Signed a Transaction and Your Wallet Was Drained: How to Revoke Approvals and Save the Remaining Funds

In short

• A drainer is a malicious website or contract that tricks you into signing. After that, the attacker gains the right to withdraw tokens, and they do not need your seed phrase to do it.
• The most dangerous signatures are Permit/Permit2, approve and increaseAllowance, setApprovalForAll, and starting in 2025 also EIP-7702 delegation — “upgrading a wallet to a smart account.”
• In the first 10 minutes: stop signing, use a clean device to create a new wallet, move everything valuable there, and revoke permissions via revoke.cash or the permissions checker in a block explorer.
• EIP-7702 delegation is not visible in standard approval revocation tools. If your seed phrase has been compromised, revocation will not help — only moving assets to a new wallet will.
• Signature phishing has not gone away: in January 2026, losses increased by 207%, and the largest theft from a single signature amounted to $3.02 million.

The scenario is typical: you visit an “airdrop” or “compensation” website, connect your wallet, and sign a request that looks harmless. Within minutes, your tokens start disappearing one by one. Below is what to do right now, how to cut off the attacker’s access, and how to avoid getting caught next time.

How a drainer works

To steal tokens, a drainer does not need your seed phrase. It needs a signature that grants permission to manage your assets:

According to Scam Sniffer, in 2025 Permit and Permit2 became the main signature type in major thefts — about 38% of losses in cases involving $1 million or more. After the Ethereum Pectra upgrade, attacks via EIP-7702 batch signatures emerged.

What to do in the first 10 minutes: step by step

1. Stop signing. Close the phishing site and disconnect your wallet from all unfamiliar sites in the connection settings.
2. Create a new wallet on a clean device. Use a new seed phrase written down on paper. Do not use addresses derived from the same seed phrase.
3. Transfer everything valuable there. Start with the most valuable tokens and those that have approvals granted. This is faster and more reliable than revoking approvals one by one.
4. Revoke approvals. Open revoke.cash or the Token Approval Checker in your network’s block explorer, connect the old wallet, and revoke all unfamiliar approvals. You will need a small amount for gas to revoke them.
5. Check EIP-7702 delegation. If you signed a “wallet upgrade,” the address may have become delegated. This will not appear in the approvals list — see the section below.
6. Document everything. Transaction hashes, the phishing site address, the addresses where the funds were sent, screenshots.
7. File a report with the cyber police. If USDT or USDC was stolen, the issuer may freeze it at the request of law enforcement, so speed matters.

EIP-7702 delegation: a separate threat

With the Pectra upgrade (May 2025), a regular Ethereum wallet can “delegate” execution to a smart contract. For an attacker, this is an ideal tool:

• a single signature turns your wallet into a “vacuum cleaner”: any incoming tokens and ETH are automatically sent to the scammer;
• the delegation does not appear in approval revocation tools;
• if you send ETH for gas to “rescue” the tokens, it will be taken too.

According to Wintermute data cited in an analysis on DEV Community, more than 97% of observed EIP-7702 delegations pointed to malicious “sweeper” contracts.

What to do:

• If the seed phrase has not been compromised — delegation can be revoked with a new EIP-7702 authorization to the zero address or a safe contract. Some wallets let you return the account to normal mode in the settings. If you are not sure how to do this, do not experiment with large amounts — transfer the remaining balance to a new wallet.
• If the seed phrase has been compromised — revocation will not help: an attacker will sign the delegation again. The only option is a new wallet.

How to recognize a dangerous signature before confirmation

• Read exactly what you are signing. If the wallet shows “spender,” “allowance,” “permit,” “setApprovalForAll,” or “upgrade account,” while you only wanted to “claim an airdrop,” that is a red flag.
• Use unlimited approval only for trusted protocols. In many wallets, you can set an exact approval amount instead of an infinite one.
• Do not sign an “upgrade to smart account” on third-party websites. If the wallet offers this feature, enable it only within the wallet itself.
• Check the domain. Phishing sites copy the interface of popular protocols and are promoted in search results and on social media.
• Keep large amounts separate. Use a separate “hot” wallet for DeFi experiments and airdrops, and store your main funds on a hardware wallet.
• Enable transaction simulation. Many wallets and extensions show which tokens will leave the wallet after you sign.

Prevention: review permissions once a month

1. Open revoke.cash or the permissions checker in the block explorer.
2. Revoke permissions for protocols you no longer use.
3. Replace unlimited permissions with limited ones wherever possible.
4. Disconnect your wallet from sites you do not use.

Risks

• Stolen funds are almost impossible to recover. Transactions are irreversible, and there is usually only a chance with stablecoins that have a freeze function.
• “Rescue” gas goes to the attacker. If the wallet is delegated or the seed phrase has been leaked, any ETH sent will be taken by a bot.
• “Recovery specialists” are a second round of fraud. They find victims in the comments and ask for an upfront payment.
• Phishing adapts to the news. Hacks, airdrops, and “compensation” are the main pretexts for new scam campaigns.

FAQ

What is a token approval in a crypto wallet?

This is permission for a smart contract to spend a certain amount of your tokens. It is required to work with DeFi protocols, but scammers use it to withdraw tokens after a single signature.

How do you revoke an approval?

Open revoke.cash or the approvals checker in your network’s block explorer, connect your wallet, find unfamiliar or unnecessary approvals, and revoke them. Each revocation is a transaction that requires a small amount for gas.

Will revoking an approval help if I entered my seed phrase on a phishing site?

No. If the seed phrase has been leaked, an attacker has full control over the wallet. Create a new wallet on a clean device and transfer everything that remains there.

What is phishing via EIP-7702?

This is an attack in which you are asked to sign a “wallet update” or “feature activation.” In reality, the signature delegates your wallet’s execution to a malicious contract, and all incoming funds are automatically sent to the attacker. This type of delegation is not visible in standard approval revocation tools.

Is it possible to recover tokens stolen by a drainer?

As a rule, no. If USDT or USDC are stolen, the issuer may freeze them at the request of law enforcement, so promptly file a report with the cyber police and keep the transaction hashes.

How often should you check wallet permissions?

A good practice is to do this once a month and after every interaction with a new protocol. Revoke permissions you no longer use, and replace unlimited ones with limited ones.