.
• Revoking costs gas. Each revoke is an on-chain transaction, so cleaning up many old approvals across several chains adds up in fees; prioritize unlimited approvals and unfamiliar spenders first.
• It does not undo a compromised seed phrase. If malware or a fake wallet app captured your private key or seed phrase directly, rather than tricking you into an approval, revoking approvals will not help; you need to move funds to a new wallet.

Frequently Asked Questions

What is the difference between a wallet drainer and a regular phishing scam?

A regular phishing scam might try to steal your password or seed phrase directly. A wallet drainer specifically targets on-chain permissions: it gets you to sign an approval, Permit or Permit2 message that lets the attacker's contract move your assets, without ever needing your private key.

Does revoking a token approval cost gas?

Yes. Revoking a standard ERC-20 or NFT approval is an on-chain transaction, so you pay a small gas fee, just like when you granted it. A Permit signature that has not been submitted yet does not appear in approval lists until someone uses it, so if you think you signed a malicious one, move the affected tokens to a fresh wallet and revoke any approval that shows up.

Is it safe to use Revoke.cash or Etherscan's approval checker?

Both only read public on-chain approval data and let you send a revoke transaction that you confirm yourself in your own wallet; neither tool asks for your private key or seed phrase. Always type the URL directly or use an official bookmark rather than a search ad link.

How often should I check my token approvals?

Check after every IDO, airdrop claim or new dApp connection, and do a full review every few months even if you have not connected to anything new, since an app you approved long ago can later get hacked and any standing approval becomes a risk again.

Can a wallet drainer steal NFTs too?

Yes. The setApprovalForAll function, commonly used by legitimate NFT marketplaces, gives an operator control over an entire collection in your wallet. A phishing page that gets you to sign this for a malicious address can drain every NFT you own from that collection.

Ready to join a launchpad sale the safer way? Browse live and upcoming rounds on Kommunitas Launchpad, always starting from our official site rather than a shared link.

Last updated: November 2026.