Hopchain Hopchain
How it works
Learn ▾
Safety Guides Flagged Addresses Case files
Sybil check Bulk check Check a wallet →
Case file

After a search ad: how an old approval emptied a BNB Chain wallet

On 1 October 2026 at 02:56 UTC, a contract on BNB Chain moved 0.0351 BTCB out of a wallet without asking its owner again. The owner had earlier given that contract an unlimited approval. The wallet's owner reports that this happened after clicking a sponsored search result that pretended to be a well-known bridge. The transaction shows the mechanism clearly: nothing new had to be signed. Below is what the chain shows, what we could not check, and how to look at your own approvals.

Read this first: the chain data was read from the public BNB Chain network on 10 October 2026 and can be checked on any block explorer. The description of the ad and the site comes from a public report on r/CryptoScams, and we did not verify that part. We do not show the affected wallet's address. The chain shows addresses, not people, and we do not name or accuse anyone.

What happened on the chain

Chain BNB Chain (chain ID 56)
Transaction 0xc4ba2567814f651ee366512a9feaf84348fa0acd2a1b1ee191b85ab768a75592
When 1 October 2026, 02:56:01 UTC (block 125,024,213), successful
Sent by 0x29de5bd4eed7eba3495a3ca6ed1be8a7b9770559 (78 transactions in total)
Called contract 0x2d56934dd32baee8e997b444e727a49f804823d1, a small contract that takes a token, an amount, a source and a destination
Token and amount 0.035135 BTCB ("BTCB Token", 18 decimals)
From the affected wallet (not shown here)
To 0xaC91aB227308cf0F5E8763c808926Aa37403Dcd3

Why no new signature was needed

The transaction produced two events. The first is the transfer of 0.035135 BTCB to the destination address. The second is an approval event for the same token: the remaining allowance the wallet had given the called contract. It sits just below the maximum possible number, reduced by exactly the amount that was moved. That means the contract already held an unlimited approval from this wallet before 1 October, and simply used part of it.

An approval is a standing permission, not a payment. Once it exists, the approved contract can pull those tokens whenever it wants, up to the approved amount, without asking the owner again. That is why the owner never saw a request on that night. We explain this in unlimited token approvals.

Where the funds went

  • The destination 0xaC91…Dcd3 is an ordinary address, not a contract, with 7 transactions in total. On 10 October 2026 it held 0 BTCB: the funds were moved on. We did not follow them further.
  • A public automated check (GoPlus) does not flag this address. That is a good illustration that "no flags found" does not mean "safe".
  • The affected wallet also held 0 BTCB on 10 October.

What we cannot see

  • The ad and the site. The report names a look-alike domain, jumper.us.com, and says it was shown as a sponsored result. We did not open it or check the ad.
  • When and how the unlimited approval was granted. The public network endpoints we used do not serve older blocks, so we could not find the approval transaction.
  • What the called contract does beyond this call. We did not analyse its code.
  • Other victims and the full path of the funds after the destination address.
  • The value in US dollars at the time.

How to check your own approvals

  1. Open an approval checker: the one in your chain's block explorer, or Revoke.cash. Only use the official site and never enter a seed phrase.
  2. Look for contracts you do not recognise, especially with "Unlimited" next to a valuable token.
  3. Revoke what you do not need. It costs a small network fee per approval.
  4. If you signed something on a site you are not sure about, do this before anything else.

Habits that help

  • For wallets, bridges and exchanges, use a bookmark you created from the official site instead of a search result. Ads are paid placements, and some impersonate real projects.
  • Compare the domain letter by letter before connecting a wallet. Look-alikes often change an ending or add a word.
  • Prefer exact amounts over "unlimited" when a site offers the choice.
  • Keep your main funds on a wallet you do not use for new or unfamiliar sites.

See also how to check if a crypto address is a scam and fake airdrops and spam NFTs. Hopchain does not cover BNB Chain yet; for supported chains, paste an address on the home page.

Frequently asked questions

Can tokens be taken from my wallet without a new signature?
Yes, if you earlier gave a contract an unlimited approval for that token. The contract can then move the tokens on its own, up to the approved amount, without asking you again. That is what the transaction in this case shows.

How do I check which contracts can spend my tokens?
Use an approval checker, for example the one in the block explorer of your chain or Revoke.cash. It lists the contracts that have an approval on your tokens and lets you revoke them. Only use the official site and never enter a seed phrase.

Is a sponsored search result safe because it is at the top?
No. Ads are paid placements and some impersonate real projects. For wallets, exchanges and bridges, use a bookmark you made from the official site or type the address yourself, and compare the domain letter by letter before connecting a wallet.

What should I do if I think I signed something on a fake site?
Do not sign anything else. Check and revoke approvals on your tokens right away, move remaining funds to a new wallet created on a clean device if you are unsure, and report the site and the transaction hash to the relevant platforms and authorities. Ignore anyone offering to recover funds for a fee.

Found a mistake or have new information? Write to info@hopchain.io and we will correct this page. This is general information, not financial, legal or security advice.

More case files

Keep reading

Got an address you are unsure about? Paste it on the home page. It's free and needs no signup.