What a wallet drainer actually does when you click "Approve"

Most wallets are not "hacked". They are drained — and the owner usually opened the door themselves with a single click. The click felt routine: connect wallet, approve, confirm. Here is what those clicks can actually mean.

1. The unlimited approval

To trade a token on a DEX, you first let the DEX spend it — an "approval". Many sites ask for an unlimited approval by default, because it saves you a future transaction. It also means that address can take all of that token, at any time, forever. On a legitimate site that is a convenience. On a drainer, the moment you approve, a bot sweeps the tokens out.

2. setApprovalForAll — your entire NFT collection

This one is NFTs, and it is even broader: it hands over the right to move every NFT you own in a collection, present and future. It is needed by real marketplaces like OpenSea — and it is the single most common request on fake "free mint" and "claim your airdrop" pages.

3. Permit — a signature that spends without a transaction

A Permit is just a signed message — no transaction, no gas, no obvious warning. But that signature can later be used by anyone to move your tokens. Scam pages love it because signing feels harmless: "it's just a signature, nothing is being sent." Something is being sent. Permission is.

4. Blind signatures (eth_sign)

The oldest and bluntest tool: "sign this message", where the message is an unreadable blob of hex. You cannot know what you signed. Modern wallets warn about it, but the warning is easy to click through when a page insists it is needed to "verify your wallet".

Why the page looks trustworthy

Drainers are sold as kits. For a fee, a scammer gets a polished clone of a popular mint or DEX, hosting, and the draining code itself. Some campaigns even compromise the real site's frontend, so the address is correct and the page is still poisoned — which is why CapyGuard also fingerprints the scripts on trusted exchanges and warns when new code sources suddenly appear.

How CapyGuard pauses the danger

CapyGuard sits between the page and your wallet. When a site requests an unlimited approval, setApprovalForAll, a Permit, a blind signature, or an unusually large send, CapyGuard pauses the request and shows you a plain-language warning: what is being asked, and what it could cost. You can still proceed — but never by accident, and never without seeing it spelled out first.

If you already approved something sketchy

Approvals can be revoked. Use a revocation tool (like revoke.cash) from a bookmarked link, remove approvals you do not recognize, and move anything valuable to a fresh wallet if you signed something you did not understand. Speed matters — drainers often wait for the wallet to fill up before sweeping.