Wallet Drainers and Token Approvals: How to Revoke Access

The message in the Telegram group looked like good news. A new project was "airdropping" tokens to early wallets, and the claim page took ten seconds: connect wallet, tap Claim, confirm. Tunde did all three, saw nothing arrive, shrugged and forgot about it.

Three weeks later, every USDT in that wallet left in a single transaction. Nobody had the seed phrase. Nobody had touched the phone. Back on that claim page, the wallet had simply given a stranger's contract permission to spend its USDT, and the stranger had come back to collect.

That permission is called a token approval. It's one of the most useful features in crypto and one of the most abused. Here's how it works, how drainers exploit it, and how to find and cancel the approvals sitting in your own wallet right now.

What a token approval actually is

On Ethereum and the networks built the same way (BNB Smart Chain, Polygon, Arbitrum, Base and others whose addresses start with 0x), tokens such as USDT and USDC are smart contracts. When you use a decentralised exchange, a game or an NFT marketplace, that app's contract has to move tokens out of your wallet on your behalf. It can't until you approve it.

An approval says: this contract (the "spender") may move up to this amount of this token from my wallet. The amount is called the allowance.

Three things about approvals catch people out:

• They don't expire. An approval you gave two years ago is still live today unless you cancelled it.
• Many are unlimited. So you don't have to approve again for every trade, plenty of apps ask for an unlimited allowance by default. Convenient, but it means that contract can take every unit of that token the wallet ever holds, including tokens that arrive next month.
• They're per token, per spender, per network. Approving a contract to spend your USDT on BNB Smart Chain says nothing about your USDC, or about your USDT on Ethereum.

If the spender is an honest app you use, an approval is usually fine. The trouble starts when the spender is a drainer, or when an honest contract you approved long ago is later hacked.

Tokens on TRON, including USDT on TRC20, use approvals too, so the same thinking applies if you use TRON apps.

How drainers get you to approve them

Drainers rarely ask for anything that looks dangerous. They wrap the request in something exciting, then rely on you tapping Confirm without reading. Here's what that looks like in practice:

What the page said	What your wallet asked	What it really meant
"Claim your airdrop"	Approve USDT, spending cap unlimited	The site's contract can take all your USDT, now or later
"Sign in" or "Verify wallet"	A signature request for a token permit	A gas-free signature that grants a spending allowance
"Free mint, mint now"	Permission to access all your NFTs in a collection	The contract can move every NFT you hold in that collection
"Sync your wallet to receive tokens"	Nothing: the site itself asks for your 12 or 24 words	Full control of everything. No real site ever asks for this

The links arrive the usual ways: replies under popular posts on X, Discord and Telegram DMs, hacked project accounts announcing a "surprise drop", and search ads for well-known apps. Our guide to NFT scams covers the mint and marketplace versions in more detail.

Signature requests deserve special mention. Many people think "it's only a signature, it doesn't cost gas, so it can't do anything". Some signatures, called permits, are exactly how a spending allowance is granted without a transaction. The thief then submits it and pays the gas. Treat an unexpected signature request with the same suspicion as an approval.

How to check and revoke your approvals

You can do this in about ten minutes, and you only need your wallet address to look.

1. Get to the real tool. Type your block explorer's web address yourself or use a bookmark. Don't follow a link from a DM, a group or a search ad. Fake "revoke your approvals" sites are themselves a popular drainer trick.
2. Find the approvals page. Most major explorers for 0x networks have a token approval checker, usually under a menu called something like More or Tools. Some wallets also have an approvals or security section built in.
3. Paste your address and pick the network. Looking is read-only. You don't need to connect anything just to see the list.
4. Read each line. You'll see the token, the spender (a contract address, sometimes with a name), the allowance (an amount or "unlimited") and when it was granted.
5. Decide what goes. Revoke anything you don't recognise, anything from a claim or mint page, and unlimited approvals for apps you no longer use.
6. Connect and revoke. Connect your wallet, tap Revoke next to an approval, and check what your wallet shows before you confirm: the right token, the right spender, an allowance going to zero.
7. Repeat on every network you've used. An approval on BNB Smart Chain won't show on the Ethereum page.

Each revoke is a transaction, so you need a little of the network's own coin for gas. If that's new to you, see why you need TRX or BNB to send USDT: the same idea applies to revoking.

One common misunderstanding: disconnecting a site in your wallet's "connected sites" list is not the same as revoking. Disconnecting stops the site seeing your address. The approval stays on the blockchain until you revoke it.

When revoking is too late

Revoking protects you from a contract you approved. It does nothing if someone has your seed phrase or private key, because they can sign anything as you.

If you typed your words into a website, gave them to "support" or stored them where someone could find them, treat the wallet as burnt. Create a new wallet with a new seed phrase on a device you trust, and move what's left as quickly as you can. Be aware that thieves often run "sweeper" bots on compromised wallets that grab any gas coin you send in. If your gas keeps vanishing seconds after it lands, stop sending it: you're feeding the bot.

Our seed phrase guide explains how to set up the new wallet properly, and what to do in the first hour after a hack walks through the rest.

Use two wallets: a vault and a burner

The simplest protection costs nothing. Keep two self-custody wallets:

• The vault holds the crypto you care about. It never connects to a new site, never claims an airdrop, never mints.
• The burner holds only what you're happy to lose. This is the one you connect to new games, mints and claim pages.

If a burner gets drained, you lose pocket money, not your savings. When something you did in the burner pays off, move it to the vault or cash it out. The same approach works for blockchain games, which we cover in Web3 gaming safety.

A few habits make both wallets safer:

• Read every prompt. If your wallet lets you edit the spending cap, set it to the amount you actually need rather than unlimited.
• Be suspicious of "claim" and "free". Real airdrops rarely need you to approve a token you already hold.
• Check approvals once a month. Put it on the calendar, the way you'd check your bank statement.
• Know what a hardware wallet does and doesn't do. It keeps your keys offline, but if you use it to approve a drainer, the approval is just as valid.

Where KWIQ fits

When you're ready to turn crypto in a self-custody wallet into naira, you don't need to connect it to anything. Open the coin's wallet in the KWIQ app, copy the deposit address, and send from your wallet on the network the app shows. Swapping crypto to naira is free, and you see the rate and the naira amount before you confirm. Our MetaMask to Nigerian bank guide shows the steps.

Spend ten minutes on your approvals today, then keep your experiments in the burner. When you want naira, download the KWIQ app, or create a free account on the web if your phone is short on space.