MSTR Cat

Crypto Law/Level IV · Holders' traps/4.2 Scams the law sees/Lesson 3

Wallet drainers and approval scams

How a signature you give a website can let someone else empty your wallet, what the token standards actually permit, and where the law stands when consent was obtained by deception.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Free first line: read every signature request, reject unlimited approvals and permit signatures on sites reached by message, ad or airdrop; ERC-20 approvals and ERC-2612 permits stay usable until spent, revoked or expired.
  2. Revoke stale approvals with a block explorer’s token approval checker, as the FBI recommends; each revocation costs only a network fee and cannot undo an earlier theft.
  3. Keep most assets in a separate wallet that never connects to websites and use a low-balance wallet for apps; transfers between your own wallets are not US-taxable, but keep basis records for each.
  4. After a drain, record hashes and report free to ic3.gov at once, since funds reaching an exchange or freezable stablecoin can sometimes be frozen; a phrase typed into a site means moving everything to a new wallet.

MaterialsThe ERC-20 token standard text, sections on approve and transferFrom (eips.ethereum.org)ERC-2612, the ‘permit’ extension that lets approvals be granted by a signed messageFBI public service announcement I-072122-PSA (21 July 2022) on liquidity mining scamsA block explorer’s token approval checker, used to view the approvals on your own address

Wonder

  1. How can someone empty my wallet if I never told anyone my seed phrase?
  2. What exactly am I agreeing to when a website asks me to connect or sign?
  3. If I clicked ‘approve’ myself, is it still theft in the eyes of the law?

Explore

  1. A wallet drainer is a malicious website, app or smart contract that tricks a wallet owner into signing something that lets the attacker move the owner’s assets. Unlike a stolen seed phrase (lesson 4.1.5), the owner’s own signature does the work, so the wallet treats the theft as authorised. Connecting a wallet to a site normally just shares your public address; the danger lies in the requests to approve or sign that follow. Drainers arrive through fake airdrops, fake mint pages, lookalike sites, search ads and fake ‘support’ messages (lesson 4.2.4). Because the result is an ordinary blockchain transfer, no operator can reverse it (lesson 1.1.6).
  2. The mechanics come from the token standards. Most tokens on Ethereum and similar chains follow ERC-20. Its approve function lets a ‘spender’ withdraw from your account ‘multiple times, up to’ an amount you set, and transferFrom is how the spender then moves the tokens. Decentralised exchanges and other apps use approvals for legitimate reasons, and many interfaces request a very large or ‘unlimited’ amount for convenience. An approval stays in force until it is used up or changed. So an approval given to a malicious contract can be used days or months later to take every token of that type, including tokens received after you signed.
  3. Two newer features widen the risk. ERC-2612, a final Ethereum standard, adds a permit function that sets an approval through a signed message instead of an on-chain transaction; whoever holds the signature can submit it before its deadline. A pop-up that seems to say ‘sign to log in’ or ‘sign to claim’ can therefore be a permit, with no fee and no transaction to warn you. For NFTs, the ERC-721 standard’s setApprovalForAll lets an ‘operator’ manage all of an owner’s tokens in a collection. Some drainers skip approvals altogether and ask for the seed phrase on a fake form, which hands over the whole wallet.
  4. The FBI has documented these patterns. Its July 2022 alert on ‘liquidity mining’ scams described victims promised a guaranteed return of 1 to 3 percent a day, who linked their wallets and accepted a pop-up designed to mirror the wallet’s interface, unknowingly authorising scammers to pull an unlimited amount; it counted over $70 million in losses since January 2019. A June 2025 alert described NFT ‘airdrops’ on the Hedera network whose memo links led to sites that asked for seed phrases. Both alerts treat the result as theft, and the FBI recommends periodically using a third-party token allowance checker.
  5. In US law, permission obtained by deception is not real consent. A scheme to obtain property by false pretences using the internet is wire fraud under 18 U.S.C. §1343, with up to 20 years in prison, and state theft laws generally cover property obtained by deception. Being able to sue or prosecute is a different matter from getting the assets back, because drainer operators are often anonymous and abroad. For tax, IRS Chief Counsel Memorandum 202511015 treated losses from phishing and hacked accounts held for investment as deductible theft losses; it concerned bank and retirement accounts, so how it applies to a drained wallet depends on the facts.
  6. Practical checks: read what a signature request actually authorises, including the spender’s address and amount; treat any request on a site you reached through a message, advert or airdrop as suspect; and review and revoke old approvals with an approval checker. Revoking is itself a transaction that costs a network fee, and it cannot undo a theft that has already happened. If you ever typed your seed phrase into a website, revoking approvals is not enough, because the whole wallet is exposed. After a drain, record the transaction hashes and addresses and report promptly (lesson 4.2.7), because funds that reach an exchange or a freezable stablecoin can sometimes be frozen.

Key facts

  • Under the ERC-20 standard, approve allows a spender to withdraw from an account multiple times, up to the approved amount.
  • ERC-20’s transferFrom function lets an approved spender move tokens on the owner’s behalf.
  • ERC-2612 adds a permit function that changes token allowances using a signed message rather than an on-chain transaction sent by the owner.
  • The ERC-721 function setApprovalForAll authorises an operator to manage all of an owner’s NFTs in that contract.
  • FBI alert I-072122-PSA reported over $70 million in losses since January 2019 from liquidity mining scams that used wallet permissions.
  • Wire fraud under 18 U.S.C. §1343 is punishable by up to 20 years in prison, or up to 30 years if it affects a financial institution.

Exercise nine, six, three, one

9CollectList up to 9 kinds of wallet prompts or requests you have seen, such as connect, approve, permit, set approval for all, sign a message, enter a seed phrase, or claim an airdrop.
6ClusterSort them into 6 categories: sharing an address, token approvals, signed messages, NFT operator approvals, direct transfers, and requests for secret keys or phrases.
3DistillReduce the 6 categories to 3 levels of risk: harmless on its own, risky if the site is malicious, and never safe to give to any website.
1CrystallizeWrite 1 sentence describing what you would want to know before signing any approval request in a wallet.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS