AnchorCrypto gone without seed phrase theft: what is approval phishing
If you discover that money has disappeared and you never showed your seed phrase to anyone, don’t rush to assume it’s a bug or an error. There’s a way to withdraw funds that doesn’t require the thief to know your seed phrase at all. All they need is one signature from you.
A seed phrase written on paper is the only secret that decides the fate of all funds.
What happened on July 9 An Ethereum user signed a transaction on a website that looked like an ordinary service. Within seconds, 999,999 USDT left their wallet — nearly a million dollars. They never entered their seed phrase anywhere, never revealed their private key. All they did was click “Confirm” in a pop-up window from their wallet.
Analysts at Scam Sniffer, who spotted the theft, noted a detail: when the thief saw the wallet had slightly less money than expected, the attack script automatically recalculated the amount and took exactly the remaining balance available. This wasn’t manual work by a scammer — it was a pre-written program waiting for your signature and acting instantly.
How it works When you use any crypto service — an exchange, a swap, an app — at some point the wallet asks you to confirm an “approval.” Essentially, this is a document that says “this service can manage my tokens without asking further questions.” It’s a legitimate and standard part of how most crypto applications work — without it, services couldn’t interact with your tokens.
The problem is that the confirmation looks to a person like a routine click, one of dozens in a day. The thief simply fakes a website so that you sign such an approval for them, not for the real service. The key and seed phrase aren’t needed at all — the thief doesn’t get access to your wallet, but rather your own permission to take money out of it.
From the network’s perspective, this looks just as legitimate as a normal transaction. You signed it with your key — so you authorized it.
Why this is scarier than ordinary phishing Stealing a seed phrase happens once and is immediately clear: get the phrase, steal everything. Approval phishing works differently and is more dangerous for one reason: the approval can sit dormant for weeks or months.
You sign it today on a website that’s safe at the moment. Two months later, that same site gets hacked, or its owner turns out to be a fraudster. Your old approval is still active — and the money leaves without any new action on your part. A person might genuinely not understand why they were hit: they didn’t sign anything today.
How to check your wallet right now This takes about five minutes and requires no special knowledge.
Open Etherscan, go to the “Token Approvals” section, enter your wallet address — the service will show a list of all approvals you’ve ever granted. An alternative with a clearer interface is revoke.cash, which works the same way for Ethereum and most other networks.
Review the list. If you see a service you haven’t used in months, or don’t recognize at all — click “Revoke” next to it. This is a separate transaction with a small network fee, but it permanently revokes the approval until you grant a new one.
Pay special attention to approvals with no amount limit — that is, “unlimited” access rather than access to a specific sum. These are the most dangerous: the thief can take not just what was on the wallet at the moment of signing, but everything that ever appears there in the future.
How to avoid signing unnecessary things in the future Check the website address before connecting your wallet — not from memory, but literally character by character, especially if you arrived via a link from an email or message. Fakes often differ by a single rearranged letter in the domain.
When a signature request pop-up appears, don’t click “Confirm” on autopilot. The wallet usually shows what exactly you’re approving and to what extent — take three seconds to read it rather than just dismissing the window with a click.
Get into the habit of checking your active approvals list every few months using the method described above, and revoke anything you haven’t used in a long time. This isn’t paranoia — it’s the same as periodically reviewing which apps have access to your email.
What this has to do with storing money Revoking approvals closes one specific vulnerability, but it doesn’t solve the broader question: what happens if you still make a mistake and sign something you shouldn’t. If a single key signs all operations, any signing error means losing everything. If a large transfer requires confirmation from a second, separate key — one wrong signature on a phishing site won’t give the thief access to the entire sum at once.