WWCWildWildCrypto
Menu

Wallet safety / Updated 2026-06-21

Token Approval Revocation Guide: The Blank Checks Draining Wallets, and How to Cancel Them

A plain-language token approval revocation guide: how approve signatures work, how drainers exploit unlimited approvals, and how to check and revoke them.

How this guide is checked

Official sources first, no wallet connection, no guaranteed returns.

Reviewed on 2026-06-21 by WildWildCrypto Safety Desk. Method: Human editorial review with official-source checks, affiliate-disclosure checks, and no-financial-advice checks.

Publisher: WildWildCrypto Editorial. Corrections go through the contact page. We do not ask for seed phrases or tell you what to buy.

token approval revocation matters because A wallet can be emptied without your password and without anyone stealing your seed phrase, simply because months ago you approved a contract you no longer remember.

This guide explains what an approval really is, how drainers turn an unlimited one into an open door, and how to check and revoke approvals.

You will learn approvals versus transfers, the blank-check mental model, how to read a signing prompt, and a revocation routine that shrinks your blast radius.

What is a token approval, and how is it different from a transfer?

A transfer moves tokens out of your wallet once, right now. An approval does not move anything; it grants a smart contract standing permission to move a set amount of one token on your behalf, whenever it chooses, until you cancel it. Most apps need this so a contract can pull tokens during a swap or a deposit.

The danger is the amount. Many apps default to an unlimited approval so you never have to approve again, which means you have signed a permission with no ceiling and no expiry. The permission lives on the blockchain independently of the app, so closing the website does nothing to it.

Checklist

  • Remember that approve grants permission, it does not send funds.
  • Treat an unlimited approval as a signed blank check.
  • Know the permission survives after you leave the app.
  • Prefer a limited approval amount when the app allows it.

How do wallet drainers exploit unlimited approvals?

A drainer rarely needs your seed phrase. It needs you to sign one approval to a contract it controls, usually on a fake mint, airdrop, or 'connect to claim' page. Once you approve, the attacker can call the contract at any later time and pull the approved token straight out of your wallet, even days later, with no further click from you.

The CFTC and SEC investor education offices warn that fraudulent crypto sites are built to look professional while functioning as theft funnels, and approval-phishing is one of their core tools. Because the malicious permission is just a normal-looking approval, it can sit unnoticed until the wallet is swept.

Checklist

  • Be suspicious of any page that rushes you to connect and approve.
  • Never approve a token you did not intend to trade or deposit.
  • Assume a surprise airdrop or mint that needs an approval is bait.
  • Check your approvals after using any unfamiliar dapp.

How do I check and revoke the approvals I have already given?

You can review every approval a wallet has granted using an approval-checker such as revoke.cash or the token-approval tool built into major block explorers. Connect read-only, look for unlimited allowances and contracts you no longer recognize, and revoke them. Revoking is itself an on-chain transaction, so it costs a small network fee, but it cancels the blank check.

Ethereum.org's wallet guidance and the broader self-custody literature stress that the recovery phrase is the master key and should never be entered anywhere; revocation tools never need it. A legitimate revoke tool only asks you to sign a revoke transaction, never to type your seed phrase.

Checklist

  • Review allowances with revoke.cash or your explorer's approval tool.
  • Revoke unlimited approvals and any contract you do not recognize.
  • Never enter your seed phrase into any approval tool.
  • Re-check approvals on a regular schedule, not just once.

How do I read what I am actually signing before I approve?

Slow down at the signing prompt and read it like a contract, because it is one. Look at which token the permission covers, which contract address receives the permission, and the amount; a value shown as unlimited or a very large number is the warning sign. If your wallet lets you edit the amount, set it to only what the transaction needs.

Be especially careful with signatures that are not normal transactions, such as Permit or set-approval-for-all style messages, which can grant sweeping permissions in a single off-chain signature. If a prompt is vague, the safe move is to reject it and verify the app through its real domain before trying again.

Checklist

  • Read the token, the spender address, and the amount every time.
  • Edit unlimited approvals down to what the action needs.
  • Treat Permit and approve-for-all prompts as high-risk.
  • Reject any signing request you cannot fully understand.

Why does a hardware wallet and a spending-limit habit shrink the damage?

A hardware wallet shows the transaction details on its own screen and requires a physical button press, so malware on your computer cannot silently approve a drainer in the background. It does not stop you from approving a bad contract yourself, but it removes the invisible-signature attack and gives you a last chance to read the prompt.

Setting spending limits is the other half. Approving only the amount a transaction needs, instead of unlimited, caps how much any single compromised contract can ever take. Combined, a hardware wallet and limited approvals turn a potential total loss into a contained, survivable one.

Checklist

  • Use a hardware wallet so approvals require a physical confirmation.
  • Verify the transaction on the device screen, not just the computer.
  • Approve only the amount the transaction actually needs.
  • Keep high-value funds in a wallet that never touches unknown dapps.

Authority sources used

Outbound links are included for verification and entity authority, not decoration.

FAQ

If I revoke an approval, are my tokens safe again?

Revoking closes one specific door: it cancels a contract's standing permission to move a particular token from your wallet, using an on-chain revoke transaction that costs a small network fee. What it does not do is reverse a transfer that has already happened; once a drainer has pulled tokens out using an approval you granted, revoking that same approval afterward does nothing to bring those tokens back; it only stops that contract from taking more later. 'Safe again' means your remaining tokens are protected going forward, not that anything already taken is recovered. That is why timing matters more than the tool itself: revoke a suspicious or unlimited approval the moment you notice it, not after you've confirmed something is wrong. Review every approval your wallet has granted using a checker like revoke.cash or your block explorer's approval tool, and revoke anything unlimited or unrecognized as a routine habit, not a one-time cleanup.

Does an approval let a contract take my other tokens too?

Only if you signed a broader permission than a standard approval. A normal ERC-20 approval is scoped to one specific token, up to the amount the prompt specified, and cannot touch anything else in your wallet. The exception is 'setApprovalForAll' permissions, common on NFT marketplaces, which grant standing control over an entire collection instead of one item; Permit-style off-chain signatures work similarly, bundling sweeping approval into a single click with no separate on-chain transaction per token. Both are riskier than a normal approval because one signature can cover far more than it appears to at a glance. The only way to know what you granted is to read the signing prompt: check which token or collection it names, which contract address receives the permission, and whether the amount is limited or unlimited. Reject any prompt that does not make all three clear, and verify the app's real domain before trying again.

Can I be drained even if I never shared my seed phrase?

Yes, and this is the mechanism most people underestimate. A wallet drainer does not need your seed phrase; it needs one signature from you on a malicious approval, usually collected through a fake mint, airdrop, or 'connect wallet to claim' page. Once you sign, the attacker's contract can call itself at any later time, even days afterward, and pull the approved token straight out of your wallet with no further action from you. The CFTC and SEC investor education offices have warned that fraudulent crypto sites are built to look professional while functioning purely as theft funnels, and approval phishing is one of their most effective tools precisely because it leaves your seed phrase untouched, so victims often assume they were careful. Read every signing prompt before you approve, and revoke old approvals periodically with a tool like revoke.cash, even when your recovery phrase has never left cold storage.

Do revocation tools need my seed phrase?

No, and this is a reliable way to spot a fake revocation site. A legitimate tool such as revoke.cash or a block explorer's approval page connects to your wallet read-only to display your approvals, then asks you to sign a normal revoke transaction through your wallet's own interface, the same way you would sign any other on-chain action. Ethereum.org's wallet guidance and the wider self-custody literature are consistent on this point: the recovery phrase is the master key to your funds and should never be entered anywhere, and a genuine revocation tool has no technical reason to ask for it. If any page claiming to help you revoke approvals asks you to type, paste, or import your seed phrase, close it immediately; that is not a revocation tool, it is a theft attempt. Only ever interact with your wallet's own signing prompt to revoke, never a form or text field.