These traps live on the blockchain itself. They need one signature, one copied address or one curious tap.
One signature can move your money
On Ethereum and networks built like it, using a crypto app often means giving a contract permission to spend a token on your behalf. That’s an approval, and it’s normal: a swap can’t work without one. The trouble is that an approval can be for an unlimited amount, and it stays in force until you cancel it.
A drainer site is a copy of a real app, a fake “claim” page or a mint (a page that creates new tokens or NFTs), built to get one signature out of you. Sometimes it asks for an approval. Often it asks for a permit instead.
A permit is the same permission granted by a signature alone: no transaction, no gas fee (the small payment a network charges), and often fewer warnings than an approval gets, so it can look like a plain sign-in. Revoke.cash, which runs a tool for checking approvals, warns that it may look like you’re simply signing in to a website, but you’re actually granting an approval.
