What you are signing: wallet approvals and drainer scams around pump.fun

• What happens when you click “Approve”
• Common patterns behind fake pump.fun pages
• Habits that prevent most of this
• If you think you signed something bad
• Further reading

Disclosure: I run PumpFunReferralCode.vip, an independent guide to the pump.fun invite code SAVE100. The site uses a referral link, so I may benefit if you sign up through it. Not affiliated with pump.fun. Not financial advice.

Most people who lose a whole wallet around memecoins do not lose it on a bad trade. They lose it by signing something they did not read. Pump.fun’s popularity makes it a favourite theme for fake “claim”, “airdrop” and “bonus” pages, so it is worth understanding what a wallet signature actually does.

§What happens when you click “Approve”

On Solana, your wallet (Phantom, Solflare, a Ledger and so on) holds the key that authorises transactions. When a site asks you to sign, it hands your wallet a transaction or a message. If you approve a transaction, the network executes everything in it: transfers of SOL, transfers of tokens, changes to who controls a token account. There is no “undo”. A signature on a malicious site can move far more than the amount shown on the page.

§Common patterns behind fake pump.fun pages

• “Claim your reward” or “airdrop” buttons on a look-alike domain. Real rewards are announced on the platform’s own site; a page that asks you to connect and sign to receive something should be treated as hostile.
• Fake support in DMs asking you to “verify” or “sync” your wallet, or asking for your recovery phrase. No legitimate service needs your recovery phrase, ever.
• Look-alike links in replies and comments, with an extra hyphen, a different ending, or a lookalike letter.
• “Bonus code” pages that promise a guaranteed reward for a code. An invite code is not a reason to sign anything beyond the platform’s normal sign-up.

§Habits that prevent most of this

1. Type the address yourself or use a bookmark. Check that the address bar reads exactly pump.fun before connecting.
2. Read the wallet preview. Modern wallets simulate the transaction and show what will leave your wallet. If it shows assets you did not expect to send, reject it.
3. Use a separate trading wallet with only the SOL you are prepared to risk, and keep long-term holdings elsewhere.
4. Never share your recovery phrase or private key, and never paste it into a website.
5. When in doubt, do nothing. A real opportunity will still be there after you have checked it; a scam depends on urgency.

§If you think you signed something bad

Move any remaining assets to a fresh wallet with a new recovery phrase as quickly as possible, stop using the old one, and assume anything left in it can be taken. Report the site to your wallet provider.

§Further reading

How to recognise a genuine pump.fun invite link and what to check while signing up is covered step by step in how to use a pump.fun referral code. Coin-level red flags are in rug pull warning signs, and a short overview of fees and safety is at pump.fun fees and safety.

Risk warning: memecoins are highly speculative and volatile, and most lose most of their value. Only use money you can afford to lose.