A permission you sign, separate from a transfer
Connecting your wallet to a site shares your address. At some point after that, many sites ask for a second signature, and that one can create a token approval instead of moving anything. An approval names a contract address and gives it permission to move a set amount of your tokens later, without asking you to sign again. Revoking an approval cancels that permission. It leaves your tokens exactly where they were.
Ethereum's ERC-20 standard and TRON's TRC-20 standard both keep one balance per address, and that balance changes only through a transfer. Granting or revoking an approval leaves that balance as it is.
Why a site wants the second signature, not just the connection
A connection on its own only lets a site read your address, which is already public on the blockchain. It cannot move tokens. A site designed to take tokens from visitors needs the approval signature, because that is what lets a contract reach into your balance later instead of asking you to send something directly. That is the signature worth reading carefully before you approve it.
Checking the contract and the transfer record before you act
Two checks settle what has actually happened to your tokens, and both use a block explorer, a public tool that reads the blockchain and lays out every transfer in the same fields.
- Confirm the token is genuine. Tether's contract on Ethereum is 0xdAC17F958D2ee523a2206206994597C13D831ec7. Its contract on TRON is TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t. A token that calls itself USDT from a different contract is not Tether's USDT.
- Search your wallet address on Etherscan if the token is on Ethereum, or on Tronscan if it is on TRON. Each one shows the sender, the recipient, the token contract, the amount and the time of every transfer tied to that address.
- Look at outgoing transfers from the time you connected to the site up to today. An approval lets a contract move tokens later, so a clean record on the day you connected is not enough. If nothing went out in that whole period, your balance has not moved, whatever the site's own page claims.
- If a transfer did go out, the explorer shows where the tokens went and when. Keep that record in case you report it.
A connect prompt and an approval signature look alike and are not
Wallets show more than one kind of prompt. A connection prompt shares your address and nothing else. An approval prompt either creates a new permission or increases the amount an existing one allows. Sites may label its button claim, verify or enable, so judge the prompt by what it asks for and ignore the label. If it lets a contract spend one of your tokens, signing it gives that contract a standing permission over your balance.
What these checks settle, and what they leave open
A matching contract address and a transfer record with nothing unexpected tell you that no tokens have left your address so far. They cannot tell you whether the approval still exists, because the transfer record does not list current approvals. Treat any approval you signed on a site you no longer trust as active, and cancel it in the wallet you signed it with. Until you do, the contract can still move tokens up to the amount you approved.
If the record is hard to read, for example several transfers close together or an address you do not recognize, paste that address into TrustSniffer's wallet checker. The block explorer shows what moved. The wallet checker is our tool for judging whether the receiving address is linked to known risk, and a flagged address is a reason to report the transfer. You can also run the site itself through our website checker before you trust anything its page shows about your balance.
