What to collect
- Token, owner and spender addresses
- Approval value and transaction order
- Receipt and matching transfer evidence
Before drawing a conclusion
An approval alone is not proof of theft. Later allowances and the token’s own implementation can change the result.
Test the idea
An approval for 1,000 tokens appears. Is that evidence that 1,000 tokens left?
Reveal the explanation
No. It records permission. You need evidence of an executed transfer to describe a movement.