What Happens When You Sign a setApprovalForAll for an Unknown Site?

22 October 2026

If you sign a setApprovalForAll transaction for an unknown site, you grant that site unlimited permission to move every token of that type in your wallet, forever, until you manually revoke the approval. The site can then drain those tokens immediately or wait days or months before stealing them.

How setApprovalForAll Works

setApprovalForAll is a standard ERC-721 (NFT) and ERC-1155 (multi-token) contract function. It authorizes another address - called an "operator" - to transfer any token of that collection from your wallet without asking you again. Unlike a one-time approval for a specific token ID, this is an unlimited, blanket permission.

When you sign this through a wallet like MetaMask, you see a transaction request, not a signature request. The transaction calls the contract's setApprovalForAll method with two parameters: - operator: the address you are approving (here, the scammer's contract) - approved: set to true

Once confirmed on-chain, the operator can call transferFrom or safeTransferFrom on any token in that collection that you own, at any time.

What the scam site does

A phishing site impersonating a marketplace, airdrop claim page, or NFT mint will prompt you to "approve" before you can interact. The site's instructions often say something like "Approve to continue" or "Authorize collection access." The actual transaction is a setApprovalForAll to a contract the scammer controls.

After you sign and confirm the transaction in your wallet: 1. The approval is recorded on the blockchain. 2. The scammer's operator address now has permission to move your tokens. 3. The scammer almost always triggers a transfer immediately, stealing every token in that collection from your wallet.

Why It's Dangerous

• No further confirmation needed. The scammer does not need you to sign anything else. They can transfer tokens one by one or all at once, in a single transaction.
• It covers past and future tokens. If you later acquire more tokens from that same collection, the approval still applies. The scammer can drain those too.
• It does not expire. Unlike a one-time approval, setApprovalForAll remains active until you revoke it. If the scammer does not drain you immediately, they can return weeks later.
• Your wallet warning may not help. Some wallets show a red warning for setApprovalForAll to an unknown contract. But scammers design sites to bypass this by using well-known contract addresses or by tricking you into ignoring the warning.

How to check before you sign

Before confirming any transaction that requests token approval:

1. Read the transaction details in your wallet. Look for the function name. If it says setApprovalForAll, pause.
2. Check the operator address. The wallet shows the address being approved. Compare it against the official contract address of the site you believe you are using. If it does not match, do not sign.
3. Use a transaction simulator. Tools like those built into some wallets or block explorers let you preview what will happen if you confirm. If the simulation shows your tokens being transferred away, reject the transaction.
4. Verify the site URL. Even if the site looks identical to a real marketplace, check the browser's address bar. Phishing sites use typosquatting, lookalike characters, or subdomains that mimic the real domain.

What to do if you already signed

If you signed a setApprovalForAll for a malicious operator:

1. Revoke the approval immediately. Use a token approval checker tool or a block explorer's "Token Approvals" section for your address. Find the operator address and revoke permission by calling setApprovalForAll with approved set to false.
2. Move remaining tokens. If you still own tokens from that collection, transfer them to a fresh wallet that has never interacted with the scam contract. This breaks the approval link.
3. Monitor the operator address. Even after revocation, check that no pending transfer transactions exist. Scammers sometimes front-run revocations.

What setapprovalforall does not do

• It does not give the operator access to other token types or native coins (ETH, BNB, etc.). Each collection requires its own setApprovalForAll.
• It does not give the operator control over your wallet's other functions, like sending transactions or changing settings.
• It is not a signature like a permit or a typed data signature. It is an on-chain transaction that costs gas and cannot be revoked by discarding a signature request.

The Bottom Line

setApprovalForAll is the most dangerous approval you can sign because it is unlimited, permanent, and covers every token in a collection. A single mistake can cost you every NFT or ERC-1155 token you own. Treat any request to sign this function for an unknown site as a red flag. Verify the operator address, simulate the transaction, and if anything looks wrong, do not confirm.

Back to phishing