I have seen one of the most brutal crypto scams: you get an email saying "The project team is sending out free airdrop tokens, click to connect your wallet to claim". You click, your wallet pops up an approval request, you think "it's just permission to view my balance" and hit confirm. Then all your USDT gets transferred away immediately.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
The action of "connecting your wallet" itself is not dangerous. The real deadly step is the "approval" you click after connecting.
Step 1: Understand the difference between "connecting wallet" and "approving contract"
Goal: Clarify the risk level of these two separate actions.
Connecting a wallet essentially only shares your public wallet address with the other party. Your address is public information by default, sharing it does not give anyone control over your assets.
Approving a contract means you sign a transaction in your wallet, giving a specific smart contract permission to move a certain type of asset in your wallet. This is the action that truly hands over access to your funds.
Many phishing websites combine these two steps: when you click "Connect Wallet", it directly pops up a signature request to "approve XXX tokens", with an interface almost identical to a normal connection request. If you are used to clicking confirm without checking, you can hardly tell if you are just connecting or giving away asset permissions.
Completion rule: You can clearly state that connecting is a read-only action, while approval grants fund access. The latter is the high-risk action.
Step 2: Check these 3 details before approving any permission
Goal: Filter out 99% of phishing approval requests with 3 checks before you click confirm.
Check 1: Is the approval spending cap set to "Unlimited"?
What to do: On the wallet pop-up approval confirmation page, find the item labeled "Spending Cap" or approval amount.
How to do it: See if it shows "Unlimited" or a specific number (for example 100 USDT).
Completion rule: If it shows "Unlimited", cancel immediately. This means the contract can transfer out 100% of that specific token in your wallet at any time. Legitimate DApps usually let you manually set the spending cap, or only default to approving the exact amount needed for the current operation. Any request that asks for unlimited access right away is malicious.
Check 2: Is the token being approved exactly the one you expect to operate?
What to do: Check what token the approval request is for — is it USDT? ETH? Or some random token you have never heard of?
How to do it: If the email says you are claiming an airdrop from a project, but the approval request asks for permission to move your USDT, that does not make sense. An airdrop means the project team sends you free tokens, so they never need permission to move your existing USDT.
Completion rule: The token type listed in the approval request fully matches the activity you are participating in. If it does not match, cancel the request right away.
Check 3: Is the contract address you are approving the official address released by the project team?
What to do: On the wallet pop-up confirmation interface, copy the "Contract Address" field.
How to do it: Search this address on block explorers (Etherscan, BscScan or Tronscan) to check if it is marked as "phishing" or "high risk" by the community. Then find the official public contract address from the project's official Twitter or documentation, and compare every character of the two addresses.
Completion rule: The address you checked is exactly the same as the official public address, and is not marked as a risk address by the community.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Step 3: Immediate actions to take if you already approved a suspicious contract
Goal: Cut off the malicious permission before your assets get transferred away.
If you find you already clicked confirm to approve a suspicious contract, no matter if the attacker has started moving your funds or not, do the following steps immediately:
What to do: Open Revoke.cash or the built-in "Approval Management" feature in your wallet, connect your wallet, find that suspicious contract address, and click "Revoke" to cancel the permission.
How to do it:
- Revoke.cash: Open the website, connect your wallet, it will list all contracts you have approved. Find the suspicious one, click Revoke, pay a small on-chain gas fee to finish the cancellation.
- Built-in wallet revocation: Some wallets (such as TokenPocket, imToken) have an "Approval Management" entry on the asset page, you can cancel the approval directly there.
Completion rule: The suspicious contract no longer appears in your approval list.
Common failure reason: Some people think "I will wait and observe for a while before revoking". But as long as you approved an unlimited spending cap, the attacker can call the contract to transfer all your assets at any second. One minute of hesitation can cost you all your crypto funds.
High Risk Reminder: Some phishing approval requests leave hidden backdoors you cannot see. After you cancel approval for Contract A, the attacker may have also deployed Contract B that holds the same permission. So after revoking the suspicious approval, we recommend you transfer all mainstream assets (ETH, USDT, etc.) in this address to a brand new wallet address to fully eliminate the risk. This extra step is a bit troublesome, but it is way better than losing all your money.
Verification method after operation: Confirm via Revoke.cash or wallet approval management that the suspicious contract has been removed from your approval list. Then monitor this address for 24 hours to make sure there are no abnormal outbound transfer records.
Next step: Open Revoke.cash right now, check all contracts with unlimited approval permissions for your current wallet address, and revoke all unknown and unused approvals. Spend 10 extra seconds to confirm the 3 details above (spending cap, token type, contract address) every time before you approve any permission later. This simple habit will help you avoid almost all airdrop phishing scams.
