Learn / Experienced · Using Crypto Safely

A bad day: token approvals, look-alike addresses and what to do next

Most crypto losses do not come from clever hacking of the blockchain. They come from a person approving something they did not understand. This module follows a made-up bad day so you can recognise the moments where things go wrong, and rehearse the response before you ever need it.

The story below is invented for teaching. The mechanisms are real.

Education only, not financial advice. Examples use made-up numbers, not live prices.

Morning: a permission you forgot you gave

Ravi uses a token swap app on Ethereum. The first time he used it, the app asked him to “approve” a token. He tapped yes without reading. That approval is a permission that lets a program, called a smart contract, spend up to a stated amount of that token from his wallet. Many apps request an unlimited amount so you do not have to approve again each time.

• Why it matters. An approval stays active until you cancel it. If the app is later hacked, or if you approved a fake app, whoever controls that contract can move the approved tokens without asking you again.
• It is not the same as sharing your seed phrase. The attacker never learns your secret words. They simply use a permission you signed.

Midday: the look-alike address

Ravi wants to send money to a friend and copies the friend’s address from his transaction history. Scammers know people do this. In an attack called address poisoning, they send a tiny or zero-value transaction from an address that begins and ends with the same characters as the friend’s. It then appears in Ravi’s history, and one careless copy sends real money to the wrong wallet.

Wallets like Trezor Suite try to blur such entries, but the habit that protects you is yours: check the whole address, not just the first and last few characters, and send a very small test amount first when the amount is large.

Evening: the message that says “urgent”

A message claims to be from wallet support and says his wallet is “out of sync”. It asks him to enter his twelve or twenty-four recovery words on a website to fix it. This is phishing. No genuine support team, exchange or wallet company needs your recovery phrase. Anyone who has it can take everything, from any device, at any time. Another trap is the fake revoke scam, where a page pretends to help you cancel an approval but asks you to sign something harmful instead. Reach revoke tools by typing the address yourself or from a bookmark you trust.

What to do when you suspect a problem

If you think something is wrong, slow down and follow an order. Panic is what scammers rely on.

• 1. Stop signing. Do not approve anything more, and do not click “fix” links.
• 2. Move what you can to a safe wallet. If your recovery phrase might be exposed, create a new wallet on a clean device and move funds first, starting with the most valuable.
• 3. Review and revoke approvals. Tools such as the Etherscan Token Approval Checker or Revoke.cash list active approvals. Look for unlimited ones and unfamiliar spenders. Revoking costs a small network fee, so keep a little of the native coin for it.
• 4. Note the details. Save addresses, transaction links and dates. You may need them for a report.
• 5. Report it. Tell the platform involved, and consider telling the police or the relevant authority, even if recovery is unlikely.

Habits that make the bad day smaller

• Prefer limited approvals when the app lets you choose, and approve only what the transaction needs.
• Clean up regularly. Review approvals every month or two and revoke those for apps you no longer use.
• Use a hardware wallet for savings. A hardware wallet keeps keys on a separate device, so a compromised computer cannot sign without your physical confirmation. You must still read what you are confirming.
• Use two wallets. Keep a small “spending” wallet for apps and a separate “savings” wallet that never connects to them.
• Store your recovery phrase offline. Write it on paper or metal, never in photos, email, notes apps or cloud storage.

A five-minute monthly safety routine

Safety works best as a small habit, not a rescue. Put a reminder in your calendar once a month and spend five minutes on this routine.

First, open a block explorer’s approval checker and look at every active approval. For each, ask whether you still use that app. If not, revoke it. Second, check that you can still find your recovery phrase backup and that it is stored somewhere dry and private. You do not need to type it anywhere to check; just confirm the paper or metal is where you expect. Third, update your wallet app and any browser extension from the official source, and remove extensions you no longer use. Fourth, scan your recent transaction history for anything you do not recognise, including tiny incoming tokens you never asked for. Do not click on or try to sell unknown tokens; they are often bait.

Last, write one line in a note: the date and anything you changed. After three months you will have a record that makes it easy to spot something unusual.

Common mistakes

Tapping approve on autopilot. Read what you are allowing and for how much.

Copying an address from history. Verify the full address from the source.

Trusting urgency. Real problems rarely need you to share your phrase.

Thinking a hardware wallet makes you immune. It protects keys, not judgement.

Try it yourself

Open a block explorer such as Etherscan, search a wallet address you own (or a public one if you prefer not to use yours), and find the token approvals page. List every spender you do not recognise and write down how you would check each one before revoking. If you use a swap app, find its approval setting and see whether you can change an unlimited allowance to a limited one.

Keep in mind

• An approval is a permission that stays on until you cancel it.
• Nobody legitimate asks for your recovery phrase.
• Check the whole address, and test with a small amount first.
• This lesson is general safety information, not financial advice.

Key terms from this lesson

• Token approval (allowance) — a permission letting a contract spend your tokens up to a set amount.
• Smart contract — a program stored on a blockchain.
• Recovery phrase — the words that can rebuild your wallet and its keys.
• Address poisoning — planting a look-alike address in your history to trick a transfer.
• Phishing — tricking you into giving up secrets or signing something harmful.
• Hardware wallet — a physical device that keeps keys offline.

Sources and credits

• Etherscan: Token Approval Checker — view and revoke approvals
• Trezor Support: Address poisoning attacks — how look-alike addresses work
• 1inch Help Center: Token approvals — risks of unlimited approvals and tools to review them
• Revoke.cash — approval review tool
• ethereum.org: Security and preventing scams — official safety guidance for users

Explained in our own words from these sources. Figures are approximate and reported by the sources named; check them yourself. Education only, not financial advice.

Module quiz

3 questions. Tap an answer to see if you are right and why. Get 2 right to complete the module.

Back to Experienced →

Back to Learn →