Approval Phishing

What Is Approval Phishing?

Approval phishing is a social engineering attack targeting cryptocurrency users. The attacker creates a fraudulent website, fake airdrop claim page, or compromised decentralized application (dApp) that prompts the victim to sign a token approval transaction. Instead of performing a legitimate action, the transaction grants the attacker's smart contract or wallet address permission to transfer the victim's tokens without further consent.

What makes approval phishing particularly dangerous is the time gap between the approval and the theft. Unlike a direct transfer scam where funds leave immediately, an approval phishing attack establishes persistent access. The attacker can drain the victim's wallet minutes, days, or even months after the malicious approval was signed. In one documented case from 2024, an attacker waited 458 days between obtaining the approval and draining $908,551 in USDC from the victim.

How It Works

Approval phishing exploits the way ERC-20 tokens handle spending permissions. The ERC-20 standard includes an approve() function that lets a token holder authorize another address to spend tokens on their behalf. This mechanism was designed for legitimate use cases like allowing a DEX to execute trades. Attackers repurpose it as an attack vector.

The Attack Sequence

1. The attacker creates a convincing phishing site: a fake NFT mint page, a fraudulent airdrop claim, a spoofed DeFi protocol interface, or a fake token migration portal
2. The victim connects their wallet to the site, believing it to be legitimate
3. The site triggers a transaction that calls approve() on one or more token contracts, setting the spender to the attacker's address and the amount to the maximum value (2^256 - 1, representing unlimited access)
4. The victim sees a wallet confirmation prompt but does not recognize the significance of the approval, especially if the site labels it as "Claim," "Verify," or "Connect"
5. Once the approval transaction confirms on-chain, the attacker calls transferFrom() to move the victim's tokens to their own wallet

The approve() Function

The core vulnerability lies in how ERC-20 approvals work at the contract level:

// ERC-20 approve function signature
function approve(address spender, uint256 amount)
  external returns (bool);

// What the victim unknowingly signs:
approve(
  0xAttackerAddress,      // spender: attacker's contract
  type(uint256).max       // amount: unlimited token access
);

// What the attacker then calls:
transferFrom(
  0xVictimAddress,        // from: victim's wallet
  0xAttackerAddress,      // to: attacker's wallet
  victimBalance           // amount: all tokens
);

Permit Signature Variant

A more sophisticated version uses the EIP-2612 permit standard. Instead of requiring an on-chain approve() transaction, the victim signs an off-chain message (an EIP-712 typed data signature). The attacker then submits this signature to the token contract's permit() function to set the approval.

This variant is harder to detect because no approval transaction appears on-chain before the drain. Tools that audit on-chain approvals cannot see off-chain permit signatures. Revoke.cash, the most widely used approval management tool, explicitly notes that it cannot detect which permit signatures a user has signed because they remain off-chain until submitted.

Permit2 Exploitation

Uniswap's Permit2 contract consolidates token approvals into a single system. Users grant a one-time unlimited approval to the Permit2 contract, then use signed messages to authorize individual spenders. Attackers exploit this by phishing the Permit2 signature rather than the underlying token approval: one signed message can grant access to every token the victim has already approved to Permit2.

Scale of the Threat

Approval phishing is one of the highest-revenue crypto scam categories. Chainalysis tracked cumulative losses exceeding $1 billion from May 2021 through the end of 2023. The peak year was 2022, with an estimated $516.8 million stolen. In 2023, suspected losses reached approximately $374 million.

The scam is characterized by concentration: a small number of highly successful operators account for a disproportionate share of total theft. Chainalysis identified that the single most successful approval phishing address stole an estimated $44.3 million from thousands of victim addresses.

Actual losses are likely higher than reported figures. Many victims do not realize they have been phished until tokens are drained, and the connection between signing an approval and losing funds may not be obvious to less technical users. Chainalysis notes that approval phishing has structural similarities to romance scams, which are notoriously underreported.

Why It Matters

Approval phishing highlights a fundamental UX problem in token-based blockchains. The approve/transferFrom pattern is a core building block of DeFi, enabling DEXs, lending protocols, and yield aggregators to interact with user tokens. But the same mechanism creates a persistent attack surface that most users do not understand.

For payment-focused systems, this risk underscores the value of architectures that minimize or eliminate token approval surfaces. Bitcoin and its Layer 2 networks like Spark use a UTXO model where spending requires a direct signature over the specific transaction: there is no equivalent of a blanket spending approval that can be phished. This architectural difference means approval phishing is structurally impossible on UTXO-based systems.

Use Cases for Understanding Approval Phishing

• Security auditing: wallet providers and DeFi protocols implement approval simulation and warning systems to flag suspicious approval requests before users sign them
• Fraud detection: on-chain analytics firms like Chainalysis use approval patterns to trace scam networks and identify attacker infrastructure
• User education: exchanges and wallet apps surface approval management tools to help users understand and control their outstanding token permissions
• Protocol design: newer token standards and wallet interfaces incorporate limited approvals, expiring permissions, and clearer signing prompts to reduce the attack surface

Prevention and Mitigation

Before Signing

• Read the transaction details carefully: verify that the spender address matches the protocol you intend to use, not an unknown contract
• Use transaction simulation tools: wallets with built-in simulation show what a transaction will do before you confirm it, making disguised approvals visible
• Never sign approvals from unfamiliar sites: legitimate airdrops and token claims do not require unlimited token approvals
• Be cautious with blind signing: hardware wallets faithfully sign whatever the user confirms, so a signed approval on a Ledger or Trezor is just as dangerous as one signed in a software wallet

Managing Existing Approvals

• Use approval management tools like Revoke.cash to audit and revoke outstanding token approvals regularly
• Set limited approval amounts instead of unlimited: approve only the amount needed for a specific transaction
• Revoke approvals for protocols you no longer use: stale approvals are a persistent risk even if the original protocol was legitimate

After a Suspected Attack

• For on-chain approvals: immediately revoke the malicious approval via Revoke.cash or your wallet's approval manager; if your revoke transaction confirms before the attacker drains, the funds are safe
• For off-chain permit signatures: revocation tools cannot help because the signature is off-chain; transfer all tokens to a new wallet address immediately
• Report the phishing site to Chainabuse and your wallet provider to help protect other users

Risks and Considerations

Even security-conscious users face challenges with approval phishing. The phishing sites can be nearly indistinguishable from legitimate protocols, especially when attackers compromise DNS records or front-end code of real applications. The approval prompt in most wallets shows a contract address and token amount but does not clearly communicate the risk of granting spending permission.

For further reading on how stablecoin blacklisting can freeze stolen funds after approval phishing, see the research article on stablecoin blacklisting and sanctions mechanics. Understanding how stablecoin payment systems reduce fraud also provides context on how payment architectures can mitigate these risks.

Related concepts include address poisoning, another wallet-targeting attack that exploits user inattention, and rug pulls, which similarly abuse smart contract permissions but from the protocol operator side rather than through phishing.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.