Approval drains: the two minutes after the signature
What an ERC-20 approval actually authorises, why drains complete in under two minutes, and which part of the sequence is worth tracing when the transfer itself is already settled.
What is a token approval drain?
A token approval drain uses a permission the victim previously signed, allowing a contract to move tokens out of their wallet. Execution takes about two minutes and the resulting transfer is valid on-chain. Tracing the original approval adds context the transfer alone does not, but it does not make the transfer reversible.
An ERC-20 approval is not a transfer. It is a standing permission for another address to move a token on your behalf, up to a limit you set — and, in the overwhelming majority of wallet interfaces, that limit defaults to effectively unlimited.
This distinction matters for tracing, because the approval and the theft are two separate on-chain events, usually separated by anything from seconds to months.
The sequence
A drain has a recognisable four-step shape:
- The approval. The victim signs a transaction granting an allowance to a contract they believe is something else.
- The wait. Sometimes none. Sometimes weeks, while the operator accumulates approvals across many victims.
- The drain. A single transaction, or a rapid sequence, calling
transferFromagainst every approved balance. - The dispersal. Funds fan out within minutes, frequently through an automated splitter.
The victim usually reports step three. Step one is where the evidence is.
What tracing the approval adds
The approval transaction identifies the spender contract, and that contract is almost never used for one victim. Reading its transaction history typically reveals the wider set of affected addresses, which changes what a law-enforcement report can say: not one loss, but a pattern with a scale attached.
It also dates the operation. An operator whose contract has been collecting approvals for six weeks is running something planned, and that is a materially different characterisation from an opportunistic theft.
Why the dispersal is usually automated
When the interval between the drain and the first onward hop is measured in seconds, a human did not do it. Automation implies infrastructure, and infrastructure implies reuse: the same splitter pattern frequently appears across many unrelated victims.
That reuse is what makes an otherwise unremarkable individual case worth aggregating with others.
What this does not establish
Reading the approval identifies a contract, not a person. It does not tell you who deployed the contract, who controls the receiving addresses, or where the funds ultimately went. Those are separate questions, and only the last one is answerable by tracing.
Revoke first. If you have signed an approval you did not intend, revoking it is the only step that prevents further loss. Tracing what already left does not stop what has not left yet.