The approval she didn't read

February 2025. A holder in Boston clicks a Twitter ad for a "BAYC season 2 free claim." The site looks like OpenSea, asks her to connect her wallet, and pops up a request labeled "Confirm airdrop eligibility." It is not a harmless signature: it is a setApprovalForAll transaction on her Bored Ape contract, and the site follows it with the same request for each of her other collections. She confirms them all.

Within four minutes, three Bored Apes, one Pudgy Penguin, and a Doodle leave her wallet.

What setApprovalForAll actually does

It is a single function call on an ERC-721 or ERC-1155 contract that grants a third-party address permission to transfer every NFT of that collection that you currently hold, or will ever hold, until you revoke. Once granted, the operator can call transferFrom with no further interaction from you. In the wallet it is just one more confirm button. Unless you stop on the line saying the site wants access to all your NFTs in that collection, it looks routine.

The three signals on the signature screen

  • "setApprovalForAll" is almost never legitimate for an airdrop. Real airdrops use either a Merkle-claim function (you sign a transaction calling claim, no approval needed) or a transferFrom from the project's own wallet (you sign nothing). If a "claim" page asks for setApprovalForAll, close the tab.
  • The operator address should be the contract you trust. Look at who you are approving. For OpenSea, that is the Conduit contract listed in OpenSea's own documentation. A random EOA (externally owned account) or an unverified contract you cannot match to a marketplace's docs is the drainer.
  • Heed the wallet's warning. MetaMask flags many high-risk approvals with a red security alert. Do not click through it — and do not treat the absence of one as a green light.

If you already signed

Go to revoke.cash or etherscan.io/tokenapprovalchecker immediately. Connect the affected wallet. Find every approval to non-marketplace addresses and revoke them. Each revoke is a transaction with gas, so keep some ETH in the wallet for it. If the drainer has not yet moved the NFTs, you can save them. The race is often over in minutes.

The standing rule

I review my approvals on revoke.cash once a month. I keep a screenshot of the previous month's list. Anything new that I did not consciously authorize gets revoked the same hour.