Opening page

How to Revoke Token Approvals with Revoke.cash

By OKSPOT Editorial · Published

Learn how to check and revoke token approvals with Revoke.cash, remove risky wallet permissions, and reduce the risk of approval-based wallet drains.

You do not have to reveal your seed phrase for someone to steal your tokens. A dangerous spending approval can let an attacker move an approved asset without asking you to confirm another transaction.

Revoke.cash helps you find and remove token approvals you no longer need. This guide explains how to check your permissions, revoke them safely, and recognise situations where revoking is not enough.

Quick answer: Open https://revoke.cash, enter your wallet address, choose the correct network, and find the approval you want to remove. Connect the wallet that owns the assets, select Revoke, review the request, and confirm the transaction. After confirmation, check that the permission is disabled or the allowance is zero.

Revoking reduces approval-related risk. It does not reverse completed transfers or secure an exposed seed phrase.

In this guide

What token approvals allow

A token approval authorises another address, called a spender, to move a particular token from your wallet. The spender is often a smart contract used by a swap platform, lending app, or other decentralised application.

For example, approving 100 USDC lets that spender use up to that allowance. An unlimited approval gives much broader access to that USDC balance, including tokens you receive later while the permission remains active. It does not automatically approve every other asset in your wallet.

NFT permissions can cover an individual NFT or an entire collection. A collection-wide operator approval can allow transfers of multiple NFTs from that collection.

These permissions make applications work, but they also create exposure. A malicious spender can abuse the access you grant. A legitimate contract may also become vulnerable later, long after you last used it.

Why disconnecting your wallet is not enough

Disconnecting a website ends its connection to your wallet application. It does not remove spending permissions already recorded on the blockchain.

Closing a browser tab, deleting an app, or removing a site from your connected-app list does not cancel those approvals either. To remove an existing on-chain approval, you need a successful revocation transaction on the relevant network.

How to revoke approvals with Revoke.cash

1. Open the correct website

Type https://revoke.cash directly into your browser and check the domain before continuing. Bookmark the verified address for future visits.

Do not follow unsolicited messages offering a wallet fix. Never enter a seed phrase or private key into a website to check or revoke approvals.

2. Look up your wallet address

Paste your public wallet address into the search field. You can inspect its approvals without connecting a wallet. Alternatively, use Connect Wallet with a supported wallet.

Check the address against your wallet. Looking up an address does not give you authority to change its permissions: revoking requires authorisation from the wallet that owns them.

3. Choose the network you used

Select the blockchain where you granted the permission. Ethereum, Base, Arbitrum, and BNB Chain are examples of supported networks.

The same wallet address can have different approvals on different networks. Removing a USDC approval on Ethereum does not remove a USDC approval on Base. Review each network where you have used applications.

4. Keep enough native currency for gas

A standard revocation is an on-chain transaction, so you normally need the network's native currency in that wallet. Examples include ETH on Ethereum, Base, and Arbitrum, and BNB on BNB Chain.

Gas funds must be on the network where you are revoking. ETH held on Ethereum does not automatically cover a Base transaction. A USDC balance alone normally cannot pay for a standard revocation.

If newly added gas funds disappear immediately, stop adding funds and follow the incident guidance below.

5. Inspect the approval details

Review the token or collection, approved spender, allowance, and date. Use the sorting and filtering options to narrow the list. If you recently signed something suspicious, sorting from newest to oldest can help you find it.

Check contract addresses rather than trusting a familiar name or logo. Prioritise the assets you hold and the permissions connected to the suspicious interaction.

6. Select Revoke and review the wallet request

Connect the correct wallet if you have not already done so, then select Revoke beside the unwanted permission. Review the account, network, affected asset, spender, and estimated gas fee before confirming.

For a standard ERC-20 approval, revoking normally sets the spender's allowance to 0. For a collection-wide NFT approval, it sets the operator permission to false. Revoking an individual NFT approval clears its approved address.

A wallet may still label the action as an approval because the same contract function can grant or remove permission. Check the actual change. A standard individual revocation should remove access, without transferring your tokens to a so-called safe address.

If you choose an optional batch or automated feature, review its additional permissions and fees separately. You can use individual revocations without enabling those features.

7. Confirm that the transaction succeeded

After signing, wait for a successful blockchain confirmation. A pending, rejected, or failed transaction has not completed the revocation.

Refresh the approval list and verify that the relevant allowance is zero or the permission is disabled. You can also check the transaction and resulting permission on the network's block explorer. A successful transaction alone is not a substitute for checking the resulting state.

8. Repeat for other permissions and networks

One revocation does not remove every approval. Continue with the other spenders, tokens, NFT collections, wallet addresses, and networks you want to review.

Which approvals should you remove?

Start with permissions you cannot justify keeping:

  • Suspicious recent approvals: permissions signed after visiting a questionable claim, mint, swap, or verification page.
  • Unused applications: contracts you no longer need to access your assets.
  • Unnecessary unlimited allowances: especially for valuable token balances.
  • Unused collection-wide NFT permissions: operators that no longer need access to your collection.
  • Known affected contracts: approvals linked to an exploit confirmed through the project's verified channels.

A zero token balance does not make an active approval irrelevant: an unused allowance may still expose tokens received later. A recognised project name also does not guarantee future safety.

Removing an approval can interrupt a feature that needs it, such as an NFT listing. If you later need the application again, verify the contract and grant only the amount and duration the task requires, where supported.

Permit signatures and Permit2: gasless does not mean harmless

Some permissions begin with a signed message instead of an approval transaction. Permit signatures can authorise token spending even when signing the message costs no gas.

An unused off-chain signature may not appear in an approval dashboard. For standard EIP-2612 tokens, setting an existing allowance to zero does not by itself invalidate an unsubmitted Permit signature; the signature's nonce and deadline also matter.

If you signed a suspicious Permit, seek guidance through your wallet's official support or a verified security channel. Removing visible approvals does not prove every outstanding signature is harmless.

Permit2 adds another layer: a token allowance to the Permit2 contract, plus permissions or signed authorisations used through it. Check the underlying token approval as well as any relevant Permit2 permissions. Removing only an app-specific allowance does not necessarily disable every signed authorisation.

Revoking a token's allowance to Permit2 blocks Permit2 from moving that token through that allowance while it remains zero. It does not erase signatures, so reapproving later can restore exposure if a malicious authorisation is still valid.

What to do if your wallet is being drained

Act quickly, but first distinguish a dangerous approval from compromised wallet keys. The response is different.

If you signed a suspicious approval

Stop interacting with the suspicious site. Identify the asset, spender, and network, then revoke the affected permission through the verified Revoke.cash website. An attacker can spend an allowance before your revocation confirms, so submitting a transaction does not guarantee you will stop the loss.

Check for other approvals or signatures you authorised during the same visit. Save transaction hashes, wallet addresses, and the suspicious URL if funds were stolen. Report the incident through verified support channels and, where appropriate, to local authorities.

If your seed phrase or private key was exposed

Revoking approvals cannot take control away from someone who has your keys. Changing a wallet password does not invalidate their copy.

Create a wallet with a completely new recovery phrase on a clean device, preferably using a hardware wallet. Do not create another account under the exposed phrase. Moving remaining assets may require specialist help if an attacker is actively monitoring the wallet.

If gas deposits disappear immediately

Stop repeatedly funding the address. A sweeper bot or another form of account compromise may take incoming funds before you can use them. Seek help through verified wallet or security channels, and never give a recovery service your seed phrase.

Revoke.cash cannot reverse theft or retrieve assets already transferred away.

A practical wallet security checklist

  • Review approvals after using unfamiliar applications and whenever you stop using a service.
  • Read both transaction requests and gasless signature requests before signing.
  • Prefer limited spending amounts when an application supports them.
  • Keep long-term holdings separate from the wallet used for frequent app interactions.
  • Use a hardware wallet to protect keys, while still checking every permission you sign.
  • Bookmark trusted sites and avoid unsolicited wallet-verification links.
  • Review every relevant network; one clean approval list is not a complete wallet audit.

Frequently asked questions

Is Revoke.cash free to use?

Inspecting approvals and revoking them individually is free apart from network gas fees. Optional batch and paid features may have additional charges. Check the current terms and the fee shown before confirming.

Does revoking move my tokens?

A standard individual revocation changes a spending permission; it does not send your token balance elsewhere. You still pay the transaction's gas fee.

Will revoking withdraw my staked or deposited assets?

Revoking a token spending allowance does not itself withdraw assets already deposited in a protocol. Adding more assets may require a new approval. Check the protocol's withdrawal process separately.

Does a hardware wallet prevent approval-based theft?

A hardware wallet helps protect private keys. It cannot make a dangerous approval safe: an authorised spender can use the permission you signed without obtaining your keys.

Can native ETH be taken through an ERC-20 approval?

A normal ERC-20 allowance controls the specified token, such as USDC or wrapped ETH. Native ETH is different, but it can still be lost through malicious transfers, compromised keys, or other wallet permissions.

Does an empty approval list mean my wallet is safe?

No. Outstanding off-chain signatures, non-standard token permissions, account delegations, and exposed keys can create risks beyond the displayed approvals. Smart-account or EIP-7702 delegation controls may need attention inside your wallet application.

Does this apply to my OKSPOT account balance?

This guide concerns blockchain wallets you control. Your OKSPOT account balance is separate from your personal wallet's token approvals. An exchange deposit address is not a wallet you can connect to Revoke.cash and manage yourself.

Sources and further reading

Last reviewed: 13 November 2026. Wallet interfaces, supported networks, and optional service fees may change.

Trade on OKSPOT

Buy and sell Bitcoin, Monero and other crypto on OKSPOT spot markets. Sign up with just your email. No ID upload.

Create an account Explore markets