Decentralized apps, or dApps, let you lend, trade, and interact with crypto directly from your wallet, with no middleman. But there's often no undo button once you approve a transaction or sign a message. Knowing the risks before you connect is the best protection you have.

A decentralized application (dApp) is an app that runs on a blockchain network like Ethereum or BNB Chain instead of a centralized server. On your Binance.US Wallet, you can connect to dApps via QR code or browse dApps directly in the app.

The openness of blockchain means anyone can deploy a smart contract or create a dApp. Scammers exploit this by building fake dApps that closely mimic legitimate ones, tricking users into signing risky messages or approving harmful transactions.

Social engineering is one of the most common ways scammers trick users into connecting their wallets to malicious dApps. Instead of relying on technical exploits, these scams manipulate emotions like fear, curiosity, and urgency.

Here's how it typically unfolds:

In DeFi, approvals are a normal part of interacting with smart contracts. They let a dApp move your tokens on your behalf. In approval phishing, malicious dApps abuse this by prompting you to approve unlimited token spending.

Once granted, scammers can drain your wallet over time using smart contract functions. Since approvals stay active until you manually revoke them, the scammer can keep accessing your wallet long after the initial interaction.

Signature phishing tricks you into signing unreadable or arbitrary data off-chain. Unlike a standard transaction, there's no gas fee, no blockchain record, and no immediate red flag. Once a valid signature is created, scammers can submit it to a smart contract later to gain access to your tokens without you realizing it.

A common version of this scam abuses Permit and Permit2, which are legitimate off-chain approval methods:

Scammers disguise malicious Permit or Permit2 requests as harmless prompts. If you sign one, they can withdraw your funds long after the interaction. Since no transaction is broadcast when you sign, the breach often goes unnoticed until the tokens are gone.

If a signature request is unreadable or doesn't make sense, don't sign it.

These scam sites claim to fix common wallet issues like slippage errors or failed transactions. They're actually designed to steal your seed phrase or private keys.

Here's how it works:

Your Binance.US Wallet has built-in safeguards including transaction simulations and signature filters. It also blocks approvals to externally owned addresses (EOAs), high-risk requests, and known malicious dApps. Always read wallet warnings before confirming a transaction or signing a message.

Before interacting with any dApp, take time to evaluate it. Legitimate projects are typically audited by independent security firms, with reports available on their official website. Be cautious of anonymous teams, vague documentation, or low community activity.

Always access dApps from verified links on the project's official website. Scammers create fake sites by subtly misspelling domain names or swapping in lookalike characters, which can be hard to spot at a glance. Avoid clicking search ads, as phishing sites frequently pay to appear at the top of results. When in doubt, type the URL manually.

If anyone asks for your seed phrase or private key, stop immediately. No legitimate dApp, service, or support agent will ever ask for it. The moment you share it, your wallet is compromised. Close the tab and walk away.