How to Check and Revoke Token Approvals on Your Wallet in 2027

What a token approval is

On Ethereum and similar networks, tokens such as USDT, USDC or DAI live inside smart contracts. For an exchange, a bridge or any other smart-contract service to take tokens from your address, you first sign an approval (approve): you record in the token contract that a given address may spend a given amount of your coins.

An approval has three properties that people come to regret later:

• It never expires. The record stays valid until you change it, even three years on.
• It is often unlimited. Sites ask for an approval for the maximum possible amount so they don't have to ask again. The wallet shows this as "unlimited".
• It is not tied to the site. The "disconnect site" button in a wallet only removes the connection. The approval is recorded on the blockchain and remains in force.

Native coins have no approvals: ETH, BTC or TRX cannot be spent through someone else's approve. The risk applies to tokens: USDT on Ethereum, TRON and BNB Chain, USDC, wrapped coins, NFTs.

Why old approvals are dangerous

While an approval is active, the contract can take the tokens without a new signature. That leads to two theft scenarios:

1. You signed an approval for a scammer yourself. A fake airdrop site, a "wallet check", fake support. The signature looks harmless, yet it grants the right to withdraw everything.
2. An honest service got hacked. You once gave the approval to a real protocol, then a vulnerability was found in its contract, and your tokens left along with everyone else's.

A hardware wallet offers no protection here: you put the signature there yourself, and from then on the contract acts without you. A strong password doesn't help either.

Scam Sniffer's reports show the scale. In 2025, about $83.85 million was stolen from 106,106 victims through phishing signatures. That is 83% less than a year earlier, but large thefts have not gone away: in cases above $1 million, Permit and Permit2 signatures accounted for 38% of the losses. In January 2026, 4,741 victims lost $6.27 million, with 65% of that sum coming from two people. And in July 2026, one user lost 999,999 USDT after a single signed approval.

Thefts from old addresses often come together with other tricks, such as address poisoning, where USDT is stolen with a single "dust" transfer. If you need your tokens on another network or in another coin, it is simpler not to connect your wallet to unknown sites at all and to use a crypto exchange without registration instead: there you send coins to an address and sign nothing.

Types of approvals

Two rows deserve a comment. Permit signatures are invisible on the blockchain until the very second a scammer uses them, so an approval check will not show them. EIP-7702 delegation arrived on Ethereum with the Pectra upgrade in May 2025: the address of an ordinary wallet can behave like a smart contract until the owner clears the delegation. Scam Sniffer recorded the first theft through such a signature on May 24, 2025; the user lost about $146,600.

How to check your wallet with a token approval checker

A wallet address is public, so you can view its approvals without connecting and without signing anything. The main tools:

• Block explorer. Etherscan has a Token Approvals section, and the explorers of BNB Chain, Polygon, Arbitrum and other networks have the same. For TRON, Tronscan shows approvals on the address page.
• Revoke.cash. The service shows approvals across dozens of networks at once and can revoke them.
• The wallet itself. Rabby has an Approvals section, and MetaMask offers a similar list of approvals.

The order is simple:

1. Open the tool at an address you typed by hand or took from your own bookmarks. Fake "revoke services" from ads and search results are themselves out to extract approvals.
2. Paste the wallet address into the search bar without connecting the wallet.
3. Look through the list: the token, who the approval was given to, for what amount and when.
4. Mark unlimited approvals, unfamiliar addresses and services you no longer use.
5. Repeat for every network where the address holds tokens: approvals on Ethereum and on BNB Chain are stored separately.

How to revoke token approvals step by step

A revocation is written to the blockchain by the same kind of transaction as the approval itself, only with a limit of zero. So this time you do have to connect the wallet.

1. On the checker page, connect your wallet and make sure the right network is selected.
2. Click Revoke next to the approval you don't need.
3. Check in the wallet that the transaction removes access: it sets the token limit to 0 or cancels the approval for an NFT collection rather than granting a new one.
4. Confirm and wait for it to be included in a block. How to make sure the transaction went through is covered in the guide on how to check a transaction by TXID.
5. Refresh the list: the row should be gone.

What to know in advance:

• Revoking costs a fee. Each approval is revoked by a separate transaction. On Ethereum this is cents when the network is quiet and more when it is busy. The address needs a little ETH, BNB or TRX to cover the fee.
• Most valuable first. Start with unlimited approvals on the tokens you hold a lot of.
• Revoking does not return what was stolen. It only closes access to what is still left.
• The limit can be lowered instead of zeroed. If you still use the service, set the amount for your next operation. For USDT on Ethereum that takes two transactions: first zero, then the new amount.

When revoking won't help

Revoking approvals closes one specific path. In three cases it is useless.

The seed phrase has leaked. Whoever holds the phrase can sign anything themselves. You need a new wallet with a new phrase and to move all your coins there. That is what buyers of tampered wallets are doing now: we wrote about how Trezor cut its resellers and MediaMarkt halted Ledger sales.

An EIP-7702 delegation has been signed. While it is active, someone else's code can control the whole address, ETH included. The delegation has to be reset, and if the wallet won't let you do that, move the assets to a new address.

The tokens are already gone. Blockchain transactions are irreversible. What remains is to report it to the police and to the issuer: Tether and Circle sometimes freeze stolen USDT and USDC, but there are no guarantees.

How to avoid granting unnecessary approvals

• Set an exact amount in the wallet instead of "unlimited": MetaMask and Rabby let you change the limit before signing.
• Keep the bulk of your funds on an address that never connects to sites, and create a separate one for experiments.
• Read what you sign. The words Permit, Permit2, setApprovalForAll or a delegation request in the signature window mean access to your assets, not a "site login".
• Use a wallet or an extension that simulates the transaction and shows what will leave the address.
• Check your approvals every few months and after every high-profile hack of a service you have used.

How to swap ETH and tokens without connecting a wallet

Most approvals appear where swaps run on smart contracts: the site asks you to connect a wallet and sign an approve. There is a way to swap coins without a single approval.

With VertEXchange, no wallet is connected and there is nothing to sign. You choose a pair, enter the receiving address and send the coins as a regular transfer to the address shown in the form. No account, email or phone number is needed, and the rate and amount are visible before you send. This way you can swap ETH to BTC without registration, convert USDT ERC20 to TRC20 or buy Monero with USDT TRC20.

• After the swap, no approvals remain on your address: all you made was a regular transfer.
• The fixed rate holds for about 15 minutes.
• VertEXchange does not hold coins: the payout goes straight to your address.
• If the swap does not go through, the coins return to the refund address.
• Personal fields of the order are deleted 24 hours after completion, and a support chat is available on every page.

FAQ

How do I revoke token approvals in 2027?

Open the Token Approvals section in your network's explorer or the Revoke.cash service, paste your address, find the approval you don't need and click Revoke. The wallet will ask you to confirm the transaction and pay the network fee.

How much does it cost to revoke a token approval?

Only the network fee for one transaction. On Ethereum this is cents when the network is quiet, and on BNB Chain and layer-two networks it is even less. The checker services themselves charge nothing for revoking.

Is disconnecting a site from my wallet enough?

No. Disconnecting removes the link between the site and the wallet, while the approval is recorded in the token contract and keeps working. Only a revoke transaction removes it.

Can tokens be stolen from a hardware wallet through an approval?

Yes. A hardware wallet protects the keys, but you sign the approval yourself. After that the contract withdraws the tokens without a new signature.

Do Bitcoin and Monero have token approvals?

No. Bitcoin and Monero have no smart-contract tokens and no approve mechanism. Coins can only be spent with the signature of the key owner.

How do I know if a token approval is risky?

Warning signs are an unlimited amount, an unfamiliar spender address, a service you haven't used for a long time and any approval you don't remember. It is better to revoke such an approval: if needed, it is easy to grant again.

Does revoking an approval get stolen tokens back?

No. Revoking closes access to the tokens that remain. What has already been withdrawn can only be recovered through a freeze by the issuer or an investigation, and that rarely works out.