How to revoke token approvals before a wallet drainer strikes

A token approval is permission you give a smart contract to move your coins. Revoking cancels that permission. To revoke, open a trusted tool like Revoke.cash or the Etherscan approval checker, connect your wallet, pick the approval, and send one transaction. Do it for anything you do not recognize.

What a token approval actually is

Most crypto theft does not start with a stolen password. It starts with a signature you gave on purpose.

When you use a decentralized exchange or a lending app, the app cannot touch your tokens directly. You have to grant it permission first. That permission is the token approval. On Ethereum and similar chains, the ERC-20 standard handles it with a function called approve, which lets you approve whether an amount of token from an account can be spent by a third-party account, as the official Ethereum documentation puts it. The contract you approve gets an allowance, a set amount it is cleared to move on your behalf.

Think of it like a standing instruction at a bank. You tell the bank a named company may pull up to a set amount from your account whenever it wants. Handy for a subscription. Dangerous if the company turns crooked or someone forges its paperwork. A token approval works the same way, except it runs on code that executes without asking twice.

Here is the part that trips people up. Many apps ask for an unlimited approval rather than a one-time one. That is convenient, because you sign once and never again. It is also the opening a thief wants. An approved contract can move the approved tokens at any later time, for any reason, with no second signature from you.

How a wallet drainer turns an approval into theft

A wallet drainer is a kit that tricks you into approving a contract the attacker controls. The bait is usually a fake website. A cloned airdrop page, a counterfeit version of a real app, a link dropped in a hijacked Discord. You connect your wallet, a box asks you to approve or sign, and the wording looks routine. One click later, the attacker holds an allowance over your tokens.

The numbers show how common this became. In 2025, crypto phishing drained $83.85 million from 106,106 victims, according to blockchain security firm Scam Sniffer in a report covered on 4 January 2026. That was down 83 percent from $494 million the year before. The fall is real. The method did not go away. Signature tricks using the permit and permit2 functions alone accounted for $8.72 million across three large cases, Scam Sniffer said. Those figures count only drainer attacks run through phishing sites on EVM chains. They leave out direct hacks, exchange failures and contract exploits, so the true total runs higher.

How to tell a risky approval from a safe one

You cannot judge an approval by how the box feels. You judge it by three things. The amount, the spender, and whether it is even an approval at all.

Check the amount first. A request for unlimited, or a number that looks like a long string of nines, is a warning sign unless you have a clear reason to grant it. A reputable app will usually let you cap the amount if you ask. Check the spender next. If you reached the site from an ad, a direct message or a fresh airdrop link, and the contract is one you have never dealt with, treat it as hostile until it proves otherwise.

Then look at what you are actually signing. A normal approval is an on-chain transaction with a network fee. A permit or permit2 request is different. It is a gasless signature, so there is no fee, and many victims relax because nothing seems to cost anything. That is the trap. A free signature can still hand over an allowance. Read the token name, the spender and the amount in the signing window every single time, even when you are rushing. Especially then.

Why disconnecting your wallet does not revoke it

This is the mistake that costs people the most. They get nervous, hit disconnect in their wallet, and assume the danger has passed. It has not.

Disconnecting only ends the current browser session. The approval itself lives on-chain, inside the token contract, which keeps a running list of who you have approved. As Revoke.cash explains, that list updates only when you grant or revoke an approval. Close the tab, switch devices, come back a month later. The allowance is still there, still valid, still usable by whoever holds it.

So self-custody does not save you here. Your keys never left your device. You authorized the access yourself, and a hardware wallet signs a malicious approval as obediently as a hot one.

How to revoke a token approval, step by step

Revoking is one transaction that sets the allowance back to zero. For a standard token, your wallet calls approve again with the amount set to 0. For a blanket NFT permission, it calls setApprovalForAll with the value false. You do not need to do any of this by hand. Tools do it for you.

Two are worth bookmarking. Revoke.cash shows every approval tied to your address and lets you cancel them one at a time. Etherscan runs a Token Approval Checker that, in its own words, lets you review and revoke your token approvals for any dApp, and shows the value at risk if a given contract were hacked. Many wallets, including MetaMask, now bundle a revoke feature too.

The steps are short. Connect your wallet to the tool. Sort the list so the ones you do not recognize, and anything marked unlimited, sit at the top. Select those. Send the revoke transaction, pay the small network fee, and confirm the entry now reads zero.

Start with the riskiest. An unlimited approval on a stablecoin you forgot about is a bigger hole than a capped approval on a token worth a few dollars.

What revoking can and cannot do

Revoking is prevention, not recovery. It stops future transfers. It cannot pull back coins a drainer has already taken, because those transactions are final.

One trap deserves its own warning. Some attacks do not use an on-chain approval at all. They get you to sign an off-chain permit or permit2 message, a gasless authorization the attacker can submit later. Revoking your on-chain approvals will not cancel a signature you already handed over. The only real fix there is to move your remaining funds to a fresh wallet before that signature is used.

And watch the revoke tools themselves. Attackers build fake copies of Revoke.cash and sites like it to catch people in a panic. Reach these tools through a saved bookmark, never through a search ad or a link a stranger sends you.

What to watch

A clean habit beats a cleanup. When an app offers a custom amount, approve only what the trade needs instead of the unlimited default. The extra click is worth it. Set a reminder to sweep your approvals once a month, which takes a few minutes and clears the junk left by apps you tried once. Keep large balances in a separate wallet that never touches random sites, and guard your seed phrase just as closely, because a leaked recovery phrase hands over everything at once, approvals or not.

Approval theft tracks how busy a chain gets. More new tokens, more airdrops and more untested apps mean more chances to sign the wrong thing. Two shifts are worth following. Wallets are getting better at simulating a transaction before you sign, so you can see what an approval would really do. At the same time, attackers have started bundling several harmful actions into a single signature using newer account features. The safest move stays simple. Approve little, revoke often, and read what you are signing before you click.