TLDR
Approval phishing is a crypto scam where victims are tricked into signing a wallet transaction that grants attackers standing permission to spend or transfer tokens. Unlike classic phishing, victims often see no immediate loss, but the...
How it works
Approval phishing is a crypto scam where victims are tricked into signing a wallet transaction that grants attackers standing permission to spend or transfer tokens. Unlike classic phishing, victims often see no immediate loss, but the...
Red flags
- : A website or dApp asks you to "approve" or "set spending cap" before you can claim an airdrop, mint an NFT, or fix a stuck transaction. The approval request is unlimited (no custom cap) or targets a token contract you did not intend to interact with. The prompt appears via Discord, X, or Telegram link from an unverified account promising free rewards
What to do
- 1: Revoke unused or unlimited token approvals regularly using tools like Etherscan Token Approvals or Revoke.cash. Never sign a wallet popup you did not initiate from a trusted dApp
- 2read the contract address and permission scope carefully. Use a separate hot wallet for interacting with new or unverified dApps, and keep long ter
Source
chainalysis
Source reviewed by Mythos Forensic Team
https://www.chainalysis.com/blog/what-is-approval-phishing/FAQ
Is Approval Phishing: How a Single Signature Drains Your Crypto Wallet a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
: A website or dApp asks you to "approve" or "set spending cap" before you can claim an airdrop, mint an NFT, or fix a stuck transaction. The approval request is unlimited (no custom cap) or targets a token contract you did not intend to interact with. The prompt appears via Discord, X, or Telegram link from an unverified account promising free rewards
What should I do first?
: Revoke unused or unlimited token approvals regularly using tools like Etherscan Token Approvals or Revoke.cash. Never sign a wallet popup you did not initiate from a trusted dApp; read the contract address and permission scope carefully. Use a separate hot wallet for interacting with new or unverified dApps, and keep long ter
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.