How to Find and Revoke Dangerous Token Approvals (Before They Drain Your Wallet)

Here’s a scary thought: right now, there might be smart contracts out there with unlimited access to your crypto tokens — and you probably forgot you gave them permission.

Every time you’ve swapped tokens on a DEX, minted an NFT, or interacted with a DeFi protocol, chances are you signed a token approval. Most of us click “Approve” without thinking twice. But those approvals don’t expire. They sit there quietly, waiting — and if the contract behind them gets exploited or turns malicious, your funds can vanish in seconds.

Let’s fix that today.

What Exactly Is a Token Approval?

When you interact with a decentralized application (dApp), it often needs permission to move tokens on your behalf. For example, if you want to swap USDC for ETH on Uniswap, Uniswap’s smart contract needs your approval to access your USDC.

This is done through a function called approve() on the token’s smart contract. You’re essentially saying:

“Hey, I give this contract permission to spend up to X amount of my tokens.”

The problem? Most dApps request unlimited approval by default. That means the contract can access all of your tokens of that type — not just the amount you’re swapping right now, but everything you hold, now and in the future.

Why Are Token Approvals Dangerous?

On their own, approvals to trusted protocols are generally fine. But here’s where things get risky:

1. Exploited Contracts

Even legitimate protocols get hacked. If a contract you approved gets compromised, attackers can use your existing approval to drain your tokens without you signing anything new.

2. Abandoned Projects

That random DeFi protocol you tried eight months ago? If the team disappears and someone exploits a vulnerability, your approval is still active.

3. Phishing and Scam dApps

Ever connected your wallet to a sketchy site to claim a “free airdrop”? You might have unknowingly approved a malicious contract to spend your tokens. This is one of the most common ways people lose funds in crypto.

4. Unlimited Approvals

Since most approvals are set to unlimited by default, a single compromised contract can wipe out your entire balance of that token — not just the amount you originally intended to use.

Top 5 Most Dangerous Approvals to Watch For

Not all approvals carry the same risk. Here are the ones you should prioritize revoking:

1. Approvals to unknown or unverified contracts — If you don’t recognize the contract address, revoke it immediately. You may have interacted with a phishing site without realizing it.

2. Unlimited approvals on stablecoins (USDC, USDT, DAI) — These are high-value targets. Attackers specifically look for wallets with unlimited stablecoin approvals.

3. Approvals to dead or abandoned projects — If the protocol no longer exists or hasn’t been updated in months, there’s no reason to keep the approval active.

4. Approvals granted on unfamiliar chains — If you’ve been experimenting on newer or less-established chains, those contracts may have weaker security audits.

5. Old approvals from before a protocol’s migration — Some protocols upgrade their contracts. Your approval to the old (now unsupported) version could become a liability.

How to Check and Revoke Token Approvals: Step-by-Step Guide

The good news is that checking and revoking approvals is simple, free (aside from a small gas fee), and takes just a few minutes. The most popular tool for this is Revoke.cash, but there are alternatives like Etherscan’s Token Approval Checker and Unrekt.

Let’s walk through the process using Revoke.cash.

Step 1: Go to Revoke.cash

Open your browser and navigate to revoke.cash. You’ll see a clean, straightforward interface with a search bar at the top.

What you’ll see: A simple homepage with the Revoke.cash logo, a prominent search/connect area, and options to select different blockchain networks.

Step 2: Connect Your Wallet

Click the “Connect Wallet” button. You can use MetaMask, WalletConnect, Coinbase Wallet, or several other options. Alternatively, you can simply paste your wallet address into the search bar if you just want to view approvals without revoking yet.

What you’ll see: A wallet connection popup appears, showing supported wallet options. Select yours and confirm the connection in your wallet extension.

Step 3: Select the Right Network

Make sure you’re on the correct blockchain network. Revoke.cash supports Ethereum, Polygon, Arbitrum, Optimism, BSC, Avalanche, and dozens of other chains. If you’ve used multiple chains, you’ll need to check each one separately.

What you’ll see: A dropdown menu or network selector near the top of the page. Switch between networks to scan approvals on each chain.

Step 4: Review Your Approvals

Once connected, Revoke.cash will display a list of all your active token approvals. For each one, you’ll see:

• The token you approved (e.g., USDC, WETH)
• The spender — the contract address that has permission
• The approved amount — often shown as “Unlimited”
• The date the approval was granted

What you’ll see: A table or list view showing each approval as a row, with token icons, spender addresses (sometimes with protocol names if recognized), and a “Revoke” button on the right side of each entry.

Take a moment to scan through this list. Recognized protocol names like Uniswap or Aave are generally lower risk (though unlimited approvals to them are still worth reviewing). Anything you don’t recognize should raise a red flag.

Step 5: Revoke Suspicious Approvals

Found something you don’t recognize — or an old approval you no longer need? Click the “Revoke” button next to it.

Your wallet will prompt you to confirm a transaction. This is an on-chain transaction, so you’ll need to pay a small gas fee (usually just a few cents on Layer 2 networks, potentially a dollar or two on Ethereum mainnet).

What you’ll see: Your wallet popup asking you to confirm the revoke transaction, showing the estimated gas fee.

Once the transaction confirms, that contract can no longer access your tokens. Done.

Step 6: Repeat for Other Networks

If you’ve been active on multiple chains — and most of us have — switch to each network and repeat the process. Don’t forget about chains you may have tried once and forgotten about. Those forgotten approvals on a random BSC protocol from 2021 could be your biggest vulnerability.

Alternative Tools Worth Knowing

While Revoke.cash is the most popular and user-friendly option, here are a few alternatives:

• Etherscan Token Approval Checker — Go to etherscan.io/tokenapprovalchecker and connect your wallet. It’s Ethereum-only but comes from a trusted source.
• Unrekt.net — A multi-chain approval checker with a straightforward interface.
• De.Fi Shield — Part of the De.Fi security suite, it checks approvals alongside other wallet risks.
• Rabby Wallet — This wallet has a built-in approval management feature, so you can check and revoke directly from your wallet interface.

Best Practices to Stay Safe Going Forward

Revoking old approvals is a great start, but here’s how to protect yourself moving forward:

• Set custom approval amounts — When a dApp requests unlimited approval, manually edit the amount in your wallet to only what you need for that specific transaction. Yes, it means you’ll need to re-approve next time, but it dramatically limits your risk.
• Revoke approvals after you’re done — Finished using a protocol? Revoke the approval right away. Make it a habit.
• Schedule monthly check-ups — Set a recurring reminder to visit Revoke.cash and audit your approvals. Think of it like changing your passwords regularly.
• Be cautious with new and unaudited protocols — The newest DeFi farm offering 10,000% APY probably isn’t worth the risk of an unlimited token approval.
• Use a separate wallet for experiments — Keep your main holdings in a wallet that rarely interacts with dApps. Use a separate “burner” wallet for trying new protocols.

Your Challenge: Revoke One Approval Today

Here’s my challenge to you: go to Revoke.cash right now, connect your wallet, and revoke at least one unnecessary approval. Just one. It’ll take two minutes, cost a few cents, and could save you from a devastating loss down the road.

Once you’ve done it, drop a comment below and tell us:

• How many active approvals did you find?
• Were any of them surprising or unrecognized?
• Which one did you revoke?

I’ll go first — last time I checked, I had 47 active approvals on Ethereum mainnet alone. Several were to contracts I couldn’t even identify. That’s terrifying when you think about it.

Final Thoughts

Token approvals are one of crypto’s hidden dangers. They’re easy to forget about, they never expire, and they can be exploited long after you’ve stopped using a protocol. The few minutes it takes to audit and revoke your approvals is one of the highest-impact security steps you can take as a crypto user.

Don’t wait for a hack to remind you. Take control of your wallet permissions today.

Stay safe out there. 🛡️