Last updated: October 30, 2026
To revoke token approvals, connect your wallet to an approval checker such as Revoke.cash, the Etherscan Token Approval Checker or your wallet's built-in approval list, find contracts you no longer use (especially "unlimited" ones), and send a revoke transaction for each, which costs a small network fee. An approval lets a smart contract move your tokens whenever it wants, long after you've left the site. If that contract is malicious or gets hacked, the tokens go with it. A five-minute cleanup every few months closes that door.
- ~5 min to review and revoke
- Unlimited = the default on many apps
- 1 gas fee per revoke
- 0 effect on a leaked seed — move funds instead
What is a token approval?
Tokens like USDT, USDC or any ERC-20 can't be pulled from your wallet by a contract unless you approve it first. When you swap on a DEX or deposit into a lending app, your wallet asks you to approve the app's contract to spend a token. Many apps ask for an unlimited amount so you don't have to approve again next time. That approval stays active until you revoke it, even if you never visit the site again.
| Type | How it's granted | Risk |
|---|---|---|
Token approval (approve) | An on-chain transaction | The contract can spend up to the approved amount at any time |
| Permit / Permit2 | A signature, often with no transaction | Drainers love it: one signed message can hand over a token without you paying any gas |
| NFT "approval for all" | An on-chain transaction | Every NFT in that collection can be moved |
| EIP-7702 delegation | A signed authorization | Not an approval at all — gives the contract control of the whole wallet |
How to revoke approvals — step by step
- Open an approval checker from a bookmarked or typed URL: Revoke.cash (most EVM chains), Etherscan's Token Approval Checker (and the same tool on BscScan, PolygonScan and others), or the approvals list built into wallets like Rabby.
- Enter or connect your address. Checking only needs your public address; connecting is needed to revoke.
- Sort by risk: unlimited amounts, contracts you don't recognise, apps you no longer use and anything flagged as an exploit or phishing.
- Click revoke and confirm the transaction in your wallet. Each revoke is an on-chain transaction with a normal network fee.
- Repeat on every chain you use. Approvals on Ethereum, BNB Chain, Arbitrum, Base and Polygon are separate.
- On Tron, check TRC20 approvals in TronScan's account view; on Solana, look for token delegates in your wallet or a Solana approval tool.
When revoking won't save you
- Your seed phrase or private key leaked. The attacker can sign anything; revoking is pointless. Move everything to a new wallet — seed phrase compromised: what to do.
- A drain is already happening. Bots move faster than you. Transfer remaining funds out first, revoke later.
- A signed permit wasn't used yet. It can still be submitted until it expires. Tools like Revoke.cash can cancel Permit2 permissions too.
- Your wallet is delegated to a malicious contract via EIP-7702 — that's not an approval, see EIP-7702 explained.
Habits that keep approvals safe
- Approve exact amounts when your wallet lets you edit the number, instead of "unlimited".
- Use a separate wallet for new or risky apps, with only what you need.
- Read every signature request, especially ones that mention "Permit" — see blind signing and wallet drainer scams.
- Review approvals after any incident on a site you've used, like the Polymarket script attack.
- Ignore random tokens that appear in your wallet. Trying to sell them is a common approval trap — unknown token in wallet.
Frequently asked questions
How do I check my token approvals?
Paste your public address into Revoke.cash or the Etherscan Token Approval Checker. You'll see every contract allowed to spend your tokens, the amount and the date. Checking is free and doesn't require connecting your wallet.
Does revoking approvals cost money?
Yes, each revoke is an on-chain transaction with a normal gas fee. On Ethereum mainnet it can cost a few dollars; on layer-2 networks and BNB Chain it's usually cents.
Should I revoke all approvals?
Revoke anything unlimited, unknown or unused. Approvals for apps you use every day can stay, but limited amounts are safer than unlimited ones.
Will revoking get back stolen tokens?
No. Revoking only stops future spending. Tokens already moved are gone; report the theft and be wary of anyone offering recovery for a fee.
Do instant swaps need token approvals?
No. With an instant exchange you simply send coins to a deposit address from your wallet, so no contract gets permission to spend your tokens.
Swap without approvals or wallet connections: compare live offers on /swap and send from your own wallet — for example ETH → XMR or USDT → BTC. No account, no ID, no logs.