A friend of mine texted me at 1 a.m. last month with one line: “why is my USDC gone.” He hadn’t clicked a fake link that night. He hadn’t signed anything shady in weeks. The approval that drained him was almost four months old, sitting quietly on a dead NFT mint page he’d forgotten existed. He just never revoked it.
That’s the part people miss about crypto wallet security. You can avoid every obvious scam, never click a phishing link, never connect to a shady site again in your life, and still get drained because of something you approved months ago and forgot about. Old approvals don’t expire. They just wait.
So let’s fix that. This is a straight, no fluff walkthrough on how to revoke smart contract allowances using two free tools, Revoke.cash and Etherscan’s token approval checker, plus what actually causes this problem and what to do if you think you’re already exposed.
What a Token Approval Actually Is
When you swap on Uniswap, list an NFT on OpenSea, or bridge a token somewhere, your wallet doesn’t just “let” the app move your funds. You sign a separate transaction called an approval, and it tells the token’s smart contract: this specific address can spend up to this much of my tokens, whenever it wants, until I say stop.
Here’s the part that trips people up. Most dapps don’t ask for approval to spend the exact amount you’re using right now. They ask for an unlimited approval, technically the maximum uint256 value, because it saves you from re-approving every single time you trade. Convenient for you. Also convenient for anyone who eventually gets control of that contract.
That’s the unlimited ERC20 token allowance risk in one sentence: you gave a contract a blank check, and blank checks don’t have expiry dates.
Why This Actually Matters (the numbers)
I’m not going to scare you with made up stats, the real ones are bad enough. According to Scam Sniffer’s phishing data, wallet drainer losses hit close to 500 million dollars in 2024 alone, across more than 330,000 affected wallets. 2025 losses dropped sharply to around 84 million dollars, which sounds like good news until you notice why. Attackers shifted from a handful of massive heists to thousands of smaller, quieter hits, average loss per victim fell to roughly 790 dollars, and the game moved from “hit a whale” to “hit everyone a little.”
The tool of choice for that shift is the approval itself, specifically Permit and Permit2 signatures. Instead of a normal approval transaction, these let someone authorize a spend by just signing a message, no gas, no on chain confirmation to double check first. Scam Sniffer’s data shows Permit based approvals accounted for close to 38 percent of losses in incidents over a million dollars. You don’t even see a transaction pop up, just a signature request that looks like nothing, and by the time you realize what you signed, the funds are already routed through a mixer.
That’s why “I’ll just be careful” isn’t a full strategy. You also need to periodically clean house.
Revoke.cash Tutorial: The 3 Step Guide
Revoke.cash is the tool most security researchers point people to first, and for good reason. It’s free, it doesn’t require an account, and it reads directly from the blockchain rather than some third party database, so there’s nothing to trust beyond the chain itself. Here’s the whole process.
Step 1: Connect Your Wallet
Go to revoke.cash and click Connect Wallet in the top right corner, or just paste your public wallet address into the search bar if you’d rather not connect at all. Pasting the address works fine for viewing approvals. You’ll only need to actually connect when you’re ready to revoke something, since that step requires signing a transaction.
Once you’re in, pick the network from the dropdown at the top of the page. Revoke.cash covers Ethereum, Arbitrum, Optimism, BNB Chain, Polygon, Base, Avalanche, and over a hundred other EVM chains at this point. If you’ve been active across several chains, check each one separately. Approvals don’t carry over between chains, which also means risk doesn’t stay contained to just the chain you’re worried about.
Step 2: Inspect What You’ve Approved
Once the page loads, you’ll see a full list of every active approval tied to that address on that network, the token, the spender contract, and the amount approved. This is usually the moment people go quiet for a second, because most wallets that have been active for even a year end up with a surprising number of open approvals sitting there.
Sort by newest first if you suspect a recent scam signature, since that’s the one you want to kill immediately. Otherwise, scan for two red flags. Anything marked “Unlimited” next to a token you rarely use, and any spender address you don’t recognize, especially one attached to a protocol you don’t remember visiting. Revoke.cash flags known risky or drainer associated spenders in the interface, which helps, but don’t rely on that as your only filter. If a name doesn’t ring a bell, treat it as suspicious until proven otherwise.
Step 3: Revoke (or Reduce) the Approval
Click the Revoke button next to anything you don’t currently need. This triggers a small on chain transaction that sets the allowance back to zero, and you’ll pay a small gas fee for it since it’s a real write to the blockchain, not just a UI toggle. On Ethereum mainnet this can run a few dollars depending on congestion. On Layer 2 chains like Arbitrum or Base it’s usually pocket change.
If you still use a protocol regularly but don’t love the idea of an unlimited approval sitting open, click the pencil icon next to the amount instead of the trash icon. That lets you edit the allowance down to something reasonable, say, the amount of your next planned trade, rather than nuking the approval entirely and having to re-approve later. It’s a nice middle ground for protocols you trust but want to limit blast radius on.
Repeat for every risky approval, confirm each transaction in your wallet, and you’re done. For most people this whole process takes under ten minutes once you know what you’re looking at.
Backup Method: Revoke Token Approvals on Etherscan
If you’d rather not touch a third party interface, or you just want a second source to cross check what Revoke.cash showed you, Etherscan has its own built in Token Approval Checker. It’s less polished but coming straight from the block explorer itself, which some people find more reassuring.
Head to Etherscan and search “Token Approvals” or navigate to etherscan.io/tokenapprovalchecker. Connect your wallet the same way, review the list of active approvals it pulls from on chain approval logs, and click Revoke next to anything you want gone. The mechanics are identical under the hood, since both tools are just calling the same approve function with the amount set to zero. Etherscan’s version is more limited to Ethereum mainnet and a smaller set of indexed chains, so if you’re heavily multichain, Revoke.cash saves more time.
| Revoke.cash | Etherscan Approval Checker | |
|---|---|---|
| Chains supported | 100+ EVM chains | Mainly Ethereum and a few indexed chains |
| Risky spender flagging | Yes, built in labels | No |
| Batch revoke | Yes | Limited |
| Gas cost | Standard network gas | Standard network gas |
| Best for | Regular multichain cleanup | Quick single chain cross check |
Disconnect Wallet from Dapps vs. Revoking Approvals
People mix these two up constantly, and it’s worth being blunt about the difference. Disconnecting your wallet from a dapp, the button you click in MetaMask or your wallet’s connected sites list, only removes the site’s ability to see your address and prompt you for new signatures. It does nothing to existing approvals already on chain. You can disconnect from a sketchy site every single day and the approval you gave it three weeks ago will still be sitting there, fully armed.
Think of it this way. Disconnecting closes the door. Revoking takes back the key you already handed someone. You genuinely need to do both. Disconnect from dapps you don’t recognize as basic hygiene, and separately, actually revoke the approvals through Revoke.cash or Etherscan. Skipping the revoke step because you disconnected is the exact gap that got my friend drained.
Drainer Wallet Fix: What to Do If You Think You’re Already Hit
If you clicked something you shouldn’t have and you’re not sure what you signed, move fast but don’t panic sign anything else. First, check Revoke.cash immediately, sorted newest first, and revoke anything unfamiliar before the attacker gets around to using it. Drainers often sit on a signed approval for a bit before draining, so speed genuinely helps here.
Second, if funds are already gone, do not send anything to a “recovery service” that DMs you on Twitter or Telegram. That’s a second scam layered on top of the first one, and it’s extremely common right after a drain. Legitimate recovery, if it happens at all, doesn’t come from unsolicited messages asking for a fee upfront.
Third, treat that wallet as burned for anything valuable going forward. If the compromise came from a leaked seed phrase rather than just a malicious approval, revoking won’t help, since the attacker can just sign a new approval whenever they want. Move remaining assets to a brand new wallet with a freshly generated seed phrase, and don’t reuse the old one for anything again.
A Habit, Not a One Time Fix
Here’s the honest truth. You’re going to approve tokens again next week, and the week after that, because that’s how DeFi works. The fix isn’t avoiding approvals altogether. It’s building a habit of checking Revoke.cash every month or so, right after you finish a big trading session, or any time you interact with a brand new or unaudited protocol. Ten minutes, a few dollars in gas, and you close a door that a lot of people leave wide open for years without ever noticing.
FAQ
Does revoking a token approval cost gas? Yes. Revoking sets the on chain allowance to zero, which is a real transaction, so it requires network gas just like any other transfer or swap.
Will revoking approvals affect my token balance? No. Revoking only removes a spending permission. Your tokens stay exactly where they are in your wallet.
How often should I check my approvals? Once a month is a reasonable baseline for active DeFi users, and immediately after using any new or unfamiliar dapp.
Can I revoke approvals on a hardware wallet? Yes, both Revoke.cash and Etherscan work with hardware wallets connected through MetaMask or WalletConnect. You’ll confirm the revoke transaction on the device itself.
Is Revoke.cash safe to connect my wallet to? It’s widely used by the security research community and only requests read access plus the ability to prompt you for revoke transactions, which you approve individually. It cannot move funds on its own.
