How to Revoke Token Approvals: Step-by-Step Guide

What You Will Accomplish

You will locate every open token approval on your wallet, identify which ones pose security risks, and revoke them using free tools. This takes fifteen minutes and costs a few cents on most chains. The approvals you granted two years ago are still live. The smart contracts you used once still have permission to move your tokens without asking again.

Your wallet signs a transaction setting an allowance, a number recording how many tokens the spender contract is allowed to move from your address. This allowance persists forever on-chain unless you explicitly revoke it.

Closing the DApp tab does nothing. Disconnecting your wallet does nothing. Transferring your tokens elsewhere does nothing. The permission lives on the blockchain until you send a revocation transaction.

If you have approved 100 DeFi protocols over two years of trading, you may have 100 open permissions right now, even if you have not used most of those protocols in months.

Why Unlimited Approvals Are Dangerous

Unlimited approvals grant indefinite access to the full balance of a given token. Most dApps request unlimited approvals by default because it reduces friction. Users do not need to re-approve before every transaction.

If a smart contract you have given unlimited approval to is later exploited or compromised, that approval remains active. The attacker can drain your entire balance of that token without needing your private key or any further interaction from you.

Unlimited token approvals have been responsible for over $493 million in stolen assets since 2020. Over $200 million was lost to approval-based attacks in 2024-2025 alone.

In January 2025, the SwapNet exploit let the attacker siphon about $13.4 million directly from wallets. Security firm PeckShield described it as one of the largest approval-based attacks seen outside of phishing. Close to $1.42 million was stolen from users of Ekubo, a DEX that originated on Starknet and expanded to Ethereum and Arbitrum. A calldata parsing bug in Ekubo’s gas-optimized HuffRouter contracts allowed attackers to spend the token approvals of anyone who had approved them.

Phishing attacks that trick users into signing malicious approvals cost over $1 billion in 2024 according to CertiK, often exploiting old permissions users forgot existed.

This is different from a private key compromise. Hardware wallets protect your private key, but with approvals no one needs to steal your keys to take your tokens. Because of that, hardware wallets offer no extra protection against approval exploits.

The most widely used tool for revoking approvals is Revoke.cash, a free, open-source platform that supports over 100 EVM networks. Make sure the URL is correct. Phishing clones of Revoke.cash exist, so bookmark the real site.

Etherscan provides a native Token Approval tool at https://etherscan.io/tokenapprovalchecker. This is Ethereum mainnet native, with network-specific versions for Arbitrum, Polygon, and other chains. As of March 2026, Etherscan supports batch revocation for EIP-7702 wallets, reducing the cost of revoking multiple approvals at once.

ArcSign offers a built-in Token Approvals page. It is free, requires no third-party tool, and covers six EVM chains: Ethereum, BSC, Polygon, Arbitrum, Optimism, and Base. ArcSign Pro users can batch-revoke multiple approvals in a single transaction. Revoke.cash is a free third-party site that requires you to connect your wallet externally, and free-tier users can only revoke one approval at a time.

Other options include Unrekt (multiple networks), approved.zone (Ethereum mainnet), Cointool (multiple networks), beefy.finance (BSC/BNB Smart Chain), and EverRevoke (multiple networks).

Approval tools are frequently impersonated because users visit them when they are already worried. Type the address carefully, bookmark the correct page, and avoid sponsored links that appear after a panic search. A fake approval checker can be just another drainer.

Step-by-Step: Revoking Approvals on Revoke.cash

1. Go to Revoke.cash and connect your wallet. Click “Connect Wallet” and select MetaMask, WalletConnect, Coinbase Wallet, or your wallet provider. Revoke.cash does not require you to sign any transaction at this stage. It reads your address to query the blockchain.

2. Select the correct network. An approval on Arbitrum will not appear when your wallet is set to Ethereum mainnet. Use the network dropdown at the top of the page. Check every chain you have used: Ethereum, Polygon, Arbitrum, Optimism, Base, BNB Chain.

3. Review the list of approvals. You can select the token type (ERC20, ERC721, ERC1155) that you want to check approvals for. The list shows the token, the spender contract, and the allowance amount. Unlimited approvals are labeled “Unlimited.”

4. Identify which approvals to revoke. The common advice is to revoke everything on a regular schedule. A better beginner workflow is targeted: remove unlimited approvals, approvals older than your current use case, and approvals for contracts you cannot identify.

If you see an approval for a contract address you do not recognize, copy that address and paste it into Etherscan or the block explorer for the chain you are on. Look at the contract name, the verified code status, and recent transactions. If you still cannot identify it, revoke it.

5. Click “Revoke” next to each approval you want to remove. Your wallet will prompt you to confirm the transaction. On Ethereum mainnet, this costs a small amount of ETH. On L2s like Arbitrum, Optimism, Base, and Polygon, gas costs are typically a few cents. On BNB Chain gas is also very cheap.

6. Confirm the transaction in your wallet and wait for confirmation. Copy the transaction hash from Revoke.cash or from your wallet activity. Paste it into Etherscan for Ethereum, BscScan for BNB Chain, or PolygonScan for Polygon. Look for a success status. If the transaction failed, the revocation did not complete and you need to resubmit with suitable gas settings.

7. Repeat for each network. Most users have approvals on multiple chains. Check them all.

Step-by-Step: Revoking Approvals on Etherscan

1. Go to https://etherscan.io/tokenapprovalchecker. Enter your wallet address in the search box or connect your wallet directly.

2. Review the list of active approvals. Etherscan displays the token, spender contract, and allowance amount. Unlimited approvals are clearly marked.

3. Click “Revoke” next to any approval you want to remove. If your wallet is connected, the revocation transaction will populate automatically. If you entered your address manually, you will need to connect your wallet to sign the transaction.

4. Confirm the transaction and verify success. Check the transaction hash on Etherscan. A green checkmark confirms the revocation went through.

For chains other than Ethereum, use the network-specific block explorer: Arbiscan for Arbitrum, PolygonScan for Polygon, BscScan for BNB Chain.

Common Failure Modes and How to Avoid Them

Wrong network selected. This is one of the most common reasons users think a revoke did not work. An approval on Polygon will not appear when your wallet is set to Ethereum mainnet. Also check the network selector at the top of the approval tool.

Transaction reverted due to insufficient gas. If your revocation transaction fails, you did not pay enough gas. Resubmit the transaction with a higher gas limit or wait for network congestion to subside.

Believing hardware wallets prevent approval exploits. They do not. If you have already signed an unlimited approval, a Ledger or Trezor will not stop the approved contract from moving your tokens. Revoke the approval manually.

Assuming revocation recovers stolen funds. If a scammer steals your funds, revoking token approval will not help you get your money back. Revocation prevents future theft. It does not reverse past transactions.

Sweeper bot draining ETH as soon as it arrives. If you have a sweeper bot on your account that steals any ETH as soon as it comes in, your seed phrase was compromised. This means that revoking approvals is not going to help with your wallet security. Unfortunately, there is no way for your wallet to recover from this. You should abandon this wallet and create a new one.

What a Dangerous Approval Looks Like

Be suspicious of approval requests from unknown sites. If a DApp you have not used before asks for a large or unlimited approval, scrutinize the spender contract address. Phishing sites often mimic legitimate DApps and ask for approvals to attacker-controlled contracts.

Look for these red flags when reviewing your existing approvals:

• Unlimited allowances for tokens you no longer hold or use.
• Approvals granted to unverified contracts (check the block explorer).
• Spender contracts with no visible transaction history or recent activity.
• Contracts with names that do not match any DApp you remember using.
• Approvals older than six months for protocols you have not touched in that time.

If you cannot identify the spender contract, revoke the approval. The cost is a few cents. The risk is your entire token balance.

Building a Quarterly Audit Habit

Do a quarterly approval audit. Schedule a review every three months. Set a calendar reminder for the first week of January, April, July, and October.

The process takes fifteen minutes per chain. You check your approvals, revoke anything unlimited or outdated, and move on. This habit costs less than $5 per year on L2s and prevents the majority of approval-based exploits.

When you use a new DeFi protocol, write down the date and the contract address. Three months later, if you are not using that protocol anymore, revoke the approval. This prevents the accumulation of forgotten permissions.

Modern alternatives are emerging. Permit (EIP-2612) enables off-chain signatures instead of on-chain approval transactions. Permit2, developed by Uniswap, goes further by adding automatic expiration dates and fine-grained allowances. Approvals expire automatically and are limited to specific amounts or time windows.

Not all protocols support Permit2 yet. Until they do, manual revocation is the only way to close old approvals.

What to Do Next

Open Revoke.cash or Etherscan Token Approval Checker right now. Connect your wallet. Check Ethereum mainnet first, then Polygon, Arbitrum, Optimism, Base, and BNB Chain.

Revoke every unlimited approval for a protocol you have not used in the last three months. Revoke every approval for a contract you cannot identify.

Bookmark the approval tool you prefer. Set a calendar reminder for three months from today. When the reminder fires, repeat the process.

If you see an approval request in the future, read it carefully. Look at the spender contract address. Search for that address on Etherscan. If the contract is unverified or you do not recognize it, reject the approval. If you need to approve, consider setting a limited allowance instead of unlimited.

This is not theoretical. MetaMask’s official documentation recommends regular approval audits. Etherscan built a native tool for it. Revoke.cash exists because this is a real, recurring attack vector.

The Takeaway

You just learned how to locate, evaluate, and revoke token approvals on six EVM chains using free tools that cost pennies in gas. The approvals you granted two years ago are still active, and they will stay active until you revoke them. Set a quarterly reminder. Check your approvals. Revoke anything unlimited or outdated. The tools are free. The cost is minimal. The risk is your entire token balance.

Frequently Asked Questions

Do token approvals expire automatically?

No. Token approvals persist forever on the blockchain unless you explicitly revoke them. Closing the DApp, disconnecting your wallet, or transferring tokens does not cancel the approval. The permission remains active until you send a revocation transaction. This is why quarterly audits are necessary. Approvals granted two years ago are still live today.

How much does it cost to revoke a token approval?

Gas costs vary by chain. On Ethereum mainnet, revocation costs depend on network congestion but typically range from a few dollars to ten dollars per approval. On Layer 2 networks like Arbitrum, Optimism, Base, and Polygon, gas costs are usually a few cents per revocation. On BNB Chain, costs are similarly low. Batch revocation tools can reduce total costs when revoking multiple approvals.

Will revoking approvals affect my active DeFi positions?

Revoking an approval for a protocol you are actively using will require you to re-approve the next time you interact with it. If you have funds staked, deposited, or earning yield in a protocol, revoking the approval does not withdraw your funds or close your position. It only prevents the protocol from moving additional tokens from your wallet without a new approval.

Can I set a limited approval instead of unlimited?

Yes. When a DApp requests an approval, you can manually edit the allowance amount in your wallet interface before confirming. Instead of unlimited, set the allowance to the specific amount you plan to interact with. This requires re-approval for future transactions but limits exposure. Permit2, developed by Uniswap, automates time-limited and amount-limited approvals, though not all protocols support it yet.

What happens if I revoke an approval and later want to use that protocol again?

You will need to grant a new approval the next time you interact with the protocol. The DApp will prompt you to approve again before you can deposit, swap, or stake. This adds one additional transaction but significantly reduces long-term risk. Many users revoke approvals for protocols they use infrequently and re-approve only when needed.