Token approvals explained: the hidden permission that can empty your wallet, and how to revoke it

Most people know they should protect their seed phrase. Fewer know about a second way to lose tokens without ever sharing it: a token approval. Every time you use a decentralized exchange, an NFT marketplace or another app on Ethereum, you may be giving a smart contract permission to move your tokens. If that contract is malicious or gets hacked, the permission is all it needs.

This guide explains how approvals work, why apps ask for so much access and how to check and revoke them.

What a token approval is

Tokens on Ethereum follow standards. The ERC-20 standard, which most tokens use, includes three functions that matter here, according to ethereum.org:

• approve: lets a third-party account spend tokens on behalf of the owner, up to a set amount.
• allowance: returns how many tokens a spender is still permitted to use from an owner’s account.
• transferFrom: moves tokens from one account to another, typically used by a third party that has been approved.

So when a decentralized exchange swaps your tokens, you usually first approve its contract to spend them, and the contract then uses transferFrom to take them when you trade.

For NFTs, the ERC-721 standard has a similar approve function for a single token, plus setApprovalForAll, which lets an “operator” manage all of your NFTs in that collection at once.

A worked example

Suppose you want to swap 200 USDC on a decentralized exchange:

1. The app asks you to approve its contract to spend your USDC. If you accept the default, that may be an unlimited allowance.
2. You confirm the swap, and the contract uses transferFrom to take 200 USDC.
3. Under ERC-20, the allowance is how many tokens the spender is still permitted to use. With a 1,000 USDC approval, the remaining allowance would typically be 800; with an unlimited one, the contract can still move all your USDC.

Weeks later, you’ve forgotten the app, but the permission is still there. That’s the risk this guide is about.

Why apps ask for unlimited access

ethereum.org explains that projects often request unlimited allowances to minimize the number of requests: you approve once and pay the transaction fee once, instead of approving every time you trade.

It’s convenient, but it means the permission is much larger than any single trade needs.

Why that’s risky

ethereum.org is blunt: once a platform has unlimited access rights to one of your tokens, it can spend all those tokens, even if you’ve withdrawn your funds from the platform.

That becomes a problem if:

• the contract was malicious from the start, for example a fake app or a phishing site that got you to sign an approval;
• a legitimate app’s contract is later hacked or exploited;
• you approved a contract you no longer use and have forgotten about.

Phishing sites often don’t ask for your seed phrase at all. They ask you to “connect your wallet” and sign a transaction that turns out to be an approval. See fake crypto apps and phishing.

Approvals you sign without a transaction: “permits”

Not every approval is an on-chain transaction. A widely used Ethereum standard, ERC-2612, adds a permit function to tokens. It lets you change an allowance with a signed message instead of a transaction, so you don’t need ETH for gas to approve.

The signed permit names the spender, the amount and a deadline. Once anyone submits it to the token contract before the deadline, the allowance is set as if you had approved it yourself. The standard notes that the person you sign it for isn’t necessarily the one who submits it.

What this means for you:

• A signature request can be as powerful as an approval. A pop-up asking you to “sign” a message, with no gas fee, can still hand over spending rights.
• Check the spender, amount and deadline in any permit request. An unknown spender, an enormous amount or a far-off deadline are red flags.
• Be wary of “harmless” signatures. A site that asks you to sign a message “to verify your wallet” or “to claim an airdrop” could be asking for a permit. See crypto airdrops explained.

Reading an approval request

Before you confirm, look for:

• Which token, and whether the request covers one NFT or “all” NFTs in a collection (setApprovalForAll).
• The spender: the contract that will get the permission. Is it the app you meant to use?
• The amount: a specific number, or “unlimited”.
• The network: the same token on a different network is a different contract.

ethereum.org warns that raw transaction data is hard to read, and that blind signing, approving something without understanding what it does, is a major security risk. If your wallet can’t show you clearly what a request does, don’t sign it. See what is a smart contract?

How to check and revoke approvals

ethereum.org describes the process in four steps:

1. Use a revoke tool. ethereum.org mentions tools such as Etherscan, Revoke.cash and Unrekt. Reach them by typing the address yourself or from a trusted link, not from an ad or a message.
2. Connect your wallet to the tool.
3. Find the contract whose access you want to remove.
4. Revoke it and pay the network fee.

What to look for in the list:

• Unlimited allowances, often shown as a huge number or “unlimited”.
• Contracts from apps you don’t recognize or no longer use.
• Approval-for-all permissions on NFT collections.

Revoking costs gas because it’s a transaction. On Ethereum mainnet that can add up, so prioritize the riskiest approvals first. See Ethereum gas fees explained.

Approvals on other networks

Approvals are recorded in each token’s contract on each network. An approval you gave on a layer 2 or another blockchain is separate from one on Ethereum mainnet, and needs to be checked and revoked there. See what is a layer 2?

Newer wallet features, same caution

Ethereum’s Pectra upgrade in May 2025 introduced EIP-7702, which lets an ordinary account execute code like a smart contract, enabling features such as batched transactions and spending controls. Like approvals, these features involve signing permissions, so the same rule applies: only sign requests from apps you trust, and only when you understand them. See Ethereum’s recent upgrades.

Habits that keep approvals under control

• Set a spending cap. Many wallets let you edit the amount in an approval request. Approve only what you need for the trade, as ethereum.org recommends against unlimited access.
• Read before you sign. If a request says “approve”, “set approval for all” or “permission”, stop and make sure you know which contract and which token.
• Use a separate wallet for trying new apps, and keep long-term holdings in a wallet that never connects to them. See hot vs cold wallets.
• Review regularly. Check your approvals every few months and after any scare.
• Revoke after you’re done with an app.

If you think a bad approval has been used

Act fast:

1. Revoke the approval if your tokens are still there.
2. Move remaining assets to a new wallet with a new seed phrase if you suspect the wallet itself is compromised.
3. Report it to the authorities and keep the transaction details. See crypto scams and where to report them.
4. Beware of “recovery” offers that follow. See crypto recovery scams.