Wallet drainers
You never sent anything, and the wallet emptied anyway. This is what the approval you signed actually permitted.
People describe this as being hacked, which is understandable and misleading. Nothing was broken into. A permission was granted, by you, in a window you clicked through, and the permission was then used exactly as written.
Signing is not the same as sending
Your wallet does two different things and presents them almost identically.
A transaction moves something now. You see an amount, a destination and a fee, and when you confirm, that specific thing happens once.
An approval grants permission for later. A contract is allowed to move a token from your wallet, up to some limit, whenever it wants, until you withdraw the permission. Nothing moves at the moment you sign, which is precisely why it does not feel dangerous.
The gap between signing and losing can be weeks
An approval sits quietly until someone uses it. This is why people cannot work out what they did wrong — the click that mattered happened long before the wallet emptied.
Approvals are not a flaw. Every exchange of one token for another needs one, which is why they became normal, and why granting them stopped feeling like a decision.
The unlimited default
Most approval requests ask for an unlimited amount, because it saves the user paying a fee again next time. It is convenient and it is the reason so many losses are total rather than partial.
An unlimited approval on a stablecoin means the contract may move every unit you hold now and every unit you ever hold in future, at a time of its choosing. If that contract is malicious, or is later upgraded by whoever controls it, the balance leaves in one transaction that you did not sign that day.
The signature that is not a transaction at all
The more modern version does not use an on-chain approval. It asks you to sign a message — no fee, no gas, sometimes described as "verify your wallet" or "sign in".
Message signatures are legitimate and widely used for logins. But some of them, under standards designed for convenience, are themselves permissions: a signed instruction that anyone holding it can submit later to move your tokens. It costs you nothing to sign, produces no on-chain record you can see afterwards, and hands over the same power as an approval.
"Free" is not the same as harmless
The absence of a fee is often used to reassure you. A signature that costs nothing can still be a permission, and it will not appear in your transaction history.
How you end up on the page
Drainers are not found by accident. They are delivered, and the delivery is the sophisticated part.
An airdrop appears in your wallet with a website name in the token's own title, so it is visible every time you open the app. A well-known project's account is compromised for two hours and posts a mint link. A search advertisement sits above the real result. A calendar invite, a job offer with a "test task", a Discord verification bot. All of them lead to a page that looks correct and asks for one signature.
Reviewing what you have already granted
Every approval you have ever given is public and readable, and can be withdrawn. This is worth doing once now and then on a schedule.
- Open a block explorer for the network you useEtherscan, BscScan, Solscan and their equivalents each have a token-approval tool. Navigate there yourself rather than following a link.
- List the approvals for your addressYou will usually find more than you expect, and several of them unlimited, from sites you used once and forgot.
- Revoke everything you do not currently needEach revocation is a transaction and costs a fee. Do the unlimited ones and the unfamiliar ones first.
- Repeat every few monthsApprovals accumulate silently. A short review twice a year keeps the surface small.
Habits that cost nothing
Keep the wallet you experiment with separate from the wallet that holds your savings. A drainer can only take what the signing wallet can reach, and this single separation turns a catastrophe into an annoyance.
Read what the wallet is asking before confirming. Modern wallets increasingly say "this site is requesting permission to spend your USDT" in plain language, and that sentence is the whole warning.
Treat unlimited as a decision rather than a default — most wallets let you edit the amount down to what the transaction actually needs.
And when a page appears in front of you asking to connect and sign, ask how you arrived at it. If the answer is anything other than "I typed the address", close it.