How To Stop Fake Crypto DApp Token Allowances From Stealing Your Funds

Lost money to a crypto or trading scam? Read this first:

If your losses exceed £3,000 (in the UK) or $10,000 worldwide The Crypto Adviser can offer advice on recovering your funds. 

>> GET IN TOUCH

Crypto scammers use a wide variety of methods to drain users’ wallets of funds, one of which is to trick people into granting permission for what’s known as a token allowance.

This means that the scammer can potentially withdraw unlimited amounts of the approved token, such as USDT (Tether) from a person’s account, often without it showing up on the activity log.

So, if you’ve recently signed up to a new crypto investing DApp which has been recommended to you by someone you’ve met online or through an advert on social media, it’s important to look out for funds vanishing from your wallet.

If you’ve noticed money being withdrawn or disappearing from your crypto wallet, such as MetaMask or Trust Wallet, it could be because a malicious address was given a token allowance often via a smart contract through a scam DApp (decentralised application).

This is a method that scammers use to enable them to drain crypto from your account as you’ve unwittingly given them permission to access all your crypto assets when signing up for a DApp.

How can I stop my crypto from being stolen?

Fortunately, the scammers can be prevented from accessing further funds by revoking the token allowance and this is easy to do.

It involves connecting the affected wallet to a service which will enable you to find the malicious address(s) and revoke the approvals that were mistakenly granted.

Bear in mind that you’ll have to pay an Ethereum gas fee as the changes take place on-chain. Also, not all token allowances are malicious and many legitimate DApps rely on them to function properly.

Some of the websites that let you examine and revoke the token approvals connected to your wallet include:

• Etherscan
• Cointool
• Revoke

Using these services involves connecting your wallet to whichever one you choose and selecting the token allowance (via smart contract) you wish to cancel.

Once you’ve done this you should log out of your wallet or at least refresh it to ensure the changes have been made.

It’s important to note that simply disconnecting your wallet from a crypto DApp or project does not prevent the scammers from using your tokens so you need to ensure you’ve followed the instructions above as well.

Case Study – malicious DApp token allowance

I dealt with a case recently where someone had a met a women while travelling and carried on the relationship over the internet after parting company.

After a few weeks of chatting, the woman started talking about a crypto investment which involved ‘mining USDT (Tether)’. She showed screenshots of her account which apparently ‘proved’ she was making thousands of dollars a week.

It’s important to note here that it’s not possible to mine USDT as this is not how the token is created. But scammers rely on people not fully understanding how crypto work to operate.

The victim send several thousands USDT to a website set up by the scammers to resemble a genuine crypto platform, which also had a companion DApp which they were told to connect their MetaMask wallet to.

Once they’d given the DApp the necessary permissions, the scammers drained any crypto they deposited into their wallet almost immediately, while the DApp claim to show that it had been invested.

Profits appeared to accrue in the victim’s ‘mining account’, but there was no way of withdrawing or accessing the money.

How to spot a malicious scam DApp

There were several red flags which gave away the scam, including:

• As mentioned, USDT cannot be mined.
• The returns offered were completely unrealistic – nearly 50% monthly.
• If such amazing returns could be achieved, why would you tell anyone else?
• The scam website had only recently been set up and was very basic.
• There was no information about the company or the team, nor any regulatory or licensing information.
• The platform didn’t have any social media or other online presence.
• There were no reviews anywhere – a sure sign a platform is a scam.
• Being introduced to a crypto investment by someone you hardly know is always a red flag.

To avoid getting scammed in this way it’s crucial to ensure you know exactly what the DApp is and that you trust the address requesting the allowance.

Doing your due diligence on a crypto investment or mining DApp is vital to avoid getting caught out. You should always research the platform you’re planning to use first before allowing it any access to your wallet.

Related post: Crypto scam help and resources