You clicked “Approve” on a random website once. Maybe it was a new DeFi protocol, a strange airdrop claim page, or a token swap that looked too good to pass up. That single click gave that smart contract permission to spend your tokens. Not just once, but forever. And now you are worried. You should be. That approval is an open door for anyone who finds a bug in that contract, or worse, for the person who deployed it.
Revoke.cash is a free tool that lets you see every smart contract your wallet has approved and remove those permissions instantly. You do not need to connect your wallet to a shady site to do it. You just paste your address, scan the list, and revoke the dangerous approvals. This guide walks you through the exact steps to clean your wallet in under five minutes.
What a Token Approval Actually Does
Think of a token approval like handing your car keys to a valet. You expect them to park the car, not take it for a weekend road trip. When you approve a smart contract to spend your USDC, DAI, or any ERC-20 token, you are giving it permission to move that specific token from your wallet to another address.
The scary part? Most approvals are unlimited. You approve once, and the contract can drain your entire balance of that token, even if you only wanted to trade 10 bucks. This is not a bug. It is how the ERC-20 standard works. The allowance system was designed to save you from approving every single transaction. But it also means one bad approval can empty your wallet.
If you are new to this space, you might want to read about what happens when you approve a smart contract to understand the full risk.
Why You Need to Revoke Token Approvals Right Now
Hackers do not break into wallets by guessing seed phrases anymore. That is too hard. Instead, they look for active approvals. They scan the blockchain for wallets that have given permission to vulnerable or malicious contracts. When they find one, they call a function on the contract that transfers your tokens to them. You lose everything in that token, and you might not even notice until you check your balance days later.
This is why you need to revoke token approvals with a tool like Revoke.cash. It is the fastest way to close those open doors.
How to Use Revoke.cash to Remove Dangerous Approvals
You do not need to install anything. You do not need to connect your wallet to a random site that could be a phishing trap. Revoke.cash works by reading the blockchain. You just paste your public wallet address, and it shows you every approval your wallet has ever made.
Here is the step-by-step process.
-
Go to Revoke.cash. Open your browser and navigate to the site. The interface is clean and simple. No pop-ups asking you to sign a message or connect your wallet.
-
Paste your wallet address. Copy your public address from MetaMask, Rainbow, or any wallet you use. Paste it into the search bar on Revoke.cash. Hit enter.
-
Scan the list of approvals. The tool will show you every token approval, organized by blockchain. You will see the token name, the contract address that has permission, and the amount it can spend. If it says “Unlimited,” that is a red flag.
-
Identify the dangerous ones. Look for contracts you do not recognize. If you see a token approval for a project you used once six months ago, that is a risk. If you see an approval for a token you do not even hold anymore, revoke it.
-
Revoke the approval. Click the “Revoke” button next to the approval you want to remove. Your wallet will open and ask you to confirm a transaction. This transaction sets the allowance to zero. You will pay a small gas fee, usually a few dollars depending on network congestion.
-
Confirm on-chain. Wait for the transaction to confirm. Once it goes through, that contract can no longer move your tokens. You are safe.
What to Revoke and What to Leave
Not every approval is dangerous. Some you need to keep. Here is a table to help you decide.
| Approval Type | Keep or Revoke | Why |
|---|---|---|
| Uniswap or SushiSwap router | Keep, unless you are done trading | You need this to swap tokens. Revoking it will break future trades. |
| A random NFT minting site | Revoke | These sites often have unlimited approvals and no security audits. |
| A lending protocol you no longer use | Revoke | You are not borrowing or lending anymore, so there is no reason to keep the approval. |
| An airdrop claim page | Revoke immediately | These are almost always scams. The approval is the trap. |
| A staking pool you are actively using | Keep | Revoking will unstake your tokens and may trigger a penalty. |
Expert advice: If you are unsure about a contract, revoke it. You can always approve it again later if you need to use that protocol. It is much safer to approve on demand than to leave an unlimited approval sitting open.
Common Mistakes People Make When Revoking Approvals
Even with a great tool like Revoke.cash, people still mess up. Here are the mistakes to avoid.
-
Revoking everything at once. If you are actively using a protocol, revoking its approval will break your position. You might get liquidated on a lending platform or lose your staking rewards. Only revoke approvals for protocols you are done using.
-
Ignoring the gas cost. Revoking an approval costs gas. On Ethereum mainnet during a busy day, that could be $5 to $20 per revocation. If you have fifty approvals to clean up, the cost adds up. Prioritize the dangerous ones first. You can clear the rest later when gas is cheap.
-
Forgetting about Permit2. Some newer contracts use Permit2, a system that separates the approval from the contract. Revoke.cash handles these too, but you need to check the Permit2 tab. If you only look at standard approvals, you might miss a Permit2 approval that is just as dangerous.
-
Thinking revoking is enough. Revoking an approval stops future theft, but it does not reverse past damage. If your tokens were already drained, revoking will not bring them back. You need to move your remaining assets to a new wallet immediately. Check out 7 warning signs your crypto wallet has been compromised for the full checklist.
A Quick Checklist for a Clean Wallet
Use this bullet list every time you finish interacting with a new protocol.
- Check Revoke.cash for new approvals after every transaction.
- Revoke approvals for protocols you tested once and will not use again.
- Never leave an unlimited approval open for more than 24 hours.
- If you see a contract address you do not recognize, revoke it before doing anything else.
- Keep a separate “burner” wallet for testing new sites so your main wallet stays clean.
If you want a deeper look at how to build a secure setup from scratch, read our complete DeFi security checklist for beginners.
What Revoking Does Not Fix
Revoke.cash is a powerful tool, but it is not magic. Here is what it cannot do.
It cannot recover tokens that were already stolen. If a hacker drained your USDC before you revoked the approval, that money is gone. Revoking only stops future theft.
It cannot protect you from approvals on other blockchains. Revoke.cash supports Ethereum, Polygon, BNB Chain, Arbitrum, Optimism, and several others. But if you gave an approval on a network it does not support, you need to find a different tool for that chain.
It cannot stop you from approving a bad contract again. If you revoke an approval today and then interact with the same malicious site tomorrow, you will give it permission again. The tool only fixes the past. Your future behavior is up to you.
Your Wallet Deserves a Clean Slate
You do not need to be a blockchain security expert to protect your crypto. You just need the right habits. Checking your approvals on Revoke.cash should be as routine as checking your bank statement. Do it once a week. Do it every time you finish using a new protocol. Do it right now if you have not done it in a while.
The five minutes it takes to scan your wallet and revoke dangerous approvals could save you from losing months of savings. Open Revoke.cash, paste your address, and clean up those old permissions. Your future self will thank you.
