/
/ 

Approval phishing and the drainer economy

An ERC-20 approval is a standing permission to take tokens out of a wallet later, and it is a separate thing from a transfer.

01 / 01 Sections Sections

2026-08-01 · Web3 Security

An ERC-20 approval is a standing permission to take tokens out of a wallet later, and it is a separate thing from a transfer. Kit developers now license that attack to affiliates who never write a line of code, and the signature that empties a wallet often costs nothing in gas and shows the signer no numbers at all.

Case file

Field Value
Technique Approval phishing, also called signature phishing, delivered by drainer-as-a-service kits
Mechanism ERC-20 approve, increaseAllowance and setApprovalForAll; ERC-2612 permit; Uniswap Permit2; eth_sign
Named kits Inferno Drainer, Angel Drainer, Pink Drainer, Monkey Drainer, MS Drainer, Venom, Acedrainer
Operator cut 20% of proceeds for Inferno, 30% where Inferno also hosted the site (Group-IB). 15% for Angel on the Ledger Connect Kit funds (Ledger). MS Drainer sold outright for a fee (Scam Sniffer)
Measured losses $295m (2023), $494m (2024), $83.85m (2025), across 324,000, 332,000 and 106,106 victim addresses. Scam Sniffer’s count, EVM wallet-drainer phishing only
Largest single loss $24,055,508 from one address on 6 September 2023 (Scam Sniffer). The two authorisations and the two drains are on chain
Companion technique Address poisoning. 270 million on-chain attempts against 17 million addresses over two years, at least $83.8m lost (Tsuchiya et al., USENIX Security ’25)
Delivery Fake mint and airdrop pages, hacked Discord and X accounts, paid search and social ads, front-end and DNS compromise, package supply chain
Court, docket, prosecution Not established. No named drainer operator has been publicly charged
Posture as of 1 August 2026 Active. Permit-style signatures are the dominant loss vector. EIP-7702 batch signatures appeared in 2025
Defensive action Review and revoke standing approvals; refuse any request that cannot be read in words

What the record shows

What does an approval actually do?

ERC-20, finalised from a 2015 proposal by Fabian Vogelsteller and Vitalik Buterin, defines two separate ways for tokens to move. transfer moves a stated amount from the caller’s own balance. transferFrom moves tokens out of somebody else’s balance, and the standard describes it as “used for a withdraw workflow, allowing contracts to transfer tokens on your behalf”. The function that authorises that workflow is approve. The standard’s own text: “Allows _spender to withdraw from your account multiple times, up to the _value amount.” A separate read-only function, allowance(owner, spender), returns how much of that permission is left.

Three properties of that design carry the whole attack. Nothing in ERC-20 expires an allowance, so the permission runs until somebody changes it. The standard’s phrase “multiple times” makes it reusable rather than single-use. And granting one moves no tokens at all, which means a wallet displaying balances displays nothing.

ERC-20 also carries a warning about its own approval flow. The specification advises clients to set an allowance to zero before setting it to a new value for the same spender, to close a front-running window described in the original 2016 issue thread.

Request Gas What it authorises How to cancel
transfer Yes Moves a stated amount of one token, once, to one address Nothing to cancel. The tokens have moved
approve Yes Lets one named spender take up to a set amount of one token out of the wallet, at any time, until the allowance is changed Send approve again with an amount of 0
increaseAllowance Yes Adds to whatever allowance the spender already holds, so the request does not show the resulting total Send approve with 0. Not part of ERC-20
setApprovalForAll Yes Lets one operator move every NFT the wallet holds in that collection, including ones bought later Call it again with false
permit (ERC-2612) No The same standing permission as approve, granted by an off-chain signature that anyone can submit up to the deadline Spend the nonce by having a later permit submitted
Permit2 PermitSingle No An allowance on any token, with an expiry, spendable through the Permit2 contract lockdown() or invalidateNonces() on Permit2
Permit2 PermitBatch No The same for several tokens and several spenders in one signature As above
eth_sign No Signs a bare 32-byte hash. The hash can stand for anything, including a transaction Nothing. There is no allowance to look up

The 6 September 2023 theft, transaction by transaction

increaseAllowance is not in ERC-20. It was an OpenZeppelin extension, and it adds to an existing allowance rather than replacing it. On 6 September 2023 it produced the largest single loss in Scam Sniffer’s phishing dataset for that year, and every step of it is readable on chain.

At 17:26:11 UTC, in Ethereum block 18,078,881, the address 0x13e382dfe53207E9ce2eeEab330F69da2794179E called increaseAllowance(0x4c10a462CD1e639Da8A062aE8a33a23401120ab1, 1158472395435294898592384258348512586931256000000000000000000) on the Lido staked-ETH contract 0xae7ab96520DE3A18E5e111B5EaAb095312D7fE84. The added value works out at about 1.16 × 10^42 stETH, against a token supply then measured in millions. Forty-eight seconds later, at 17:26:59 in block 18,078,885, the same address made the identical call with the identical value on Rocket Pool’s rETH contract, 0xae78736Cd615f374D3085123A210448E74Fc6393.

Five minutes and twenty-four seconds after the first of those, at 17:31:35 in block 18,078,908, the approved spender called transferFrom and moved 9,579.212966327732523199 stETH to 0x693B725a375f599F0b6EfA0d910E749E1Bec1555. Twelve seconds later it took 4,850.986569493039492191 rETH to the same destination. The spender sent both drains. The wallet holding the tokens sent neither.

Scam Sniffer, publishing on 21 December 2023, names that same victim address as the largest single loss in its dataset and puts the figure at $24,055,508, attributing the theft to the kit it tracks as MS Drainer. Its 2025 annual report gives the largest single theft of 2023 as $24.05m, which is the same event.

On 7 September 2023, the day after the drain, a contributor opened an issue on the OpenZeppelin Contracts repository proposing the removal of increaseAllowance and decreaseAllowance from ERC20. Its second argument reads: “These functions may allow for further phishing possibilities (instead of the common approve or permit ones; see e.g. just 12 hours ago someone lost $24m since he got tricked into signing a malicious increaseAllowance payload”, followed by the link to 0xcbe7b32e62c7d931a28f747bba3a0afa7da95169fcf380ac2f7d54f3a2f77913, which is the stETH drain above. Pull request 4585, “Remove non-standard increaseAllowance and decreaseAllowance from ERC20”, was opened the same day and merged on 12 September 2023. The change shipped in OpenZeppelin Contracts v5.0.0 on 5 October 2023.

The signatures that cost no gas

ERC-2612, finalised from a 2020 proposal by Martin Lundfall, adds a permit function to a token. A call to permit(owner, spender, value, deadline, v, r, s) sets allowance[owner][spender] to value on the strength of an EIP-712 signature by the owner. The standard is explicit about who can submit it: “Note that nowhere in this definition we refer to msg.sender. The caller of the permit function can be any address.” It is also explicit that the expiry is optional in practice, since “the deadline argument can be set to uint(-1) to create Permits that effectively never expire”.

The owner pays no gas and sends no transaction. The signature is a piece of data that sits with whoever collected it until they choose to use it. ERC-2612’s own security section records that “another party can always front run this transaction and call permit before the intended party”.

Permit2, built by Uniswap, extends the same pattern to tokens that never implemented ERC-2612. It is two contracts, AllowanceTransfer and SignatureTransfer, deployed at 0x000000000022D473030F116dDEE9F6B43aC78BA3. Using it requires a normal on-chain approval to the Permit2 contract first, after which Permit2 issues sub-allowances by signature. The signed PermitSingle struct carries a token, a uint160 amount, a uint48 expiration, a nonce, a spender and a sigDeadline; PermitBatch carries an array of those, so one signature can set permissions on several tokens for several spenders. The source notes that “setting amount to type(uint160).max sets an unlimited approval”. Permit2 also ships two revocation functions, lockdown for batch-revoking approvals and invalidateNonces for killing unspent signatures.

Revoke.cash, whose product is approval management, sets out the resulting risk in its own documentation: “The Permit2 system is very flexible and allows for granting approvals for multiple tokens at once. Because of this flexibility, it is harder for users to understand what they are approving.”

Scam Sniffer’s measurements bear that out. Across its 2024 cases above $1m, permit accounted for 56.7% of losses by value, setOwner for 31.9%, transfer for 4.5% and increaseAllowance for 3.5%. In 2025 the largest single theft it recorded, $6.5m in September, came through a permit signature, and permit and Permit2 together accounted for $8.72m of the $22.98m lost in cases above $1m.

Signing a hash you cannot read

The signature types above at least describe something. The floor case is a wallet being asked to sign a raw 32-byte digest, where there is no field to display and nothing on the screen to check. MetaMask’s improvement proposal MIP-3, accepted 15 May 2024, gives the objection: the method “allows blind signing of arbitrary data without the \x19Ethereum Signed Message prefix, posing a significant phishing risk”, because “the hex data being signed can’t be decoded and made readable to the signer”.

The most expensive demonstration is the Bybit theft of 21 February 2025, covered separately in Bybit: the largest theft in the asset class. Three signers with hardware devices approved a payload their interface never showed them, and roughly $1.46 billion left the wallet. The mechanism, which signing methods show what, and what a signer can actually do about it, is the subject of blind signing: what you approve is not what you sign.

The kits and what their operators charge

Drainers are sold, not built. An operator writes the kit, hosts the panel and takes a cut; an affiliate brings the traffic. Group-IB, which read Inferno Drainer’s administrative panel, records the split as 20% to the developers and 80% to customers, rising to 30% where the operators also built the phishing site. Ledger’s own incident report gives Angel Drainer’s split as 85% to the exploiter and 15% to the kit, and describes it in those terms: “which could be seen as a malware as a service.”

The numbers attached to these operations deserve more suspicion than they usually get. The $80 million universally cited for Inferno is not Group-IB’s measurement; Group-IB attributes it to Scam Sniffer, whose own published figure is lower, and Blockaid reports that Inferno “boasts about its $80M+ in revenues”. The economics, the affiliate model, the four competing figures and what a measured on-chain total actually comes to are set out in drainer-as-a-service: the affiliate model. [Q]

Address poisoning

Address poisoning attacks the copy-paste habit rather than the signing prompt. The attacker generates an address whose leading and trailing characters match one the victim has already sent to, then pushes a transfer involving that lookalike into the victim’s history, so a later copy from the transaction list goes to the attacker.

Two peer-reviewed measurements exist. Shixuan Guan and Kai Li, at ACM CCS 2024, built a detection system called Poison-Hunter and ran it over Ethereum blocks from November 2022 to February 2024. Their paper describes the attack as exploiting “the address shortening feature of Ethereum explorers and digital wallets (e.g., Etherscan and MetaMask)”, finds that attackers “predominantly targeted USDC and USDT token holders”, and reports over 1,800 victim addresses losing up to $144 million, of which about $90 million is confirmed in the paper. It also finds that four entities controlled 98% of the phishing addresses and collected about 92% of the profits.

Taro Tsuchiya, Jin-Dong Dong, Kyle Soska and Nicolas Christin, at USENIX Security ’25, measured Ethereum and BSC over two years and identified “13 times more attack attempts than reported previously, totaling 270M on-chain attacks targeting 17M victims”, with 6,633 incidents causing at least $83.8 million in losses, which they call “one of the largest cryptocurrency phishing schemes observed in the wild”. They also identify a large attacker group that appears to be generating lookalike addresses on GPUs.

Wallet defences against this are thin. A 2025 study of 53 popular Ethereum wallets found 16 of them displaying fake token phishing transfers to users, and reports that “only three wallets throw an explicit warning message when users attempt to transfer to the phishing address”.

How the pages reach people

Scam Sniffer’s 2024 report groups the traffic sources into four. Hacked project Discord servers and X accounts, plus front-end and supply chain compromise. Organic traffic through NFT and token airdrop pages, and through expired Discord invite links taken over by somebody else. Paid traffic through Google Search, X and Telegram advertising. And direct contact through email and private messages.

Group-IB catalogues the specific pretexts Inferno’s affiliates used: exclusive, first-ever or final airdrops; invitations to mint an NFT and claim a reward; and pages offering compensation because the company “was hacked” or because “assets were frozen and are now available again”.

On paid search, Scam Sniffer documents two techniques that get the ads past review. Regional targeting, so a reviewer outside the target country sees an ordinary website at the same link. And redirect chains that make the ad appear to originate from an official domain while landing the click somewhere else.

On hosting, Scam Sniffer’s 2024 report names Cloudflare, Vercel and IPFS as the common deployment targets, and OwnRegistrar, Hostinger, NameSilo and Tucows as the common registrars. It also lists four ways the kits work around wallet security layers: producing signatures a wallet will process but a detection layer will miss, wrapping the flow in legitimate contracts behind a Cloudflare or fake CAPTCHA page, using XSS to get around wallet blocklists, and feeding false results to transaction simulation.

What the totals actually measure

Chainalysis published on 14 December 2023 that at least $374 million was suspected stolen through approval phishing during 2023, and estimated roughly $1.0 billion since the start of its dataset in May 2021. Its own caveat on that figure: “this $1.0 billion total is an estimate based on on-chain patterns, and that some of it could represent laundering of funds already controlled by the scammers”. By 18 July 2024 the firm had revised the cumulative figure upward, writing that “over USD $2.7 billion has been lost to approval phishing”, and it restated that number on 17 June 2026. The revision came from finding more illicit addresses, not from new thefts.

Chainalysis also describes the on-chain shape that makes the typology detectable: the victim’s address signs an approval to a second address, and that second address, rather than the victim, initiates the transaction that moves the funds to a third. Its Operation Spincaster, run across the United States, United Kingdom, Canada, Spain, the Netherlands and Australia with 12 public sector agencies and 17 exchanges, passed more than 7,000 leads relating to about $162 million of losses.

Scam Sniffer’s annual series counts something narrower and says so. Its scope is EVM chains, wallet drainer attacks via phishing websites only, valued in dollars at the time of theft, and its stated limitation is: “Lower bound estimate; based on trackable drainer activity only; unreported incidents not captured.” On that basis: $295 million from 324,000 victim addresses in 2023, $494 million from 332,000 in 2024, and $83.85 million from 106,106 in 2025. The firm’s own reading of the 83% fall is that “the decline in trackable losses may partly reflect a shift toward harder-to-track attack vectors”.

One number inside that series is worth holding on to. In 2025, Scam Sniffer recorded two cases using EIP-7702 batch signatures, which appeared after Ethereum’s Pectra upgrade and let an attacker bundle several operations into a single approval. Together they took $2.54 million.

What I think is going on

Start with the sentence that does the most damage. People say a drainer “hacks” your wallet. Nothing gets hacked. You sign, the signature is valid, the contract does exactly what the standard says it should do, and your keys never leave your device. Every control you bought works perfectly. The permission is the payload.

The part I want you to sit with is the gas.

You have been trained by every wallet you have ever used to treat the gas fee as the moment of consequence. Money leaves, so something real is happening. A permit signature costs nothing and sends nothing. There is no pending transaction, no confirmation, no entry in your history, no change in any balance. The most expensive thing you can do in this asset class produces less on-screen feedback than sending a friend $20. That inversion is the entire user-experience bug, and it is not the phisher’s invention: it is what ERC-2612 was built to do, and it made real things possible, and it also means the destructive act is now the cheap one.

Look at what the 6 September 2023 record actually shows, because it corrects something people repeat about this attack, including people who should know better. The received line is “you sign now and the drain comes later”, and everyone pictures a sleeper approval sitting there for weeks. Five minutes and twenty-four seconds. That is the gap between the stETH approval and the stETH drain. Forty-eight seconds between the two approvals, twelve seconds between the two drains. That is a script running, not a patient adversary. “Later” is a property of the permission, not of the schedule, and the practical consequence is that if you realise thirty seconds after signing that something was wrong, you are probably already too late to revoke ahead of a bot.

The number in that approval is the detail I keep coming back to. About 1.16 × 10^42 tokens. Not the maximum value a uint256 can hold, which is what an approve phish would normally ask for. My read, and I am labelling it as a read: increaseAllowance adds to whatever is already there, and checked arithmetic reverts on overflow, so a phisher who asks for the true maximum risks the transaction failing on any wallet with a non-zero existing allowance. So they pick a number that is unlimited for every practical purpose and safe to add. That is somebody who has thought about the failure modes of their own product, which tells you what kind of business this is.

And it is a business, which is the point of the affiliate model. Group-IB’s Inferno split is 20% to the developer and 80% to the affiliate, 30% if the developer also builds and hosts the site. Ledger watched 15% flow to Angel Drainer off the Connect Kit funds. MS Drainer sold the source code outright with paid add-on modules, which is closer to a software licence than a heist. Read those three side by side and you are looking at a normal software market with normal pricing tiers: managed service, self-hosted, enterprise. The person who writes the drainer never touches a victim, never runs an ad account, never gets DMs from anyone. The person who runs the ad account does not need to understand a single thing about EIP-712. Group-IB found the panel showing affiliates their conversion rate: connections, successful hits, dollar value. That is a dashboard. Somebody optimised a funnel.

Now the numbers, and I want you to be harder on these than the coverage is.

Group-IB’s Inferno report is the best piece of work anyone has published on a drainer kit, and it does not claim the $80 million. Its own sentence is “As reported by Scam Sniffer”. Every outlet that ran “Group-IB: Inferno Drainer stole $80 million” attributed a figure to the wrong firm. Pink Drainer is worse: $75 million and $85 million appear in coverage published within days of each other, both tracing back to a Dune dashboard and a Telegram post, and nobody published a method. Scam Sniffer’s own $58.98 million for MS Drainer got rounded to $59 million everywhere. Monkey Drainer has a real measurement from SlowMist at $12.972 million and press figures of $1 million and $24 million floating alongside it. Chainalysis moved from $1 billion to $2.7 billion without new thefts, purely from finding more addresses, and said so.

None of that means the numbers are fake. It means they are estimates of a lower bound with different scopes, and the honest way to hold them is that this is a nine-figure annual problem whose exact size nobody knows. Scam Sniffer, whose numbers get quoted the most, prints its own limitation at the top of every report. Read that line before you quote the total.

Which brings me to 2025 and the 83% fall, because it is going to get misread all year. Losses went from $494 million to $83.85 million and victims from 332,000 to 106,106. That looks like a win, and some of it is: eth_sign is gone from MetaMask, gone from Safe’s interface, and wallets ship transaction simulation by default now in a way they did not in 2023. But Scam Sniffer’s own outlook says the fall “may partly reflect a shift toward harder-to-track attack vectors”, and its methodology only counts drainer sites on EVM chains. Private key compromise and targeted social engineering do not appear in that dataset at all. And the same report notes that the Bybit theft alone was 17 times the year’s entire signature phishing total. The mass-market end got harder and the high-value end got worse.

Here is the connection I think matters most, and it runs straight through the Bybit article on this desk. Three professional signers at a multi-billion-dollar exchange, each holding a hardware wallet, each following a cold-wallet procedure, produced three valid signatures over a payload their screen never showed them. A retail user approving a token allowance on a fake mint page is in the identical position: signing a thing they cannot read because the surface computing the display and the surface computing the payload are the same compromised code. Bybit lost $1.46 billion. The user loses $4,000. Same failure, seven orders of magnitude apart, and no amount of money buys you out of it. Safe deleted eth_sign three days after Bybit. MetaMask took from May 2024 to August 2024 to finish the job it proposed. Those two deletions are the clearest statement anyone in this industry has made about how bad blind signing is, and both were made by the people who built the thing.

The last thing that bothers me is what is missing from the case file above. Court: none. Docket: none. No named drainer operator has been publicly charged, anywhere, for any of this. Group-IB published a Telegram handle and a Telegram user ID for Inferno’s operator in early 2024. Scam Sniffer published MS Drainer’s forum handle and watched it change from pakulichev to Phishlab. Chainalysis ran a six-country operation that generated 7,000 leads and $162 million of identified losses, and what came out of it was account closures and frozen funds. That is real work and it helps victims. It is also not a prosecution. Compare that with the Illicit Finance desk, where the same dollar amounts produce indictments, forfeitures and sentencing dates. Approval phishing sits in an enforcement gap: too distributed for any single victim to justify a case, too jurisdictional for a domestic prosecutor, and the affiliate model splits the conduct across dozens of people who each did a small legal-looking part of it. Until that changes, the defence is entirely on you, and that is not a rhetorical flourish. It is a description of the current state.

What reduces your exposure

Nothing structural stops this. A trust does not stop somebody signing a permission, and an entity does not read calldata. This is a targeting problem, so there is no product to recommend and ** What follows is process, and most of it takes about twenty minutes. None of it makes you safe. Each item removes one specific way of losing money and leaves the others where they are, which is worth saying at the top rather than only at the end.

Go and look at your approvals now, before you finish reading. Two tools do this well. Revoke.cash covers more than 100 networks, takes an address or an ENS name without connecting a wallet, and lists every standing approval with its spender and amount. Sort the list newest to oldest, which puts anything you signed recently and did not mean to at the top. Each row has a revoke button, and a pencil icon that lets you reduce an allowance instead of removing it if you still need the spender. The second tool is your block explorer: Etherscan’s Token Approvals page, under the More menu, does the same job per token standard, and BscScan, Polygonscan and the rest work identically on their own chains. Revoking costs gas, so batch the work rather than doing it one approval at a time.

Check Permit2 separately, because it has two layers. The first is the ordinary ERC-20 approval you gave the Permit2 contract at 0x000000000022D473030F116dDEE9F6B43aC78BA3, which is usually unlimited. The second is the set of sub-allowances Permit2 is holding on your behalf. Revoke the outer approval when you are not actively using an application that needs it. For the inner ones, Permit2 exposes lockdown to batch-revoke approvals and invalidateNonces to kill signatures you signed but nobody has submitted yet. Revoke.cash surfaces both layers, which is the easier route than calling the contract yourself.

Revoke even after you have already been drained. Revocation recovers nothing. What has left the wallet has left, and a signature that has already been exploited cannot be unwound. What revocation does is stop the same permission being used a second time, which is not theoretical. Scam Sniffer documented a case in January 2024 where a victim lost about $4 million in Aave-deposited ETH, did not revoke, and the drainer came back to the same approval and took a further 158 ETH once a liquidation topped the balance back up. Several researchers tried to reach the victim on chain and failed. An allowance survives the theft it enabled.

Refuse anything you cannot read in words. If the confirmation shows a hash, a hex blob, or a field named data with no explanation, the only thing on your screen is a digest, and nobody can check a digest by eye. A wallet that decodes the call into a sentence with a token name, an amount and a counterparty is doing the one job that matters at the moment of signing. Where a wallet warns you that a message “can have dangerous side effects”, that warning is the product working; the Angel Drainer pages that told victims the warning came from an outdated MetaMask are the reason this needs saying.

A hardware wallet solves a different problem than the one you have here. It stops your private key ever reaching an internet-connected machine, and it does that well. It does not tell you the transaction is the one you intended. The device shows what it is handed, and when what it is handed is a 32-byte hash there is nothing on that screen to check. This is exactly what happened to three signers at Bybit, all of them on hardware. A device that can decode the specific call it is being asked to sign narrows one risk, which is signing something you would have refused had you been able to read it. That is what clear signing means, and what ERC-7730, currently a draft, is trying to standardise across wallets. Ledger committed after the Connect Kit incident to “removing [blind signing] as an option for Ledger users”. Buy the device for key protection, treat the on-device screen as a control only when it is showing you words, and do not read either feature as cover for the decision you make after reading them.

Keep a separate wallet for minting and for connecting to anything new. Fund it with what you are willing to lose that day. This does not lower the chance of being drained. It caps what a drain reaches, which is the only variable in this whole article you fully control. The kits check balances before they fire; Group-IB found Inferno skipping wallets under $100 because a careful user often connects a small wallet first to test the site. That behaviour is documented, so use it: the small wallet is the one that takes the hit, and the wallet holding the position never touches a page you have not used before. Keep long-term holdings in an address that has never signed an approval to anything.

Slow down on the copy-paste. Address poisoning works because wallets and explorers show you a shortened address, and the attacker has generated one that matches the first and last characters of somebody you have paid before. Only three of 53 wallets tested in 2025 warned a user sending to a poisoned address. Do not copy an address out of your transaction history. Use a saved contact you created yourself, check the middle characters rather than the ends, and send a small test amount first on any transfer large enough to hurt.

No legitimate project will ever need your seed phrase. Not for support, not for a migration, not to validate a wallet, not to claim an airdrop, not to fix an error. A seed phrase restores the wallet, so anybody who has it has everything, forever, on every chain. There is no situation in which typing it into a website is the correct answer. If a page asks, the page is the attack, and no other detail about the page matters.

Three limits worth naming, because a checklist that oversells itself is its own risk. Revoking allowances reduces exposure to standing permissions and does nothing about a compromised device, a stolen seed phrase, or a transfer you were talked into making on purpose. Clear signing tells you what you are signing and cannot tell you whether the counterparty deserves the permission. And every item here assumes the request reaches you through a screen you can inspect, which stops being true the moment the machine itself is compromised. The signature is only ever as good as the decision behind it, and the decision is only as good as what you were shown.

Sources

Disclosure. Max Avery is affiliated with Digital Ascension Group (DAG). Investment advisory services are offered through DAG Wealth, an SEC-registered investment adviser (CRD No. 328627). Registration does not imply a certain level of skill or training. DAG is not a law firm and does not provide legal or tax advice. Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. Nothing here is investment, legal, or tax advice, or a recommendation to buy or sell any asset. This article describes matters of public record; charges are allegations and defendants are presumed innocent unless and until proven guilty.

More from the journal

Continue reading.