Defending Against Approval Phishing: How $374 Million Was Stolen From Crypto Users in 2023

Chainalysis released a damning report in December 2023 revealing that approval phishing scams had stolen at least $374 million from cryptocurrency users throughout the year, marking explosive growth in a technique that many wallet holders still do not fully understand. As Bitcoin traded near $43,650 and Ethereum hovered around $2,200, the sheer scale of these losses demanded urgent attention from every participant in the cryptocurrency ecosystem.

The Threat Landscape

Approval phishing represents a fundamental shift in how scammers drain cryptocurrency wallets. Unlike traditional scams where victims are tricked into sending funds directly, approval phishing exploits the very mechanism that makes decentralized applications functional. On smart contract-enabled blockchains like Ethereum, users must routinely sign approval transactions that grant dApp smart contracts permission to move tokens held in the user’s wallet. This is a normal and necessary part of interacting with DeFi protocols, decentralized exchanges, and other Web3 applications. The danger arises when scammers create malicious dApps or impersonate legitimate platforms, tricking users into signing approval transactions that grant the scammer’s address permission to spend specific tokens in the victim’s wallet. Once approved, the scammer can drain those tokens at will, often waiting days or weeks before executing the theft to avoid immediate detection. The Chainalysis report highlighted that romance scammers, also known as pig butchering operations, had increasingly adopted this technique, combining social engineering with on-chain exploitation to devastating effect.

Core Principles

Understanding the mechanics of token approvals is essential for self-protection. When you approve a token spend, you are granting another address the right to transfer a specified amount of that token from your wallet. Legitimate dApps need this permission to function. When you swap tokens on Uniswap, for example, you approve the Uniswap smart contract to move the tokens you want to trade. The critical distinction is between approving a known, audited smart contract versus approving an unknown or malicious address. Approval phishers exploit the fact that many crypto users have become accustomed to clicking approve without carefully reviewing what they are approving. Some sophisticated scams have even created fake Etherscan pages where users are prompted to connect their wallets and sign an approval transaction to supposedly check if they have been compromised, when in reality that final transaction is the trap itself.

Tooling and Setup

Protecting against approval phishing requires a combination of awareness and the right tools. First, use a token approval checker like Revoke.cash or Etherscan’s token approval tracker to regularly review and revoke unnecessary approvals. These tools display all active approvals on your wallet and allow you to revoke them with a single transaction. Second, consider using a hardware wallet for significant holdings, as hardware wallets require physical confirmation of every transaction, including approvals, making it harder for a moment of carelessness to result in catastrophic loss. Third, employ a dedicated browser profile or wallet specifically for interacting with new or unverified dApps, keeping your main holdings in a separate wallet that never connects to untrusted platforms. Fourth, always verify the URL of any dApp before connecting your wallet. Bookmarks are your friend here, as they eliminate the risk of landing on a phishing site through a manipulated search result or social media link.

Ongoing Vigilance

The holiday season amplifies phishing risks significantly. Scammers exploit the general sense of goodwill and the increased online activity during this period to push their malicious campaigns. Be particularly wary of unsolicited messages about investment opportunities, airdrops, or security alerts that require immediate wallet connection. The MongoDB security incident disclosed on December 20, 2023, which exposed customer contact information through a phishing attack on corporate systems, illustrates how even sophisticated organizations can fall victim to phishing techniques. If it can happen to MongoDB, it can happen to individual crypto users who may be less prepared to identify and resist social engineering attempts.

Final Takeaway

Approval phishing is not a vulnerability in blockchain technology itself but rather an exploitation of human trust and the complexity of wallet interactions. The $374 million stolen in 2023 represents real losses from real people. The defense is straightforward but requires discipline: verify every approval request, regularly audit your existing approvals, keep significant holdings in wallets that rarely connect to dApps, and treat every unsolicited opportunity with extreme skepticism. In an ecosystem where you are your own bank, the responsibility for security ultimately rests with you.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.