Every time you click “Sign” or “Confirm” in your wallet, you create a transaction signature. Most people do it dozens of times a week without reading the box. That habit is how wallets get emptied.
A transaction signature is cryptographic proof, created with your private key, that you approved a specific action. The blockchain checks the signature against your public address. If it matches, the action goes through. Nobody can forge it, and nobody can undo it once it is confirmed.
I have been in crypto since 2013 and run more than 100 wallets a year for airdrop farming. I have never been drained. That is not luck. It comes down to reading what I sign, and this guide shows you how to do the same.
What Is a Transaction Signature?
Your wallet holds a private key. That key never leaves your device. When you want to do something on-chain, your wallet takes the details of the action and runs them through the key. The output is the signature.
Think of it as a wax seal on a letter. Anyone can read the letter. Only you can produce that exact seal, and the seal proves the letter came from you. The network does the checking with your public address, which is derived from the key. If you want the deeper mechanics, read our explainer on the difference between a public key and a private key.
Three properties matter for beginners:
- A signature is tied to one exact action. Change a single detail and the signature stops working.
- A signature cannot be reversed. Once the network accepts it, the action is final.
- A signature does not reveal your private key. Signing a thousand times leaks nothing about the key itself.
That last point is good news. The bad news is that the action you sign can still be terrible for you.
Transactions vs Messages: The Two Things You Sign
Wallets ask for two kinds of signatures, and the difference is the heart of this guide.
A transaction signature sends something to the blockchain. It costs gas, it changes state, and it shows up on a block explorer. Sending ETH, swapping on a DEX, minting an NFT and approving a token all fall in this group.
A message signature stays off-chain. It costs nothing. You see it when a site asks you to “Sign in with Ethereum” or to verify you own a wallet. On its own, a message signature moves no funds.
Here is the catch. Some message signatures are designed to be used later inside a transaction. The Permit standard lets you sign a message that grants a token allowance. A third party then submits that message on-chain and pays the gas. You never see a transaction. Your wallet shows no pending approval. Yet the permission is real, and a drainer can cash it in minutes later.
So the rule is simple. Treat every message signature as seriously as a transaction. Free to sign does not mean free of consequences.
What a Signature Actually Does
Once your wallet produces the signature, one of three things happens.
The simplest case is a transfer. You sign, the network moves the asset, done.
The second case is a contract call. Your signature authorizes a smart contract to run a function with your wallet as the caller. A swap, a stake, a claim or a bridge all work this way. The contract decides what happens to the tokens you hand it.
The third case is a standing permission. This is where most losses happen. An approval signature tells a token contract that another address may move your tokens, up to a limit, whenever it wants. The permission stays active until you cancel it. Our guide on how to revoke token approvals explains the cleanup in detail.
A standing permission does not drain anything by itself. It opens a door and leaves it open. Whoever holds the key to the other side decides when to walk through.
The Signatures That Can Empty Your Wallet
Not every request is dangerous. These five are the ones drainers rely on.
Unlimited token approvals
A DEX asks you to approve USDC. The default amount is often unlimited. That saves gas later, but it also means the approved contract can move every USDC you will ever hold. If that contract is malicious, or gets hacked next year, your balance is exposed. Set a custom amount instead, or revoke after the trade.
Permit and Permit2 signatures
These are the gasless approvals from the previous section. A fake claim page shows a box labelled “Verify wallet” or “Claim airdrop.” Inside the typed data sits a spender address and a deadline years away. One click grants the attacker an allowance on that token, with no transaction for you to notice.
setApprovalForAll
This one is for NFTs. It gives an address permission to move every NFT in a collection, not just one. Marketplaces need it to list your items. Scam mint pages abuse it to take whole collections in one transaction.
Blind hex signing
Older wallets offered a method called eth_sign. It shows you a long hexadecimal string and nothing else. You cannot tell what you are approving. Most wallets now disable it by default. If a site asks you to turn it on, that is the answer right there.
NFT listing signatures
Marketplace listings are message signatures too. A phishing site can present a real marketplace listing for your NFT at a price of zero. You think you are verifying ownership. In fact you just listed your asset for free, and the attacker accepts the order.
How to Read a Signing Request Before You Click
Every wallet prompt contains the same handful of fields. Check them in this order, every time.
The website. Look at the address bar, character by character. Drainers live on look-alike domains. We documented a complete fake AirdropAlert clone that copied our name on every page and had one live “airdrop” pointing at a drainer.
The network. Make sure the chain matches what you expect. A prompt on the wrong chain is a sign the site is doing something you did not ask for.
The action. Modern wallets decode the request into plain words: Approve, Transfer, Set approval for all, Permit. If the word does not match what you clicked on the site, stop.
The spender or recipient. For approvals, this is the address that gets power over your tokens. A real DEX shows a known router contract. A drainer shows a fresh address with no history.
The amount and deadline. Unlimited amounts and deadlines decades away are red flags on any site you do not use daily.
The simulation. Wallets like Rabby, and extensions like Pocket Universe, show you the expected balance changes before you sign. A claim that shows your tokens leaving is not a claim.
Hardware wallets help, but only if you read the device screen. A Ledger protects your key from malware. It does not protect you from approving a bad request. Our look at whether a Ledger wallet is safe covers that gap.
When to Know Something Is Bad
You will not always have time to decode a prompt. These patterns tell you to close the tab without further analysis.
- A “claim” or “verify” button that produces an Approve or Permit request. Claims take tokens in, not out.
- Any request to enable eth_sign or “advanced signing” in your wallet settings.
- A countdown timer next to the signing button. Urgency is the scammer’s only real tool.
- A link that arrived by DM, reply, or a token you never bought. Both the dusting attack and the fake-token playbook start this way.
- A site that asks you to sign twice in a row for one action. The second prompt is often the real payload.
- A recipient address that matches only the first and last characters of one you know. That is address poisoning, and it cost one user over $50 million.
- A prompt that your wallet flags with a warning. Wallets have false positives, but almost never on a legit swap you initiated yourself.
Unsure about a project before you even get to the prompt? Our checklist of fake airdrop red flags catches most scams a step earlier.
Real Drainers That Used Signatures
Drainers are off-the-shelf phishing kits. The developer takes a cut of everything stolen, and affiliates run the fake sites. Our full breakdown of how to avoid wallet drainer scams covers the whole business model. Here are the names you will see most often.
Monkey Drainer was the first kit to go mainstream in 2022. It relied on classic setApprovalForAll and approval phishing against NFT holders, and reportedly took around $13 million before its operator shut it down in early 2023.
Inferno Drainer scaled the model. By late 2023 it had reportedly drained more than $80 million across tens of thousands of victims, largely through fake airdrop and claim pages. The team announced a shutdown, then the kit kept circulating.
Pink Drainer pushed Permit and Permit2 phishing hard. Security firms linked it to roughly $85 million in losses before it closed in 2024. Many of its victims never saw a transaction, only a signature box.
Angel Drainer is still active and is the one we meet most. Phishing domains that misspell our own name, such as “airdropsalert” on random extensions, have been flagged carrying Angel Drainer payloads while impersonating major exchanges.
One famous single case: in 2024 a holder lost about $1.4 million in PEPE and other tokens after signing a single Permit2 message on a phishing site. No approval transaction, no gas, one click.
Signed Something Bad? Do This Now
Speed matters more than anything else in the first ten minutes.
Step 1. Disconnect from the site and close the tab. Do not sign anything else it shows you.
Step 2. Open an approval checker and revoke every allowance you do not recognize, starting with unlimited ones on tokens you hold. Permit2 allowances show up there too. The step-by-step is in the revoke guide linked above.
Step 3. If the signature was a Permit on a specific token, move that token to a fresh wallet first, then revoke. The attacker may be racing you.
Step 4. If you typed your seed phrase anywhere, the wallet is gone. Create a new wallet, move everything that remains, and never reuse those words. Our seed phrase vs private key explainer shows why one leaked phrase exposes every account under it.
Step 5. Report the domain to your wallet provider and to a blocklist. It will not get your funds back, but it protects the next person. If funds already left, read our honest take on whether stolen crypto can be recovered before you pay anyone who promises to get it back.
Going forward, do risky signing from a burner wallet that holds only gas money. Follow the routine in our guide to claiming airdrops safely, and bookmark our stay safe page for the full set of airdrop safety rules. Every breach and exploit we cover lands under the security tag.
Keep This Content Free
Centralized exchanges never ask you to sign a wallet message to trade, which is one reason beginners start there. If you open an account through our OKX or Bybit links, you support guides like this one at no cost to you. Once you are comfortable signing, the trading airdrops hub lists exchange bonuses and DEX points campaigns worth your volume.
Final Words
A transaction signature is the single point where your intent meets the blockchain. Everything before it can be undone. Nothing after it can.
Read the domain, read the action, read the spender. Treat gasless message signatures as real money. Keep a burner for anything new, and revoke what you no longer use. Do those four things and the drainers move on to someone else.
FAQ
What is a transaction signature in crypto?
It is proof, generated with your private key, that you approved one specific on-chain action. The network verifies it against your address and executes the action if it matches.
Can signing a message steal my crypto?
A plain login message cannot. A Permit or Permit2 message can, because it grants a token allowance that an attacker later submits on-chain. Read every message signature as if it were a transaction.
Does a signature expose my private key or seed phrase?
No. Signing reveals nothing about the key. Your funds are at risk only if the action you signed grants permission to someone else, or if you typed your seed phrase into a site.
Does a hardware wallet protect me from bad signatures?
It protects your key from malware. It does not stop you from approving a malicious request. Read the device screen and use a wallet that decodes the request in plain language.
How do I undo a bad signature?
You cannot undo the signature itself. You can revoke the allowance it created with an approval checker, and move the affected tokens to a fresh wallet before the attacker uses it.
How often should I review what I have signed?
Check your approvals monthly, and after every airdrop claim or farming session. Each revoke is a small transaction that closes one open door.
Credit: Source link
