Revoke.cash has stopped more than 140 million dollars in losses from compromised smart contracts since it launched in 2019. That number sounds reassuring until you flip it around. It only counts the approvals people actually found and cancelled in time. Nobody tracks the ones that got missed, because those wallets just show up empty one morning with no warning at all. If you have ever connected your wallet to a new protocol, minted an NFT, or tried a DeFi platform just once and forgot about it, there is a decent chance an old approval is still sitting open right now, waiting for the wrong contract to get compromised.
Why Token Approvals Quietly Put Your Wallet at Risk
Every time you swap on a DEX, stake a token, or mint something new, you are usually asked to approve a smart contract to spend your tokens on your behalf. Most people click approve without reading the fine print, and a huge share of those approvals are set to unlimited by default. That means the contract can move your entire token balance whenever it wants, not just the amount you intended for that one transaction. The approval does not expire after use either. It stays active indefinitely unless you manually cancel it. So if that contract gets hacked six months later, your funds are still exposed even though you have not touched the app since.
What Is Revoke.cash and Why It Matters in 2026
Revoke.cash is a free, open source tool built specifically to let you see and cancel token approvals across your wallets. Connect your address, and it pulls every active approval tied to it, across more than 100 supported networks, into one readable list. The project has been protecting users since 2019 and recently added paid Premium and Ultimate tiers for people managing several wallets or chains at once, plus a browser extension built with Fairside that flags phishing links and risky approvals before you sign them. For most individual users though, the free version still covers everything needed to clean up a wallet properly.
How to Revoke Token Approvals Using Revoke.cash: Step by Step Tutorial
This part is genuinely simple, and it takes most people under ten minutes once they know where to look. Here is the full walkthrough.
- Go to revoke.cash and connect your wallet. Click Connect Wallet in the top right corner and choose MetaMask, WalletConnect, Coinbase Wallet, or whichever wallet you use. You can also paste in any public wallet address without connecting, if you just want to inspect it first.
- Select the correct network. Revoke.cash will auto detect your active chain, but you need to check each network separately, since approvals on Ethereum, Polygon, Arbitrum, Base, and BNB Chain do not show up together automatically.
- Review your full approval list. You will see a table listing every token, the spender contract, the allowance amount, and roughly when it was last updated.
- Check the Value at Risk column. This estimates how much you could lose if that specific contract were exploited today, in dollar terms, so you can prioritize which approvals to kill first.
- Click Revoke next to any approval you want to cancel. Your wallet will pop up asking you to confirm a transaction.
- Confirm and pay the small network fee. Revoking is an on chain transaction, so it costs gas, though batch revoking multiple approvals in one go can reduce the total cost significantly.
- Refresh the page to confirm it is gone. The approval should disappear from your list within a minute or two once the transaction confirms.
Repeat this across every chain your wallet has ever touched, not just the one you use most often. People frequently forget they interacted with a testnet bridge or a short lived farming protocol on a different chain years ago, and that forgotten approval is often the riskiest one in the whole list.
Reading the Revoke.cash Dashboard Like an Analyst
The dashboard gives you more than a simple yes or no on whether something is risky. Treat it the way you would treat a portfolio report, not just a checklist.
- Spender column: Shows exactly which contract address holds the permission. Unfamiliar addresses with no verified name deserve a closer look before anything else.
- Allowance column: Tells you whether the approval is capped at a fixed amount or set to unlimited, which is the single biggest risk factor on the page.
- Last updated: An approval from an app you used once years ago and never touched again is a prime candidate for revoking, regardless of the amount involved.
- Risk or exploit tags: Revoke.cash flags contracts linked to known hacks or drainer scripts, and these should always be revoked immediately, no exceptions.
Sorting by Value at Risk rather than by date is usually the smarter approach, because a small forgotten approval on a compromised contract can still matter less than a large unlimited approval sitting on something that looks perfectly fine today.
Revoke.cash vs Manual Methods Like Etherscan
You can technically do all of this manually through a block explorer like Etherscan, using its token approval checker tool and writing a revoke transaction yourself through the contract interface. It works, but it is slow, chain by chain, and genuinely unfriendly for anyone who is not comfortable reading raw contract calls. Revoke.cash automates the discovery part entirely, pulls in approvals across every supported network from a single connection, and adds the dollar value context that Etherscan simply does not calculate for you. For a one off check on a single contract, Etherscan is fine. For actually auditing and cleaning an entire wallet, Revoke.cash is faster, clearer, and far less likely to leave something behind by accident.
Revoke.cash Premium, Ultimate and Auto Revoking: Is It Worth It
The free tier handles manual revoking for individual wallets perfectly well, and that covers most retail users without any real limitation. Premium adds a unified multichain view across all your approvals and exploit exposure for up to ten wallets, along with unlimited batch revokes at no extra fee, which matters if you actively trade across several chains. Ultimate goes further with Auto Revoking, where you set rules once and Revoke.cash monitors your wallet continuously, automatically cutting off approvals tied to newly exploited contracts without you needing to notice the news first. For a casual holder checking in occasionally, free is enough. For someone running multiple active wallets, the paid tiers start making real sense.
Common Mistakes People Make When Revoking Approvals
A surprising number of users undo their own progress without realizing it, so watch out for these.
- Revoking only on the chain you currently have selected and assuming the rest of your wallet is clean.
- Re approving the same unlimited allowance the very next time you use that app, undoing the work entirely.
- Ignoring low value approvals because the dollar figure looks small today, forgetting that token prices change.
- Connecting a wallet to revoke.cash through a link shared on social media rather than typing the URL directly.
- Assuming a revoked approval protects past transactions, when it only prevents future ones from that contract.
None of these mistakes are complicated to avoid once you know they exist, which is really the whole point of building this into a habit rather than a one time cleanup.
How Often Should You Revoke Token Approvals
Treat this like checking your credit card statement rather than a one time spring cleaning task. A reasonable rhythm is once a month for an active wallet that interacts with new protocols regularly, and once every few months for a wallet you mostly just hold tokens in. The moment is also worth doing right after any major exploit headline, even if you are fairly sure you were not affected, because approval chains between protocols can expose you indirectly. Setting a recurring reminder, or simply upgrading to Revoke Ultimate’s Auto Revoking if you are managing several wallets, removes the guesswork and the need to remember at all.
Frequently Asked Questions
Is Revoke.cash safe to connect my wallet to? Yes. Revoke.cash is free and open source, and connecting your wallet only grants it permission to display your data and prepare revoke transactions, which you still have to confirm individually.
Does revoking a token approval cost money? Yes, since it is an on chain transaction that requires gas, though batching several revokes together on supported networks can lower the combined cost.
Will revoking an approval affect tokens I already lost? No. Revoking only prevents a contract from moving your tokens in the future. It does not reverse any transaction that already happened.
Can I check someone else’s wallet approvals on Revoke.cash? Yes, you can paste any public wallet address into the search bar without connecting your own wallet, which is useful for research or verifying your own cold storage from another device.
How is Revoke.cash different from a hardware wallet? A hardware wallet secures your private keys, while Revoke.cash manages the permissions you have already granted to smart contracts. You need both for proper wallet hygiene.
Related reading: How to Revoke Smart Contract Allowances | Crypto Wallet Security Basics | Hot Wallet vs Cold Wallet | How to Set Up a Crypto Wallet Safely | Multisig Wallets for Teams and DAOs
