You didn't make no mistakes. You've have been programatically decieved to give approval for your token to be stolen. That's how it is here on web3.