If you just signed a transaction you didn’t fully understand, or connected your wallet to a new site — stop reading after this sentence and go to revoke.cash right now. Then come back and read this.
Still here? Good. Let’s make sure you understand exactly what happened, what you need to do right now, and how to keep it from happening again.
What Is a Token Approval (And Why It’s Dangerous)
When you use a DeFi protocol — a decentralized exchange, a lending platform, a yield farm — the first thing it asks you to do is sign an “approval.” That approval gives a smart contract permission to move your tokens on your behalf. Without it, the protocol can’t touch your funds.
The problem? Most protocols default to “unlimited” approval. That means the contract can take any amount of your tokens, at any time, until you explicitly tell it to stop. You signed something that says “here, take whatever you want, whenever you want.”
A legitimate, battle-tested protocol will probably never abuse that. But a malicious contract, a hacked protocol, or a phishing site will drain your wallet the moment you look away. The approval is the key they’re waiting to use — and until you revoke it, that door stays open.
How to Revoke Token Approvals at revoke.cash — Step by Step
The fastest way to cut off unauthorized access is revoke.cash. Here’s the exact process:
Step 1: Verify the URL
Before you do anything, make sure you’re going to the real site. Type revoke.cash directly into your browser. Do not click a link from a Discord DM, a Telegram message, or a Google ad. Phishing sites impersonating revoke.cash exist — they’ll steal your wallet instead of protecting it. Type the URL yourself, every time.
Step 2: Connect Your Wallet
Click “Connect Wallet” and choose yours — MetaMask, Coinbase Wallet, WalletConnect, or whichever you use. You are only authorizing revoke.cash to read your approval data. Reading doesn’t cost gas and doesn’t give the site permission to move your funds.
Step 3: See Every Contract That Has Access
You’ll see a list of every smart contract that currently has approval to spend your tokens. Some will be protocols you recognize — Uniswap, Aave, a DEX you used last year. Others may be unfamiliar. That unfamiliarity is what you’re looking for.
Step 4: Revoke Approvals in Priority Order
Start with the most dangerous approvals first:
- Unlimited approvals on your largest token holdings — these are the highest risk
- Any approval from a protocol you don’t recognize — especially recent ones
- Older approvals from protocols you no longer use — good hygiene to clean these up
For each approval you want to remove, click “Revoke.” Your wallet will prompt you to confirm a transaction. You’ll pay a small gas fee — usually a few dollars on Ethereum mainnet, less on Layer 2 networks like Arbitrum or Base. That fee is worth it to protect your assets.
Step 5: Confirm Each Revocation
After each revocation, the approval disappears from your list. If it doesn’t, wait for the transaction to confirm on-chain and refresh the page. Revocations are irreversible — once done, the contract has zero access until you approve it again.
How to Identify Suspicious Approvals
Not sure which approvals to revoke? Here are the red flags to watch for:
You don’t recognize the name or contract address. If you can’t remember using a protocol and don’t recognize its name, treat it as suspicious. Copy the contract address and look it up on Etherscan.io. Check: Is it verified? How old is it? Have other wallets interacted with it and reported problems?
The approval amount shows “Unlimited.” This is the number 115,792,089,237,316,195… — the maximum possible value — or the word “Unlimited.” Any approval showing this means the contract can take your entire balance. This is the most dangerous type.
The approval was signed recently after visiting an unfamiliar site. Timing matters. If you clicked a link from a Discord server or Telegram group and then signed something, that’s a major warning sign.
The contract is unverified on Etherscan. Legitimate protocols verify their code publicly. An unverified contract at a suspicious approval is a serious red flag — revoke it.
Other Tools for Checking Wallet Approvals
revoke.cash is the gold standard, but a few other tools can help — particularly if you use multiple blockchains:
- Etherscan Token Approval Checker (etherscan.io/tokenapprovalchecker): Built directly into the block explorer, useful for Ethereum mainnet
- De.fi Shield (de.fi): Multi-chain support — useful if you’re active on Polygon, Avalanche, BNB Chain, and others
- Unrekt.net: An alternative to revoke.cash with multi-chain coverage
Use these as backups or for cross-chain coverage. For your primary revocation workflow, revoke.cash remains the most trusted and widely used option.
If You Think You’ve Already Been Drained
If tokens are already missing from your wallet, revoking approvals is still the right move — but it’s not your first step anymore.
Move any remaining assets to a fresh wallet address immediately. If the attacker has an active unlimited approval, every second you wait is a second they can drain more. Create a brand-new wallet, transfer your remaining funds, then go back to the compromised wallet and revoke everything.
For the complete emergency response playbook — what to do in the first 10 minutes, how to document the incident, and when to involve law enforcement — see What to Do If Your Crypto Wallet Gets Drained. That post walks through each step of the incident response process.
Revoking approvals after a drain still matters. A hacker with an active unlimited approval can come back for any tokens you accidentally send to that address later. Cut off their access completely.
Prevention: How to Revoke Token Approvals Before Trouble Starts
Once you’ve cleaned up existing approvals, here’s how to stay protected going forward:
Never sign an approval from a link. Legitimate DeFi protocols don’t send approval requests through email, Discord, or Telegram. If you received a link and signed something, treat it as malicious until proven otherwise.
Use a hardware wallet for significant holdings. Ledger and Trezor require physical button confirmation for every transaction. A phishing site can fool your browser — it cannot fool your hardware wallet if you read what you’re signing. For a complete setup guide, see DeFi Wallet Security Best Practices.
Review and revoke approvals monthly. Make it a habit. Five minutes on revoke.cash once a month prevents the slow accumulation of access you forgot you granted.
Request specific amounts, not unlimited. When a DeFi protocol asks for an approval, some interfaces let you set a custom amount instead of accepting the unlimited default. If you’re swapping $500 worth of a token, approve $500 worth — not your entire balance. The protocol can only ever touch what you approve.
Learn to recognize the setups before you’re targeted. Understanding how rug pulls and wallet drain schemes work is the strongest protection you have before you sign anything. How to Spot a Rug Pull Before You Lose Everything covers the patterns attackers use to get that first signature.
The Bottom Line
Token approvals are a necessary part of using DeFi. They’re also one of the most exploited attack surfaces in crypto. The good news: they’re completely reversible. A few minutes on revoke.cash, a few dollars in gas, and you’ve cut off unauthorized access to your wallet.
If you just connected to something suspicious, don’t investigate first — revoke first. Every minute an unlimited approval sits active is a minute it can be used against you.
Overwhelmed? Book a “Was I Scammed?” session ($49) — on-chain trace + a documentation pack for the FBI/IC3, police, and your bank. I will NOT promise to recover your funds; anyone who promises that is scamming you a second time. Book here