Crypto Phishing: The Signature That Empties a Wallet

The mental model most people carry is of someone stealing a password. That is not how funds leave a wallet onchain. They leave because the owner authorised it, on a page that looked right, in a moment that felt normal.

What you are actually asked to sign

An unlimited approval

The same mechanism every legitimate swap uses, pointed at a contract that will spend your balance later. It looks identical to a routine approval because it is one.

A Permit signature

This one is worse, because it is not a transaction. Permit lets you authorise spending with a signature alone – no gas, nothing onchain, nothing in your history to notice afterwards. A wallet showing you a block of hex has told you nothing, and the approval-revoking tools will not list it, because there is nothing onchain to list.

A transfer wearing a claim button

The page says Claim. The transaction sends. On a confirmation screen that does not simulate, the difference is a function name most people do not read.

How it reaches you

• A paid search result above the real site, for the exact name you typed.
• A reply under a genuine announcement, from an account with a copied name and photo, posted within a minute of the original.
• A direct message about an airdrop, a support ticket you did not open, or a collaboration offer with a link.
• A token that appears in your wallet on its own, whose page you have to visit to sell – that visit is the attack.
• A bookmark you saved once, to a domain that later changed hands.

What actually works

1. A wallet that simulates before you sign and shows balance changes in plain language – Rabby does this, so an approval you did not intend is visible as an approval rather than as hex.
2. A trading wallet that holds only what you are trading. An unlimited approval on an almost empty wallet is an unlimited claim on almost nothing.
3. Holdings in a separate wallet that never connects to anything new, and ideally never connects at all.
4. Approvals cleared periodically with Revoke.cash, which closes the onchain half of the exposure.
5. Reaching sites through your own bookmarks rather than through search, which removes the paid-result vector entirely.

The one rule that covers the rest

Nothing legitimate arrives unexpectedly and needs your signature within the hour. Airdrops that are real stay claimable. Support does not message first. A deadline in an unsolicited message is not a deadline, it is the method – urgency exists in these messages specifically to stop you doing any of the five things above.