How an approval drain works
-
01 The lure
- Source
- flash claim, airdrop, QR code
- Promise
- free or “verified” USDT
-
02 The request
- Method
- approve
- Spender
- unknown contract
- Amount
- unlimited
-
03 Nothing happens
- Your balance
- unchanged
This calm is part of the trick.
-
04 The drain
- Later
- transferFrom
- Your USDT
- moved out
Security researchers at CYFIRMA documented a 2026 campaign using Trust Wallet QR codes that opened a fake “Send USDT” page; the button triggered an approve call rather than a transfer, and the approval then appeared in the wallet’s approvals list. Binance’s security team describes the same combination as high risk: an unknown address, a token approval and an unlimited allowance.
How to read a signature request
| If the request says | It means |
|---|---|
| approve / increaseAllowance | Permission for a contract to spend your tokens |
| setApprovalForAll | Permission over all your NFTs in a collection |
| permit (off-chain signature) | An approval signed without a transaction, used by some drainers |
| Unlimited, or a huge number | The spender can take everything |
| transfer to an address you know | A normal send |
How to revoke an approval
- Open the approval tool for your network by typing its address: Etherscan’s token approval checker for Ethereum, BscScan’s for BNB Chain, and Tronscan’s approval section for TRON.
- Connect your wallet there, or search your address.
- Find approvals for USDT and other tokens to spenders you do not recognize.
- Revoke them. Revoking costs a small network fee.
A trap to know: some scams fake an alarming approval in your history and send you to a “revoke” page that is itself the drainer. Use only the explorers’ own tools or your wallet’s built-in approvals page.
Habits that prevent it
- Keep savings in a wallet that never connects to sites.
- Never sign to claim a token you did not buy.
- Prefer wallets that show human-readable warnings for approvals.
- Review approvals once a month.
Related: flash USDT ERC20, unknown tokens in your wallet, the fake AML check.
Where approval requests come from
| Lure | What it says |
|---|---|
| Airdrop or claim page | “Claim your free USDT” |
| Fake checker | “Verify your USDT is not flash” |
| QR code | “Scan to pay” or “scan to receive” |
| Fake DEX or bridge | “Swap your token at a better rate” |
| Fake revoke page | “Revoke this dangerous approval” |
| Fake staking or mining | “Stake USDT to earn daily” |
Off-chain signatures
Some tokens support permit, a signature that grants an allowance without a separate on-chain approval. The signature request looks like a message, not a transaction, and costs nothing to sign. That makes it attractive to drainers. If a site you do not trust asks you to sign typed data mentioning a spender, a value and a deadline, it is asking for spending rights.
The time gap that confuses victims
-
01 Day 1
- You sign
- an approval on a claim page
- Balance
- unchanged
-
02 Day 4
- You receive
- 2,000 USDT payment
-
03 Day 4, minutes later
- Drainer calls
- transferFrom
- Your USDT
- gone
Do hardware wallets prevent this?
A hardware wallet protects your keys from malware, but it will still sign an approval if you confirm it on the device. It helps if you read what the device screen says before pressing the button. The defence is the same: understand what you are signing.
Unlimited USDT approval: what it lets someone do
An unlimited USDT approval lets a contract move any amount of your USDT, at any time, until you revoke it. Many dapps request this for convenience. Scam sites request it so they can drain you.
| Approval type | What the spender can do | Risk |
|---|---|---|
| Exact amount | Move only that amount | Limited to that amount |
| Unlimited | Move all your USDT, now and later | Your whole balance |
| Permit signature | Same as an approval, signed off chain | Can be used later, without a visible approval transaction |
| Set approval for all | Move all NFTs in a collection | All NFTs in that collection |
Trust Wallet QR code scam, step by step
The Trust Wallet QR code scam is a common way to get an approval signed.
- A buyer, seller or “investor” sends a QR code to scan for payment.
- Trust Wallet opens a page in the DApp browser.
- The page asks you to confirm a transaction, often labelled as payment or verification.
- The transaction is actually an approval of your USDT to the scammer’s address.
- Later, sometimes hours later, your USDT is moved out.
A QR code for receiving money should only contain your address. Anything that opens a page and asks you to sign is not a payment to you.
Revoke USDT approval on each network
To revoke a USDT approval, use the token approval tools on the official explorer or a reputable revoke service you reach by typing its address.
| Network | Where |
|---|---|
| Ethereum | Etherscan’s token approval checker |
| BNB Chain | BscScan’s token approval checker |
| TRON | Tronscan’s approval section for your address |
Revoking costs a small network fee. If the scammer already moved your funds, revoking stops further losses but does not return what was taken.
Wallet drainer kits: why they look professional
A wallet drainer is a ready-made kit sold to scammers. It includes a site template, the code that requests approvals and permits, and a dashboard. This is why many scam sites look polished and work smoothly.
- The site may copy a real project’s design.
- It may check your balance first and target your largest holdings.
- It may request several signatures, each looking harmless.
Common entry points are fake verification sites, claim tokens and fake support. See fake verification sites and bait tokens.
Habits that block approval scams
- Never connect a wallet from a link in a token name, chat or ad.
- Read the spender and amount on every approval.
- Prefer exact amounts over unlimited when a dapp asks.
- Keep most funds in a wallet that never connects to dapps.
- Review and revoke approvals every few months.
Questions about USDT approval scams
Why did my USDT leave hours after I signed?
The approval stays valid until revoked. The scammer can use it whenever they choose.
Does a hardware wallet stop approval scams?
It protects your keys, but if you confirm a malicious approval on the device, it is still valid.
Questions people ask
What is a USDT approval scam?
A trick to make you sign a permission that lets a scammer’s contract move your USDT.
How do I revoke a USDT approval?
Use the explorer’s approval tool for your network and revoke unknown spenders.
Can a drainer take USDT without my seed phrase?
Yes, if you signed an approval for it.
Does revoking get my USDT back?
No. It stops future transfers. Funds already moved are gone.
Sources
Not sure about an offer?
Send it to us before you pay. A person reads it. It costs nothing.
Ask us about it