Who has this problem. Someone whose wallet was emptied by a transaction they did not sign — which means no private key was stolen. A permission they granted once, months ago, was used to move the tokens.

What they have to work with today. An empty wallet, a transaction they cannot read, and eleven permissions left — three of them unlimited — with no way to tell which one was spent, or whether the same address can still reach the rest.

The question nobody answers. Not "is this signature dangerous?" and not "what have I approved?". The unanswered one is:

Which permission was used against me — and can it still reach me?

They solve it by hand: scrolling a block explorer, matching an outflow to a token contract, guessing at an allowance page that lists everything the wallet ever granted, and revoking whichever name looks most suspicious — usually after the second drain, not before it.

• Tokens that left inside transactions the wallet did not send. That is the drain fingerprint: a key was not used, so something else authorised the transfer.
• The submitting address, named. Not "suspicious contract" — the exact address that landed the transaction, on every row.
• Whether that address still holds a live permission right now. That is what turns a list of transfers into a containment list.

A tool that cries theft on ambiguous evidence is worse than one that reports what it measured.

• Attacker family, not a single address. Approvals are grouped by the address that deployed the spender — falling back to bytecode hash — so a drainer's sibling contracts appear together instead of one at a time.
• One-click revoke of the whole family, executed sequentially and verified one by one, because a batch that reports success while allowances survive is how people get drained twice.
• Exposure that is measured, never estimated up. Exposure is capped at the wallet's real balance, so an unlimited permission cannot produce a scary number that is not actually reachable.

• How many transactions, token transfers and approval events were actually decoded.
• The log window that was validated as complete, and a note when a wider range was answered but demonstrably incomplete.
• How many allowance pairs were read on chain, and how many permissions were granted and later revoked.

• Risk factors are tagged detected or estimated, so a heuristic can never launder itself into a measurement.
• Money and score are separate numbers: a $540,000 permission scores 15 when no danger signal fired. Correct — and the page says to read the two together.
• An empty result is presented as a measurement, with the coverage panel attached, not as a failure or an all-clear.

• Reads. Live allowance per token via eth_call, spender bytecode, deployment age and verification status, and owner-filtered approval logs — over public RPC with measured fallbacks, plus keyless explorer endpoints for history.
• Writes. The only transaction is the one your wallet signs to set an allowance to zero. There is nothing to trust Anchrion with.
• Networks. Ethereum, Base, Arbitrum One, Optimism and Sepolia — every endpoint probed for capability before it was added, and endpoints that silently truncate log queries are deliberately excluded.

• Pricing. Live values with a dated static snapshot as a labelled fallback, so "unpriced" is never rendered as zero.
• Reproducible. Scripts recompute a scan's coverage numbers independently, and the published risk model lets anyone recompute a score by hand and argue with it.
• Stack. Next.js 16, TypeScript, viem and wagmi, MIT licensed, single repository, deployed and live.

• ERC-20 allowances only. ERC-721 and ERC-1155 approvals are not covered today.
• Off-chain permits are invisible. Permit2, ERC-2612 and Seaport signatures leave no trace on chain until they are redeemed, so no scanner can see them from here — including this one.

• History is bounded. Approval events are read over a validated block window; a permission older than the readable window that never touched the wallet's history can be missed, and the coverage panel says so.
• No threat feed. Anchrion ships no list of malicious addresses and will not call an address an attacker without on-chain evidence. That is a deliberate limit, not an oversight.