Home › Podcast › How Gasless Signatures Drain Crypto Wallets
How Gasless Signatures Drain Crypto Wallets
This episode is based on Chain Pursuit's own research and written guides. The narration uses a synthetic voice.
You sign a message, pay no gas, see nothing leave your wallet, and conclude it was harmless. Weeks later the wallet is empty. This episode explains gasless signatures, the Permit and Permit2 approvals that cost nothing to sign and leave no trace, why the theft happens long after you sign, and the habits at the moment of signing that stop it.
Prefer audio? Listen here or in your podcast app.
Listen on: YouTube
Key takeaways
- A gasless signature can authorise someone to move your tokens without any on-chain transaction. You pay no gas, nothing leaves your wallet at that moment, and nothing appears in your history, so there is no event to alarm you.
- The permission and the theft are separate moments. You sign today and nothing happens, then the wallet is emptied hours or weeks later, whenever the attacker decides to use the permission you granted.
- The dangerous requests are Permit, Permit2 and newer delegation signatures. Scam Sniffer found Permit and Permit2 behind 38 percent of losses above one million dollars in 2025, and a single malicious Permit signature caused a loss of about 6.5 million dollars that September.
- A signature request often deserves more suspicion than a transaction, because a transaction shows you what it moves while a signature can authorise a transfer you cannot read. Approving something you cannot read is blind signing, and it is always a decision, never a formality.
- Your defences are at the moment of signing: use clear signing and verify details on a hardware wallet's own screen, use transaction simulation where your wallet offers it, and decline anything you reached through a link or cannot fully read. There is no penalty for closing a prompt.
- If you may have already signed something, move any remaining assets to a brand new wallet first, then check and revoke approvals using a tool you reach by typing the address yourself. If your seed phrase was ever exposed, revoking does nothing, because the phrase is the wallet.
Questions
What is a gasless signature, and why is it dangerous?
It is a signature that grants permission by itself, with no on-chain transaction. A standard token approval is a transaction: it costs gas and shows in your history. A Permit or Permit2 signature grants the same kind of permission by signature alone, so there is no gas, no transaction, and nothing in your history at the moment you sign. That invisibility is exactly what makes it dangerous, because there is no alarming event to make you stop.
I only signed a message, I did not send any transaction. How can that empty my wallet?
Because the signature can authorise a contract to move your tokens later. A Permit, Permit2 or newer delegation signature is permission, not a harmless login. Once you have signed it, whoever controls that contract can transfer the covered tokens whenever they choose, without you approving anything again. The signing and the draining are two separate events, which is why people sign, see nothing wrong, and lose funds weeks later.
Why did nothing show up in my wallet history after I signed?
Because a Permit signature creates no on-chain transaction when you sign it. A standard approval is recorded on the chain and a revocation tool can see it. A Permit leaves no record at the moment of signing, so your history stays empty and a revocation tool may not list it the way it lists a standard approval. Checking your approvals is still worth doing, but it is not a complete picture of everything you have authorised.
What are Permit and Permit2?
Permit is a signature-based approval that grants permission to move a token without an on-chain transaction or gas. Permit2 extends that across multiple tokens through a single contract. Both are legitimate mechanisms that save gas and clicks, which is why scammers reuse them. Scam Sniffer found Permit and Permit2 accounted for 38 percent of losses above one million dollars in 2025, including a single incident of about 6.5 million dollars from one malicious signature.
How do I protect myself at the moment of signing?
Treat a signature request with more suspicion than a transaction, not less. Where your wallet and the application support clear signing under the EIP-712 standard, use it, so you see what is actually being authorised rather than a raw hash. Verify details on a hardware wallet's own screen, use transaction simulation if your wallet offers it, and decline anything you reached through a link, cannot read, or are being rushed into. There is no penalty for closing a prompt and returning once you understand it.
I think I already signed something bad. What should I do right now?
Move any remaining assets to a brand new wallet first, one with a seed phrase the attacker has never seen, because revocation takes time to confirm and a live permission can be used during that window. Then check and revoke approvals using an established tool you reach by typing the address yourself, since fake revocation sites are themselves drainers. If your seed phrase may have been exposed, revoking achieves nothing, because the phrase is the wallet. Preserve the addresses, amounts, dates and messages, and report through official channels.
Sources
- Wallet drainers and token approval scams: how they work
- How to verify what you are actually signing
- How to revoke token approvals, and when it matters
- FBI IC3 2025 Internet Crime Report
Related reading
If you have been affected: where to report a crypto scam, and our evidence checklist.