Approval Scam
An approval scam tricks you into granting a malicious smart contract permission to move your tokens. You never send anything yourself; the attacker later uses the permission you signed to take the tokens out of your wallet.
Why an approval is so powerful
On Ethereum and similar networks, tokens such as ERC-20 coins or NFTs cannot be moved by an app unless you first give it permission. This permission is called an approval or token allowance. Legitimate apps need it: a decentralized exchange must be allowed to take your USDC before it can swap it for you.
The catch is that an approval stays in place after you close the website. Whoever controls the approved address can move the approved tokens at any time, up to the approved amount, without asking you again.
How the scam works
The attacker builds a page that looks like a real app, a mint, an airdrop claim or a wallet verification step, and spreads it through fake social media accounts, ads, hacked Discord servers or direct messages. When you connect your wallet, the page asks you to approve a token or sign a message. The request looks routine, but the spender is the attacker's contract.
Modern variants often avoid an on-chain transaction entirely. Signature-based permits let you grant an allowance by signing a message, which costs no gas and may look harmless. For NFTs, one approval for all can hand over an entire collection.
A realistic example
Say you hold 5,000 USDC and see a post promising a bonus for early users of a well-known protocol. The link leads to a convincing copy of the site. You click Claim, your wallet shows an approval request, and you confirm it. Nothing happens at first. A few minutes or weeks later, the attacker's contract transfers all 5,000 USDC out. On the blockchain this looks like a normal, authorised transfer, so there is no one to reverse it.
How to protect yourself
Reach apps only through bookmarks or official links you have checked, never through ads or messages. Before confirming, read who the spender is, which token is affected and how much. Be suspicious of any claim, verification or gasless signature request you did not expect. Use a separate wallet with small balances for experiments, and keep long-term holdings in a wallet that never connects to new sites.
Check your existing approvals now and then with a token approval checker on a block explorer, and revoke the ones you no longer need. Revoking stops future theft but cannot recover tokens already taken.
Ask Coach about it
Coach is the AI on AtenaCrypto. It explains crypto with live market data, in plain words.
How do I read a wallet approval request and spot whether the spender is legitimate?Ask Coach →
Frequently asked questions
Can I get my tokens back after an approval scam?
Usually not. The transfer was technically authorised by your approval, and blockchain transactions cannot be reversed. You can still revoke the approval and move remaining funds to a fresh wallet to limit further losses.
Does revoking an approval cost money?
Revoking is an on-chain transaction, so it costs a network fee. On busy networks this can be noticeable, but it is usually small compared with the value it protects.
Is signing a message safer than approving a transaction?
Not always. Some signatures, such as token permits, grant the same spending rights as an approval. If you cannot understand what a signature request does, do not sign it.
Related terms
Learn it step by step
AC Learning explains these ideas in interactive lessons — the first eight sections are free.
Open AC Learning → Create a free accountAll glossary terms · Educational reference only — not investment, legal, tax or financial advice.