How Approval Phishing Powers the Drainer Business Model

Key Takeaways

Every wallet drainer needs one thing before it can steal anything: a valid signature from the victim's own wallet. That single requirement is the reason the entire drainer economy is built around harvesting token approvals and permit signatures rather than asking victims to simply send funds. Approval phishing isn't a side effect of drainer kits — it's the product they're designed to produce, and understanding why reveals both how persistent this attack category is and where the real defenses live.

Direct answer: Approval phishing powers the drainer business model because a signed token approval or permit is free to grant, doesn't look like a payment, can be requested under a routine-sounding pretext like "verify" or "claim," and gives the attacker flexible, delayed control over the victim's funds. Drainer-as-a-service kits are built specifically around harvesting these signatures at scale: kit developers rent or license the underlying contracts and phishing-site infrastructure to affiliates, take a percentage cut of whatever the affiliate's site steals, and reinvest that revenue into keeping the kit updated and harder to detect — which is exactly why this attack category has scaled into a well-resourced, professionally maintained criminal industry rather than staying a niche scam.

• A permit or approval signature costs no gas and grants no visible "you are sending money" warning, which removes the strongest instinctive red flag a direct transfer request would trigger.
• Drainer-as-a-service kits are rented or licensed to affiliates for a revenue-share cut, which funds continuous kit maintenance and lets the same underlying tooling power an enormous number of unrelated-looking fake sites.
• A typical harvesting flow scans a newly connected wallet's balances and requests a separate signature for each valuable token it finds, often in a fast sequence disguised as steps in one routine process.
• A sweeper bot frequently drains the highest-value tokens first once approvals are granted, maximizing what the attacker keeps before a victim can react.
• Being asked for more than one signature approval in a single visit is one of the most reliable tells that a site is running a harvesting flow, since a legitimate single action essentially never requires it.
• Revoking unused approvals doesn't undo a past theft, but it shrinks the standing access available to a drainer if you're phished again later.

How This Guide Fits With Wallet Drainer Scripts Explained

Swoopr covers wallet drainers from two deliberately different angles, and it's worth being explicit about the split so you land on the right page for what you need. Wallet Drainer Scripts Explained is the technical-mechanism piece: it walks through what a drainer's smart contract and front-end script actually do, how a malicious approval or a permit/setApprovalForAll signature grants spending rights, and why mempool-monitoring sweeper bots execute a drain within seconds of getting one. This page picks up one layer above that. It's about the exploitation and business side — the specific reasons drainer kits are engineered around approvals and permits instead of any other attack surface, how the "drainer-as-a-service" revenue model that funds this entire ecosystem actually works end to end, and the harvesting flow a victim experiences from the moment they land on a fake site to the moment a sweeper bot moves their funds. Read this page for the "why approvals, and who profits" story; read the companion piece for the "here's exactly how the code does it" story. They're meant to be read together.

Why Approvals and Permits Beat Direct Transfers

If an attacker's actual goal is to end up holding a victim's crypto, the most obvious approach would seem to be asking the victim to send it directly. In practice, drainer-as-a-service kits almost never do this, because a request to "send funds to this address" is precisely the kind of request that both wallets and users have been trained, through years of scam warnings, to treat with immediate suspicion. Every layer of crypto's existing security education — from exchange withdrawal warnings to wallet confirmation screens — is built around flagging outgoing payments as the moment that deserves the most scrutiny. A drainer kit built around direct transfers would be fighting that trained instinct on every single victim, which is a losing proposition at scale.

A signature-based approach sidesteps nearly all of that friction, for reasons that compound rather than simply add up. First, a permit signature or an off-chain setApprovalForAll message costs no gas to sign, which removes the one universal signal — a fee, a pending transaction, a "this will cost you" prompt — that reliably makes people pause before confirming something. Second, an approval doesn't move any funds at the moment it's signed; it only grants a smart contract the right to move funds later, so nothing in the victim's balance changes and no wallet notification says anything resembling "you just sent money." Third, and this is the part that makes approval phishing so durable as a business model, the request can be wrapped in almost any pretext the attacker wants. "Verify your wallet to continue," "claim your allocation," "mint before the window closes" — all of these are framed as the user doing something for themselves, not giving something away, which is exactly backward from what's actually happening on-chain.

The fourth reason is less about psychology and more about tactics: an approval gives the attacker flexible, delayed control. Once a broad approval or an unlimited permit is granted, the attacker doesn't have to act immediately. They can drain the wallet within seconds through an automated sweeper bot, or they can sit on the approval for days or weeks, waiting for a larger deposit to land in the wallet before triggering the sweep. A direct transfer, by contrast, is a one-time event — the attacker gets exactly what was sent and nothing more. An approval is closer to a standing authorization than a single payment, and that flexibility is precisely what makes it worth engineering an entire kit ecosystem around.

The Drainer-as-a-Service Economy

The persistence and sophistication of approval phishing isn't accidental — it's the direct result of a business model that rewards exactly that kind of investment. Drainer-as-a-service works the same way most other "as-a-service" criminal markets do: a small group of developers builds and maintains the actual malicious infrastructure — the smart contracts that receive approvals, the phishing-site templates that present the fake "verify," "claim," or "mint" flow, and the sweeper-bot systems that watch for and execute a drain — and then rents or licenses that entire package to affiliates who don't need any development skill of their own. An affiliate's job is simply to drive traffic: build or clone a convincing front end using the kit's templates, promote it through compromised social accounts, Discord servers, fake customer-support DMs, or paid ads, and point victims at it.

The payment structure is what ties the two sides together and gives kit developers a direct financial stake in every phishing campaign run on their infrastructure. Rather than charging a flat licensing fee, most drainer-as-a-service operations take a percentage cut of whatever an affiliate's site actually steals, deducted automatically at the smart-contract level before the remainder reaches the affiliate's own wallet. This revenue-share structure means the kit developer's income scales directly with how many affiliates are actively running campaigns and how successful those campaigns are, which creates a strong, ongoing incentive to keep the kit competitive: patching detection by wallet-simulation tools, adding new pretexts as old ones become recognizable, and supporting new chains and token standards as the ecosystem grows. Security researchers, including Chainalysis, have documented this pattern directly, describing drainer operations that "masquerade as web3 projects, enticing victims into connecting their crypto wallets to the drainer and approving transaction proposals that grant the operator control of the funds inside the wallet," with drainer-related theft in some periods growing faster quarter over quarter than ransomware.

This is also why approval phishing has scaled into a genuinely large criminal economy rather than remaining a scattered nuisance. Chainalysis has reported that on-chain scams, with approval phishing as a major contributor, extracted well over ten billion dollars in stolen value in a single recent year, and separate research from the Web3 security firm Scam Sniffer put wallet-drainer losses specifically at close to half a billion dollars in 2024 alone, spread across roughly 330,000 distinct victim wallet addresses — a scale that reflects an industry, not a handful of opportunistic individuals. Because the underlying contract logic and wallet-scanning code is frequently shared or only lightly modified across many different affiliate campaigns, a single well-funded kit can sit behind what looks, to any individual victim, like a completely unrelated fake airdrop, a fake NFT mint, or a fake wallet-verification page. The apparent diversity of scam sites hides a much smaller number of actual drainer platforms doing the technical work underneath.

Why this explains the persistence of the threat

Understanding the business model answers a question that otherwise seems puzzling: why does approval phishing keep working, and keep getting more sophisticated, instead of fading out as awareness spreads? The answer is that a revenue-share model funds continuous reinvestment in exactly the areas that would otherwise cause a kit to stop working. When wallets add a warning for unusually broad approvals, well-funded kit developers adjust the framing or the approval scope to avoid triggering it. When one pretext, like a specific airdrop theme, becomes widely recognized as a scam, developers roll out new templates built around a different pretext. This is professional software development funded by criminal proceeds, not a static tool that becomes obsolete the moment it's documented — which is exactly why "drainer scams are unsophisticated and easy to spot," addressed further in the misconceptions table below, is such a dangerous assumption to carry into a live encounter with one.

The Typical Approval-Harvesting Flow

Most drainer-as-a-service kits follow a recognizable sequence, because the same underlying kit is reused across many affiliate sites with only cosmetic changes. Recognizing the shape of the flow is often more useful than trying to memorize every specific pretext, since the pretexts change constantly while the underlying pattern doesn't.

1. A seemingly routine action draws the victim in

The victim arrives at a site — through a phishing link, a fake ad, a compromised social account, or a swapped QR code — that presents what looks like an entirely ordinary crypto action. Common framings include claiming an airdrop allocation, verifying wallet eligibility for a token launch, minting a limited NFT, or resolving an urgent-sounding account issue. None of these framings are inherently suspicious on their own; they're chosen precisely because they match things crypto users encounter legitimately on a routine basis.

2. Connecting the wallet triggers a balance scan

Once the victim connects their wallet, most drainer kits don't wait for the victim to specify what they want to interact with. The kit's front end reads the connected wallet's on-chain balances directly, identifying every token, NFT collection, and native-coin balance of meaningful value. This automated scan is what allows the kit to skip straight to targeting a victim's most valuable holdings rather than only the token nominally related to the site's stated pretext.

3. One or more signature requests follow, framed as routine steps

Based on what the scan finds, the site requests one or more approval or permit signatures, each typically presented as a normal, expected part of the process — "step 2 of 3: confirm eligibility," for instance, or a second popup framed as required to "complete" the claim. Because each individual signature request is dressed up as part of a single coherent flow rather than a separate demand, victims frequently sign through several in a row without recognizing that a real single action almost never requires more than one.

4. A sweeper bot executes the drain, often ordering by value

Once the necessary approvals are granted, an automated sweeper bot executes the actual transfers. Many drainer kits are built to prioritize by value, draining the most valuable token or asset first to guarantee the attacker captures the highest-value theft even if the victim notices something is wrong partway through and manages to revoke remaining approvals before the sweep finishes. This value-ordering is a direct, practical consequence of the same profit-maximizing logic that shapes every other part of the kit's design.

Worked Example: A Multi-Token Drain in Four Signatures

Hypothetical, generic example — for education only. Not based on any specific real event, project, or organization.

Picture a trader who holds a diversified wallet: a meaningful stablecoin balance, a position in a mid-cap governance token, a smaller allocation in a newer altcoin they've been accumulating, and an NFT from a collection they bought into early. One evening, a direct message arrives claiming to be from a project the trader has genuinely interacted with before, saying that a "retroactive rewards distribution" has gone live and needs to be claimed before a stated deadline. The linked site looks convincing — matching branding, a countdown timer, and a claim interface that resembles the project's real dashboard closely enough not to raise immediate suspicion.

The trader connects their wallet, and the site's "eligibility check" completes almost instantly — in reality, this is the moment the kit scans the connected wallet's balances. A first signature request appears, framed as "Step 1: Verify wallet ownership." It's presented as low-stakes, a simple confirmation, so the trader signs without much hesitation. In reality, this first signature is a permit granting the drainer's contract an allowance over the trader's stablecoin balance.

Immediately after, a second prompt appears: "Step 2: Confirm token allocation for governance-token holders," specifically naming the mid-cap governance token the trader holds. Because the previous step just resolved cleanly and this one references a token the trader actually owns, it reads as a continuation of the same legitimate-seeming process rather than a separate request. This second signature is an approval over the governance token. A third prompt follows within moments, this time referencing the smaller altcoin position under a claim titled "Bonus allocation for early holders" — again matching something genuinely true about the trader's wallet, which is exactly what makes it convincing. A fourth and final prompt asks for a broad NFT marketplace approval, framed as necessary to "unlock collection-based rewards."

By the time the trader finishes signing all four prompts, believing they've completed a straightforward multi-part claim process, they've actually granted an attacker-controlled contract spending or transfer rights over every meaningfully valuable asset in the wallet. No funds moved during any of the four signatures — nothing in the wallet's displayed balance changed, and no transaction fee was ever charged, since permits and off-chain approvals typically require no gas to sign. Within minutes, an automated sweeper bot executes the drain in sequence, moving the stablecoin balance first, then the governance token, then the smaller altcoin position, and finally transferring the NFT — value-ordered exactly as described in the harvesting-flow pattern above, so the attacker secures the largest holdings even if the trader notices something is wrong partway through.

The tell here was never hidden in any single step — it was hidden in the shape of the whole interaction. A genuine "claim your rewards" action, even a generous or unusual one, essentially never requires four separate signature approvals covering four unrelated assets. Each individual prompt was designed to look reasonable in isolation, referencing a real token or NFT the trader actually held, which is precisely why questioning the pattern as a whole — not any one prompt — is the defense that actually would have caught this before the fourth signature, let alone the first.

Practical Defenses Against Approval-Harvesting Flows

These defenses are specific to the sequential, multi-signature pattern drainer-as-a-service kits rely on, on top of the general phishing hygiene covered elsewhere on Swoopr.

Practical checklist

• Treat any site requesting more than one signature approval in the same visit as an immediate red flag — a single legitimate action, even an unusual one, essentially never needs several separate approvals for different assets back to back.
• Use a wallet that displays a running, readable list of active approvals and clearly states what a new signature will actually grant before you confirm it, rather than one that shows only a raw hexadecimal payload.
• Read what each signature actually authorizes — token, amount or "unlimited," and the contract address receiving the approval — rather than clicking through prompts based on how routine the surrounding framing feels.
• Be specifically suspicious of a wallet-connect flow that appears to already "know" which of your tokens are valuable before you've told the site anything, since that behavior typically indicates an automated balance scan feeding a harvesting flow.
• Regularly review and revoke unused or unrecognized token approvals using a reputable revocation tool — see how to revoke token approvals — so that even if you're later phished, the attacker has fewer standing permissions available to exploit.
• Learn to recognize the specific transaction and signature types drainer kits request most often, covered in detail in malicious approval transactions, so an unfamiliar-looking approval request stands out rather than blending in.
• If a "claim," "verify," or "mint" flow ever asks for a second signature after you've already completed one step, stop and independently verify the site's legitimacy before continuing, rather than assuming the second request is simply "part of the same process."

Common mistake

The most common mistake isn't signing one bad approval — it's signing several in a row without ever asking why a single action would need more than one. Each individual prompt in a harvesting flow is deliberately designed to look reasonable on its own; the giveaway is almost always in the pattern across prompts, not in any single prompt's wording.

Common Mistakes

• Signing multiple sequential approval requests without questioning why a single legitimate action would need several. Drainer kits rely on each individual step feeling like a normal continuation of the last one, rather than a separate demand worth scrutinizing on its own.
• Not periodically auditing and revoking old approvals. Every approval granted in the past, whether legitimate or not, remains active until explicitly revoked, which means old and forgotten approvals sit as standing risk indefinitely.
• Assuming an approval is safe because it doesn't cost any gas. The absence of a fee is exactly what makes permit and off-chain approval signatures attractive to attackers — it removes the one signal most people rely on to sense that something consequential is happening.
• Treating "unlimited approval" as a convenience rather than a risk. Many legitimate dApps default to requesting unlimited approval amounts for user convenience, but an unlimited approval to a malicious contract carries unlimited downside, not just unlimited convenience.
• Assuming a drainer scam will look obviously unsophisticated. Professionally maintained drainer-as-a-service kits are actively updated to evade wallet security warnings and frequently look indistinguishable from legitimate flows to an unprepared user.
• Reacting only after funds are gone instead of building revocation into a regular routine. Revocation is a forward-looking defense; it does nothing for assets already stolen, which makes waiting until after a scare to start the habit far less useful than doing it routinely beforehand.

Misconceptions Versus Reality

Prevention Checklist

These habits build on the general phishing defenses covered elsewhere on Swoopr, focused specifically on the approval-harvesting pattern drainer-as-a-service kits are built around.

Practical checklist

• Never sign a second or third signature approval in the same session without independently questioning why the action requires more than one.
• Use a wallet or browser extension that shows plain-language transaction simulation and a running list of active approvals before you confirm a new one.
• Set a recurring reminder to review and revoke unused token approvals across the wallets and chains you actively use, rather than relying on memory alone.
• Keep a smaller "hot" wallet for routine dApp interactions and claims, separate from a wallet holding your largest or longest-term positions, so a successful harvesting flow can't reach your full portfolio at once.
• Independently verify any "claim," "verify," or "mint" request through a project's official channels before connecting a wallet, especially when it arrives through a DM, email, or ad rather than a source you navigated to directly.
• Treat an unlimited approval request with extra scrutiny, and prefer wallets or interfaces that let you set a specific, limited approval amount instead of defaulting to unlimited.
• Never enter a seed phrase or private key as part of any "verification" step; a legitimate approval or permit signature never requires either.

Risks, Limitations, and Exceptions

• Not every wallet or browser extension displays approval details or transaction simulation clearly; the quality and clarity of these warnings varies significantly across different wallet software.
• Some legitimate dApps do request multiple approvals in a single flow for genuine technical reasons, such as a multi-step DeFi transaction involving more than one token; context and the requesting project's reputation still matter alongside the general "multiple approvals" red flag.
• Revoking an approval does not undo any transfer that already occurred under that approval; it only prevents future use of the same permission.
• Value-ordered draining is a common pattern but not universal — some drainer kits sweep assets in whatever order their scan discovers them, or attempt to drain everything simultaneously.
• Drainer-as-a-service kits and their pretexts continue to evolve; this guide describes common, currently observed patterns rather than an exhaustive or permanently fixed list.
• New token standards and approval mechanisms may introduce harvesting patterns not fully covered here as the underlying technology changes.

Tool Opportunity

A dedicated Swoopr tool should help readers evaluate a signature request before confirming it, surfacing exactly the information a harvesting flow relies on victims not noticing.

Recommended inputs: a pasted or connected wallet address, and optionally the specific dApp or transaction the reader is about to interact with.

Expected outputs: a plain-language summary of what a pending or recent signature actually grants (token, amount or "unlimited," and the receiving contract), a count and list of currently active approvals across supported chains, and a flag when more than one approval request has been detected from the same session in a short window.

Validation requirements: never request or store a seed phrase or private key as part of the tool's operation, clearly label any risk assessment as a heuristic signal rather than a definitive safety verdict, and link every flagged approval directly to a revocation flow so identifying a risk and acting on it happen in the same place.

Sources

• Chainalysis, "What Is Approval Phishing? Detect & Disrupt Crypto Scams at Scale," chainalysis.com — blockchain analytics research describing how approval phishing extracts standing permission from victims and tracking related on-chain scam losses.
• Chainalysis, "Understanding Crypto Drainers," chainalysis.com — research on how crypto drainer tools operate, including their promotion, approval-based theft mechanism, and fund-laundering patterns.
• Scam Sniffer, "2024 Web3 Phishing Attacks: Wallet Drainers Drain $494 Million," scamsniffer.io — Web3 anti-scam research firm's annual report on wallet-drainer losses and the affiliate-based drainer-as-a-service model.

Frequently Asked Questions

Conclusion

Approval phishing isn't an incidental technique drainer operators happen to use — it's the entire product drainer-as-a-service kits are engineered to produce, because a signed approval or permit is cheaper to obtain, easier to disguise, and more flexible to exploit than any direct transfer request could be. The revenue-share relationship between kit developers and affiliates is what turns a single well-built harvesting flow into thousands of unrelated-looking fake sites, and it's what funds the continuous updates that keep professional drainer kits ahead of wallet security warnings. The realistic defense isn't spotting a "sophisticated scam" through some obvious tell — it's questioning the pattern of what you're being asked to sign, especially the moment a second or third signature request follows the first, and keeping your standing approvals cleaned up so that even a successful phish has less to take. Read this alongside Wallet Drainer Scripts Explained for the technical mechanism underneath, and use the broader Token Approvals & Blind Signing hub for the full set of approval-specific habits this page builds on.

Related Reading

• Token Approvals & Blind Signing — the parent hub covering how token approvals and permit signatures work and the full set of approval-specific defenses.
• Wallet Drainer Scripts Explained — the technical companion to this page, covering exactly how a drainer's contract and sweeper bot execute a theft once a signature is obtained.
• Malicious Approval Transactions — a closer look at the specific transaction and signature types drainer kits request most often.
• How to Revoke Token Approvals — the step-by-step process for auditing and revoking standing approvals to limit your exposure.
• Fake Airdrop Phishing — the claim-site pretext drainer-as-a-service kits reuse constantly as the entry point into an approval-harvesting flow.
• Phishing & Wallet Drainers — the broader hub covering phishing tactics and drainer mechanics beyond the approval-specific focus of this page.