A drainer using token approval: how to distinguish malicious approval from seed-phrase theft, revoke permissions, protect remaining assets, and preserve evidence.