Get an alert when your wallet grants a token approval (catch phishing approvals fast)

Most wallet drains start with an ERC-20 approve or setApprovalForAll signed on a phishing site. Get a push alert the moment your wallet grants one, then revoke it.

Many drains do not steal your key. You sign an approve, increaseAllowance, Permit/Permit2 or setApprovalForAll on a fake site, and the attacker spends the allowance later, sometimes hours later. If you see the approval right away, you can usually revoke it before it is used.

What to watch

• ERC-20 Approval(address owner, address spender, uint256 value), topic0 0x8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b925, with topic1 = your address.
• ERC-721/1155 ApprovalForAll(address owner, address operator, bool approved), topic0 0x17307eab39ab6107e8899845ad3d59bd9653f200f220920489ca2b5937696c31, with topic1 = your address and approved = true.

Limits: off-chain signatures (Permit, Permit2 signatures, Seaport orders) emit nothing until someone submits them, so no monitor can see them earlier. Permit2 allowances show up as an Approval from the Permit2 contract once used.

When the alert fires

1. Check the spender address on the block explorer. Is it the protocol you meant to use?
2. If not, revoke at once: revoke.cash, or the explorer's token approval checker (Etherscan and Basescan both have one), by setting the allowance to 0.
3. Move the remaining assets to a fresh wallet if you also typed a seed phrase anywhere.

Doing it with Ledgerbell (free tier)

1. Open the Ledgerbell dashboard and click Create a new key (no signup, no email; save the key).
2. Pick the chain (Base, Ethereum, Arbitrum One or OP Mainnet), type Wallet, paste the address.
3. Paste a webhook URL (Discord, Slack, Telegram bot, ntfy or any JSON endpoint) and click Add watch. Use test to send a sample message.

The wallet type alerts on new approvals and setApprovalForAll granted by the wallet, plus ERC-20 tokens in and out. Zero-value transfers (address poisoning spam) are ignored.

Free: 3 watches and 50 alerts/day, polled about once a minute. Pro (30 watches, 1,000 alerts/day) is 5 USDC on Base per 30 days. Or use the API:

curl -s -X POST https://ledgerbell.quietworklabs.workers.dev/api/key
curl -s -X POST https://ledgerbell.quietworklabs.workers.dev/api/watch -H 'content-type: application/json' -H 'x-api-key: lb_...' \
  -d '{"chain":"base","kind":"wallet","address":"0x...","webhook":"https://ntfy.sh/your-long-random-topic"}'