How to Revoke Token Approvals: The 10-Minute Fix Most Victims Skip
An approval you granted months ago can still drain your wallet today. Here is how approvals work, how to find every one you have granted, how to revoke them safely, and what to do if a drainer already used one.
You Did Not Send the Money. You Gave Permission to Take It.
Why an approval is a standing instruction, and why it outlives the site that asked for it.
What this guide says in 5 lines
- An approval is a standing permission, not a one-time payment. It stays valid until you revoke it or the token runs out.
- Most drainers use approvals granted weeks or months earlier, on sites that looked legitimate at the time.
- Revoking is free apart from gas, takes about ten minutes, and is the single highest-value action available to any wallet holder.
- Revoke from a clean device, and never from a site you reached through a link in a message.
- If a drainer already used an approval, revoke everything else first, then move remaining funds to a fresh wallet.
Most people who lose funds to a wallet drainer believe they were hacked. In the majority of cases they were not. They granted an approval — a standing permission for a contract to move a specific token from their wallet — and that permission stayed valid long after the site that requested it disappeared. The drainer did not break in. It used a key the victim handed over.
This matters because it changes what the fix is. There is no password to change and no device to wipe. There is a list of approvals, and every one of them is a door. Closing them takes about ten minutes, costs only gas, and is the highest-value security action available to anyone holding tokens in a self-custody wallet.
What an approval actually is
On Ethereum and other EVM chains, a token contract does not let a third party move your tokens directly. Instead, you call an approve function, which records that a specific address is allowed to spend up to a specific amount of a specific token from your wallet. That record lives on-chain, and it persists.
The critical detail is the amount. Many interfaces request an unlimited approval, because it saves gas on future transactions. An unlimited approval is a permanent permission: until you revoke it, that contract can move that token from your wallet at any time, without any further action from you.
| Type | What it allows | How long it lasts |
|---|---|---|
| Exact-amount approval | A contract to move a set amount of one token | Until spent or revoked |
| Unlimited approval | A contract to move any amount of one token, forever | Until revoked — there is no expiry |
| NFT operator approval | A marketplace to transfer any of your NFTs in a collection | Until revoked |
| Permit2 / signature approval | A signed message granting spending rights off-chain | Until the deadline in the signature, or until revoked |
| Native token (ETH) approval | Nothing — native tokens cannot be approved | Not applicable |
An approval does not expire. A site you used two years ago, which no longer exists, may still hold an unlimited approval on your wallet. That is the door drainers walk through.
Finding every approval you have granted
You cannot see approvals in your wallet interface, because they are recorded in the token contracts rather than in your wallet. You need a tool that reads the chain and lists them.
Use a well-known revoke tool, and reach it by typing the address yourself rather than clicking a link. This is the one step where a mistake is expensive: a fake revoke site is a standard drainer vector, and it works precisely because it arrives when you are already worried about security.
- 01Open a reputable revoke tool by typing its address directly into the browser bar.
- 02Connect your wallet — read-only at this stage, so no transaction is signed yet.
- 03Review the list of approvals, sorted by risk. Unlimited approvals to unknown contracts are the priority.
- 04Check each contract against the site you remember granting it to. If you do not recognise it, treat it as hostile.
- 05Revoke the ones you do not need, starting with unlimited approvals to unrecognised contracts.
- 06Repeat for every chain you have used, because approvals are per-chain and a drainer will use whichever one you left open.
Never reach a revoke tool through a link in a message, an email, an advert or a search result. Type the address. Fake revoke sites are one of the most effective drainer vectors in existence.
Revoking safely
Revoking is a normal on-chain transaction. It costs gas, it takes a few seconds, and it is irreversible in the sense that you would have to approve again to restore the permission — which is exactly what you want.
Do it from a device you trust, on a network you trust, with your wallet software up to date. If you believe your device is compromised, do not revoke from it: move your funds to a fresh wallet generated on a clean device first, then revoke from there.
- 01Confirm you are on the correct chain before signing. A revoke on the wrong network does nothing.
- 02Sign the revoke transaction and wait for confirmation. Do not close the tab until it confirms.
- 03Verify the approval is gone by refreshing the list.
- 04Repeat for each approval you want to close. Batch where the tool supports it to save gas.
- 05Record what you revoked and when, in case you need to explain the timeline later.
Revoke everything you do not actively use. The cost is a few dollars of gas; the alternative is an unlimited permission sitting on your wallet indefinitely.
If a drainer already used an approval
The order of operations matters, and getting it wrong can cost you the rest of your balance.
- 01Do not add funds to the compromised wallet, and do not try to “rescue” tokens by sending gas to it — drainers watch for exactly that.
- 02Revoke every remaining approval on that wallet, starting with unlimited ones. The drainer may hold more than one.
- 03Generate a fresh wallet on a clean device, with a new seed phrase, and move any remaining assets there.
- 04If the drainer used a Permit2 signature, check whether other signatures are still live and revoke them.
- 05Record the drainer's address and the transaction hashes, and add them to your evidence set.
- 06Report the drainer address to the platforms and blocklists that maintain scam-address lists.
Never send gas to a drained wallet to move remaining tokens. Drainer bots monitor compromised addresses and will take the gas and anything it unlocks. Move to a fresh wallet instead.
Preventing the next one
Approval hygiene is a habit rather than a one-off task, and it is the cheapest security measure available.
- Use a separate wallet for interacting with new or unfamiliar sites, funded only with what you are willing to risk.
- Keep your main holdings in a wallet that never connects to anything.
- Decline unlimited approvals where the interface offers a custom amount.
- Revoke approvals after you finish using a site, rather than leaving them open.
- Audit all approvals quarterly, on every chain you use.
- Treat any message urging you to “verify” or “revoke” via a link as hostile by default.
The single most effective habit is a burner wallet for anything new. It converts a potential total loss into a small one, and it costs nothing to set up.
Why this is the first thing to do after any suspicious contact
If you have interacted with a site you now distrust, or clicked a link you should not have, the approval audit is the first action — before changing passwords, before filing reports, before anything else. It is the only step that closes an open door rather than documenting a closed one.
It takes ten minutes. It costs a few dollars. And it is the difference between a scare and a loss for a large number of people every week.
Do the audit now, before you need it. The people who lose funds to drainers are almost never the ones who audited their approvals last month.
Common questions
Check the wallet before you revoke
Paste the address into the tracer to see its recent activity and whether it has interacted with known drainer contracts — free, in your browser.
Primary sources and further reading
- CISA — Cryptocurrency Scams www.cisa.gov
- FTC — What To Know About Cryptocurrency and Scams consumer.ftc.gov
- Chainalysis — Crypto Crime Report www.chainalysis.com
- FBI IC3 — Internet Crime Report www.ic3.gov
External links open in a new tab and are provided so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.
Keep reading
Someone you know may be in this situation right now.
Disclaimer: this guide is general information, not legal, financial or recovery advice, and it is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.