XPR Network · Security Utility · by ProtonNZ
Remove a wallet-drainer permission from your account.
Tricked by a fake XPR airdrop (like xprdrop.com)? A hidden permission may still let an attacker drain you. This tool finds it and removes it in one signed transaction. Non-custodial — it never touches your keys.
🛡️ Verify before connecting: announced by @protonnz on X · served only from protonnz.com · source on GitHub. Never trust a copy on another domain.
🚫 Two rules that stop this attack
- Never open a link from a token memo. Scammers airdrop tokens whose memo links to fake sites.
- There are no free XPR airdrops. If a site says you can "claim" thousands of $XPR — it's a scam.
You sign it yourself — no key is stolen
It's a permission-delegation drainer. You authorize it by signing what looks like an airdrop "claim".
XPRDROP) whose memo advertises an airdrop site.claim)
controlled by the attacker and linked to your token transfers — sometimes your unstaking too.XPRDROP token whose memo links to
the fake site. Receiving it is harmless; never open the link.
How this tool helps
It inspects every permission and linked action on the account, flags anything controlled by
an account that isn't you, and — if it finds the malicious permission — builds one transaction
(unlinkauth per link, then deleteauth) for you to sign. No backend; it can only
remove permissions, never move funds.