Revoking Token Approvals: How Much Risk Do They Leave Open?

By Chanuka Geekiyanage Oct 27, 2026

A token approval is a standing permission that lets a smart contract move a specific token out of your wallet. It stays active after you close the app, and many apps request an unlimited amount by default. That means one old approval to a compromised or malicious contract can empty a balance without any further action from you. This article shows which approvals carry real risk, how Permit and Permit2 signatures change the picture, which tools work best for checking and revoking, and when revoking is not enough.

Panaprium is independent and reader supported. If you buy something through our link, we may earn a commission. If you can, please support us on a monthly basis. It takes less than a minute to set up, and you will be making a big impact every single month. Thank you!

How Much Risk an Open Approval Really Leaves

An approval alone does not move your funds. The risk starts when the approved spender is malicious, gets hacked, or is upgraded into something harmful. Then it can call transferFrom up to the approved limit, with no new prompt for you.

Unlimited approvals on tokens you still hold are the worst case. A July 2026 incident shows how it plays out. A user lost 999,999 USDT after signing a phishing token approval on Ethereum. Scam Sniffer said the attacker’s script recalculated and pulled the exact remaining balance.

Time is another factor. Cointelegraph reported a victim who lost $908,551 in USDC 458 days after signing a malicious approval. The permission did nothing for over a year, then a drainer used it in a single transaction.

The scale is real but shrinking. Scam Sniffer’s data for EVM wallet drainers shows $83.85M lost across 106,106 victims in 2025. That was down 83% in value and 68% in victims from 2024. The dataset covers EVM drainer phishing only, so it understates total wallet theft.

Notice the drop from 2024 to 2025, and that large cases still cluster around busy market periods.

Not All Approvals Carry the Same Risk

Three approval types behave very differently. The table compares them by what they expose and how you can control them.

Approval type	How it is granted	Main risk	Best control
Standard ERC-20 approve	On-chain transaction	Unlimited amount, no expiry	Set exact amounts, revoke after use
Permit (EIP-2612)	Off-chain signature	Signature looks harmless, spent later	Read the signing prompt, use a signing-warning extension
Permit2	One approval to Permit2, then signatures	One signature can grant a spender a large allowance	Check expiry, revoke Permit2 allowances

Permit2 deserves special attention. Uniswap’s docs say its allowances have an amount and an expiration, and the maximum uint160 value is treated as an unlimited allowance. The same system lets an owner revoke in batch through a lockdown function. Expiry is a real improvement over forever approvals, but only when the signer or the app actually sets a short one.

The tradeoff is easy to miss. Standard approvals are visible because they need a transaction. Signatures are quieter, which is why Permit and Permit2 signatures accounted for 38% of major losses in Scam Sniffer’s 2025 large-case data. The largest single 2025 case, $6.5M, used a Permit signature.

Newer attack types also exist. Scam Sniffer noted two EIP-7702 batch signature attacks after the Pectra upgrade that caused $2.54M in losses. These are not classic approvals, so a revoke tool may not show them.

Which Revoke Tool to Use

Three options cover most users. Pick based on your chains and how often you check.

Tool	Coverage	Strengths	Weaknesses	Best for
Revoke. cash	Many EVM chains	Shows approvals by token and spender, includes Permit2	Needs a wallet connection, and clone sites exist	Regular multi-chain cleanups
Etherscan Token Approval Checker	Ethereum mainnet, with sister explorers for other chains	Familiar explorer, ERC-20, 721, and 1155 tabs	One chain per explorer	Single-chain users, second opinion
Rabby wallet manager	Chains supported in the wallet	Built into the wallet, no extra site	Only useful if you use Rabby	Daily DeFi users

Revoke. Cash added Permit2 approval support in 2023, which matters because older tools missed those allowances. Etherscan’s checker lets you switch between ERC-20, ERC-721, and ERC-1155 tabs and press Revoke. Rabby shows approvals inside the app.

Image source: revoke.cash

Look at the allowance column and the last updated date. Unlimited entries and old dates are where to start.

Image source: etherscan.io/tokenapprovalchecker

Notice how each row shows the token, the spender contract, and the allowance amount, with a Revoke button beside it.

What to Revoke First

You do not need to clear every approval. Revoking costs gas on each transaction, so prioritize by exposure.

Unlimited approvals on stablecoins and large holdings. A drainer targets the biggest balances first.
Spenders you do not recognize. Look the contract up on a block explorer before deciding.
Apps you stopped using. A dormant approval keeps its full power, as the 458-day case shows.
Anything granted during an airdrop claim or mint. These are common phishing entry points.
Permit2 allowances with long or no expiry. Revoke the app-level allowance, not just the main Permit2 approval.

For a step-by-step process, see this step-by-step revoking walkthrough. Revoking works by setting the allowance back to zero, so the spender can no longer pull that token.

Where Revoking Falls Short

Revoking is cleanup, not a full defense. Several cases sit outside it.

Stolen funds do not come back. Revoking only prevents future transfers.
Unused off-chain signatures need a different fix. MetaMask’s guidance for a risky signed message is to revoke through a tool, or move at-risk tokens to a different account. In practice, moving funds is the safer move when you are unsure a signature is still live.
Hardware wallets do not change the math. A drainer that receives approval from a hardware wallet can spend the approved amount like any other. The device only helps if you read what you are signing.
Some thefts skip approvals entirely. Seed phrase leaks and malicious contracts you fund yourself are not fixed by a revoke tool.

This is why prevention matters more than cleanup. Set exact approval amounts when the app allows it. Read every signature prompt, and use a wallet that simulates transactions before you sign.

If you want a deeper look at the mechanics, this guide on how to revoke smart contract allowances explains the contract-level side.

Common Mistakes

Revoking only the Permit2 root approval. The individual app allowances underneath can stay live.
Using a lookalike revoke site. Scammers clone popular tools, so use a bookmark.
Checking one chain only. An approval on a side chain is still a live permission.
Revoking after a drain and assuming the job is done. If your key or seed phrase is compromised, revoking will not stop the attacker from moving other assets.
Treating hardware wallets as full protection. They secure keys, not your judgment on a signature prompt.

My Take

Open approvals leave a real but conditional risk. For a wallet with small balances and a few well-known apps, the risk is low. For a wallet holding thousands in stablecoins with years of unlimited approvals, it is high enough to justify a monthly check.

My routine would be simple. Use a separate wallet for new or unproven apps, and keep long-term holdings in a wallet that rarely signs anything. Run Revoke. Cash across every chain you use once a month, and cross-check the largest balances on Etherscan. Cancel anything unlimited, unfamiliar, or tied to an app you no longer use.

Use Rabby if you transact daily, because the built-in approval list saves a step. Skip obsessive revoking if you hold almost nothing on the wallet and rarely connect to dApps. In that case, wallet separation does more than approval hygiene.

The bigger lesson from the 2025 data is that signatures now cause more large losses than old-style approvals. Treat every signing prompt as a spending decision, not a login step.

Conclusion

Open token approvals leave meaningful risk when they are unlimited, old, or tied to contracts you no longer trust. The danger grows with balance size and time, and signature-based approvals such as Permit and Permit2 are now a leading cause of large losses. Revoking removes the standing permission, but it will not recover funds already taken or fix a compromised key.

Start with Revoke. Check your biggest stablecoin and token approvals, and cancel unlimited or unfamiliar ones first. Then reduce future exposure by capping approval amounts, separating wallets, and reading every signature before you confirm.

FAQs

1. How often should I revoke token approvals?

A monthly check is a reasonable routine for active DeFi users. Run an extra check after any airdrop claim, mint, or interaction with a new protocol.

2. Does revoking a token approval cost gas?

Yes, each revoke is an on-chain transaction that needs a network fee. Prioritize unlimited approvals on your largest balances to get the most protection per fee paid.

3. Can a revoked approval still be used by an attacker?

No, a revoked on-chain allowance is set to zero, so the spender cannot pull that token. An unused off-chain signature is different, so move funds if you think one is still valid.

4. Are Permit2 approvals safer than regular approvals?

They can be, because Permit2 allowances support expiry and one-call batch revocation. They are also riskier in one way, since a single signature can grant a large allowance without a visible on-chain transaction.

5. Will a hardware wallet protect me from malicious approvals?

It protects your private keys, but it will still sign an approval if you confirm it. You need to read the spender and amount on the device screen before approving.

References

Scam Sniffer, 2025 annual wallet drainer report: https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/

Cointelegraph, Trader loses $1M after signing phishing token approval: https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval

Cointelegraph, Crypto victim loses $908K in sophisticated phishing attack: https://cointelegraph.com/news/crypto-victim-loses-908k-in-sophisticated-phishing-attack.

Forklog, Ethereum user loses nearly $1M USDT in phishing scam: https://forklog.com/en/ethereum-user-loses-nearly-1-million-usdt-in-phishing-scam/

Was this article helpful to you? Please tell us what you liked or didn't like in the comments below.

About the Author: Chanuka Geekiyanage

Chanuka is a content writer, editor and contributor at Panaprium, specializing in long-form editorial articles. He conducts in-depth research and produces well-structured, carefully edited content with a strong focus on clarity, SEO best practices, and consistent formatting. His work spans lifestyle, fashion, wellness, and technical topics, and all articles are reviewed and refined to meet Panaprium’s editorial standards.

What We're Up Against

Multinational corporations overproducing cheap products in the poorest countries.
Huge factories with sweatshop-like conditions underpaying workers.
Media conglomerates promoting unethical, unsustainable products.
Bad actors encouraging overconsumption through oblivious behavior.
- - - -
Thankfully, we've got our supporters, including you.
Panaprium is funded by readers like you who want to join us in our mission to make the world entirely sustainable.

If you can, please support us on a monthly basis. It takes less than a minute to set up, and you will be making a big impact every single month. Thank you.