A drained wallet almost always traces back to one signature the owner forgot about. Not a cracked seed phrase, not a nation-state attacker — a token approval granted months earlier to a contract that later turned hostile. The habits below are the ones that close that gap. They are unglamorous, and they work.
Treat every approval as a standing permission
When you interact with a contract that moves your tokens, you sign an approval. Most interfaces default to unlimited. That single signature lets the contract — or anyone who compromises it later — pull that token from your wallet forever, with no further input from you.
Picture a trader who signs an unlimited USDC approval on a new yield farm. Six months pass. The farm's frontend gets compromised, and the attacker drains every wallet holding an open unlimited approval. The trader loses $40,000. No phishing link, no leaked seed phrase. Just one old signature doing exactly what it was authorized to do.
Close the approval gap
- Approve the amount you need for the transaction, never the maximum.
- Review and revoke stale approvals on a schedule, using a reputable approval checker.
- Run new protocols from a separate wallet funded only with what you can lose.
That third habit carries the most weight. A burner wallet holding $500 cannot hurt you the way your main wallet can, so treat it as your default for anything unfamiliar.
Split your keys by purpose
Keeping savings, trading funds, NFT experiments, and DeFi positions behind one seed phrase means a single bad signature exposes all of it. Tier your wallets instead. A hardware wallet holds anything you would be upset to lose. A browser wallet handles active DeFi. A throwaway wallet absorbs new protocols and airdrop claims. Move funds between tiers on purpose, not by drift.
Hardware wallets do not replace judgment
Using a hardware wallet with a lending market — supplying collateral on Aave, say, and borrowing against it — only helps if you read what the device screen is asking you to sign. Blind signing drains hardware wallet users too. The device protects your private key. It does not protect your decisions.
Assume the phishing link is aimed at you
Fake sites, fake airdrops, and support accounts in Discord that mirror the real team's handle. "Check the URL" still applies, but it no longer catches everything. Attackers now buy search ads and register lookalike domains that survive a casual glance.
The habit that catches most of these: never open a protocol from a link someone sent you. Type the URL, or use a bookmark you created yourself. Four extra seconds, one entire attack category gone.
Build the bookmark folder once
Create a folder for the protocols you actually use. Verify each URL carefully the first time you save it. After that, you never have to trust a search result or a DM again.
Habits that help you survive a mistake
Some habits do not stop an attack. They limit the damage when one lands.
| Habit | What it protects against |
|---|---|
| Seed phrase written offline, never photographed | Cloud breach, phone compromise |
| Two-factor authentication on email and exchange accounts | Account takeover, password reset attacks |
| Small test transaction before a large one | Wrong address, wrong network, fat-finger errors |
| Dedicated email for crypto accounts | Targeted phishing, credential stuffing |
None of these will impress anyone. All of them prevent losses people genuinely suffer every week.
Frequently asked questions
How often should I revoke token approvals?
A quarterly review is a reasonable baseline, plus an immediate revoke once you stop using a protocol. If you have been trying a lot of new contracts, check sooner. The point is making sure no forgotten approval still holds unlimited access to your tokens.
Is a hardware wallet worth it for a small balance?
It depends on what "small" means to you. A hardware wallet costs roughly the price of a nice dinner and protects against malware that reads browser wallet keys. If losing your holdings would genuinely hurt, the math usually favors buying one. If you are experimenting with a few hundred dollars, a dedicated hot wallet is a fair start.
Can I recover funds after a drain?
Usually not. Transactions are irreversible, and attackers typically move funds through mixers or bridges within minutes. Report the incident to the relevant authorities and any affected protocol, but recovery rates are very low. Prevention is the whole game.
What should I fix first?
Read every transaction before signing, and never approve more than you need. That single habit blocks the most common drain vector. Once it is automatic, add a burner wallet for new protocols and a hardware wallet for your main holdings.
Open your wallet now and pull up your active approvals. Revoke anything you do not recognize or no longer use — five minutes today beats a very bad morning later.