What are the red flags of this scam?

A DM, ad, or random link invites you to claim a free airdrop, bonus, or exclusive NFT — the claim button opens a wallet permission dialog • The transaction in MetaMask or Trust Wallet says 'Approve' with no clear description of what is being approved — or lists 'Unlimited' as the spending amount • The site URL does not exactly match the official project domain — extra hyphens, different TLD, or a Vercel/GitHub.io subdomain • Wallet permissions appear as a gasless signature request (no ETH fee shown) — EIP-712 permits are just as dangerous as standard approvals but appear less alarming • After approving, nothing seems to happen — the drain often occurs hours or days later once you have stopped watching

What should I do if this happened to me?

Before clicking Approve in any wallet dialog, read every permission line — reject anything granting 'unlimited' or 'max' token access to an address you don't recognize • Never interact with a dApp, airdrop site, or NFT claim page linked via a DM, ad, or unsolicited message — go directly to the project's verified URL • If you already approved: revoke the permission immediately at https://revoke.cash (all chains) or https://allowance.bscscan.com (BNB Chain) • Treat every unsolicited 'free crypto' or 'exclusive airdrop' offer as a drain attempt — real airdrops do not require you to approve spending of your existing tokens • The drained crypto cannot be recovered once transferred; file a report with the FBI's IC3 to assist law enforcement tracking • Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

CRITICAL crypto Last reported: Sep 3, 2026 Share

Clicking "Approve" on a fake crypto site secretly grants a stranger permission to drain your wallet

Q: Is this a scam?

Yes. This is a documented scam pattern. You approve what looks like a routine transaction on a fake dApp, airdrop claim site, or DeFi popup — but it secretly grants unlimited spending permission to a scammer's address. Your tokens are drained silently minutes or days later.

You approve what looks like a routine transaction on a fake dApp, airdrop claim site, or DeFi popup — but it secretly grants unlimited spending permission to a scammer's address. Your tokens are drained silently minutes or days later.

Also known as: approval phishing scam, fake airdrop wallet drain, DeFi approval scam, token approval exploit, EIP-712 wallet drainer, crypto wallet drain no seed phrase

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Before clicking Approve in any wallet dialog, read every permission line — reject anything granting 'unlimited' or 'max' token access to an address you don't recognize
2 Never interact with a dApp, airdrop site, or NFT claim page linked via a DM, ad, or unsolicited message — go directly to the project's verified URL
3 If you already approved: revoke the permission immediately at https://revoke.cash (all chains) or https://allowance.bscscan.com (BNB Chain)
4 Treat every unsolicited 'free crypto' or 'exclusive airdrop' offer as a drain attempt — real airdrops do not require you to approve spending of your existing tokens
5 The drained crypto cannot be recovered once transferred; file a report with the FBI's IC3 to assist law enforcement tracking
6 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

Red flags

⚠ A DM, ad, or random link invites you to claim a free airdrop, bonus, or exclusive NFT — the claim button opens a wallet permission dialog
⚠ The transaction in MetaMask or Trust Wallet says 'Approve' with no clear description of what is being approved — or lists 'Unlimited' as the spending amount
⚠ The site URL does not exactly match the official project domain — extra hyphens, different TLD, or a Vercel/GitHub.io subdomain
⚠ Wallet permissions appear as a gasless signature request (no ETH fee shown) — EIP-712 permits are just as dangerous as standard approvals but appear less alarming
⚠ After approving, nothing seems to happen — the drain often occurs hours or days later once you have stopped watching

Known variants

Fake airdrop claim site: victim receives a DM or social media post announcing a free token airdrop. The claim site opens a wallet approval requesting unlimited token spending. The drain runs automatically once approval is granted.

Last seen: 9/3/2026
Gasless EIP-712 permit: victim is asked to 'Sign' a message (not a transaction) on a fake DEX or NFT marketplace. The signature grants a Permit() approval without any on-chain fee appearing, so the victim does not notice the allowance. Tokens are drained later via a separate transaction.

Last seen: 9/3/2026

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Known variants

Sources