Wallet drainer

An attack typically uses a deceptive interface to obtain a signature or authorization. Permissions may cover one ERC-20 token, an NFT collection or smart-account functions.

Attacker code attempts to transfer assets using that permission. A token approval usually does not itself authorize spending the network’s native asset. Scope must be determined from the signed message or transaction.

A permission-only incident may allow revocation. If the key was exposed, approval revocation is insufficient. These are different incidents requiring assessment of account control.