← Blog Security

The four signatures behind most wallet drains

2026-08-14

Unlimited approve, Permit and Permit2, setApprovalForAll, and raw eth_sign. Each can grant far more than a single action.

Legitimate use exists for all of them, but on a phishing site any one can hand over your tokens or NFTs in a single click.

When you see these, pause and confirm the site and the intent. If a simple action requests one of these against a valuable asset, reject it.

Free browser extension. Blocks phishing and warns about dangerous signatures.

One short mental checklist, used every time, prevents the majority of avoidable losses.

Scams often hide behind fee confusion. Basic gas literacy removes that leverage.