Cookie Settings

We use cookies to improve your experience. Essential and analytics cookies are automatically enabled. View cookie preferences

    Skip to main content
    Practical guide

    How to revoke crypto wallet approvals

    Published: date not recorded · Reviewed 23 October 2026 · Editorial policy

    An approval lets another address spend a particular token, or move NFTs, from your wallet. Once granted, that permission can be used without asking you to sign each transfer. Revoking removes that permission; disconnecting a website does not. This guide covers EVM wallets, including Ethereum, Base, Arbitrum and Polygon. If you shared your recovery phrase or private key, skip the routine cleanup: you need a new wallet, not just fewer approvals.

    Open Revoke.cashCheck an address free

    Eight steps: from permission to confirmed revocation

    01

    1. Stop the suspicious interaction

    Close the suspicious page and reject any pending wallet prompts. Do not return to it to 'cancel' an approval. If you already signed, save the transaction hash or signature details. A signed approval is a permission problem; an exposed recovery phrase is a key problem. They need different responses.

    02

    2. Open the real tool yourself

    Type revoke.cash into the address bar, or use the tool link in this guide. Check that the hostname is exactly revoke.cash. Ignore search ads, unsolicited DMs and 'wallet repair' links. You never need to type a recovery phrase or private key to revoke. Inspecting an address needs neither a signature nor a transfer.

    03

    3. Select the affected account and network

    Connect the wallet you used and check the selected account. Choose the network on which you approved: a Base approval must be revoked on Base, not Ethereum. The same address can have different permissions on each network. Check every account and network you used; one clean list does not clear the others.

    04

    4. Identify what can be spent, and by whom

    In the approvals list, read the asset, spender address and allowance. The asset contract identifies the token or NFT collection; the spender is the address allowed to move it. Prioritize the spender from the suspicious interaction, then unused services and unnecessary unlimited allowances. An unlimited token approval can cover future deposits too. 'All NFTs' applies to that collection, not every NFT in your wallet. A familiar name or an absent warning is not a guarantee.

    05

    5. Keep gas on that same network

    Revoking changes blockchain state, so you pay a network fee in its native coin: ETH on Ethereum, Base or Arbitrum; POL on Polygon. USDT or a memecoin balance cannot normally pay that fee. Read the estimate before confirming; costs and times vary, and batch revocation may add a service fee. If the wallet is being swept or its keys are exposed, do not keep sending it gas: the attacker may take that too.

    06

    6. Revoke and read the wallet prompt

    Use 'Revoke' on the chosen entry. Check the account, network, target contract and action in your wallet. A normal ERC-20 revocation sets that spender's allowance to 0. An NFT operator revocation sets setApprovalForAll to false; an individual NFT approval has a separate scope. The prompt may still say 'approve': the value matters. A positive or unlimited limit, setApprovalForAll true, or an asset transfer is not a revocation. Reject anything you cannot reconcile with the entry you chose.

    07

    7. Confirm on-chain, then reload the list

    A submitted transaction is not yet a removed permission. Open its hash in the correct network explorer and wait for a successful receipt. Pending or failed means the revocation has not taken effect. Then refresh Revoke.cash on the same account and network: that token allowance must be 0 or the NFT permission inactive. Check the exact asset–spender pair, not just the success banner. Save the hash as your record.

    08

    8. Finish the remaining permissions

    Repeat for other affected tokens, NFT collections and networks. Revoking one spender does not revoke the rest. You keep the assets still in your wallet, but an app may ask for a new approval before your next swap or NFT sale. Grant only what the next verified action needs. Never reapprove the suspicious spender to 'test' whether the cleanup worked.

    Got a link or message you are unsure about? Paste it into the free detector

    When revoking is not enough

    • Recovery phrase or private key exposed: create a wallet with a completely new recovery phrase on a clean device using verified software. Another account under the old phrase is not a fresh wallet. Move remaining assets if you can do so safely; revocations cannot stop someone who holds your keys.
    • Gas vanishes immediately: stop topping up. This can indicate an automated sweeper. Use your wallet provider's official support for incident-specific guidance; never give support your recovery phrase or pay a stranger to 'rescue' the balance.
    • Permit or Permit2 signed: a gasless signature can authorize spending and may not appear in a list of current on-chain approvals. Setting an existing allowance to 0 does not necessarily invalidate an unused signed permit. Permit2 also has its own permissions. Do not assume the signature is cancelled because the list looks empty; avoid new deposits and seek official guidance for that signature type.
    • Account delegation or session permissions: EIP-7702 delegations, smart-account modules and session keys are not ordinary token allowances. This checklist does not remove them. If you signed an account-level authorization, follow the wallet provider's dedicated instructions instead of treating an empty token list as an all-clear.
    • Funds already moved: revocation can block future use of the removed permission, not reverse a completed transfer. Keep transaction hashes and chat evidence, then report through official channels.

    Keep the next approval smaller

    1. 1.For a normal token swap, choose an exact spending limit when your wallet offers it. A 50-token limit exposes less than an unlimited one, but neither makes a malicious spender safe. Verify the app and spender first.
    2. 2.Keep savings apart from the wallet used for new apps and NFT mints. Approvals are tied to an account; separation reduces the assets a bad approval can reach. It does not help if both accounts share a stolen recovery phrase.
    3. 3.If the message or link that led you there is suspicious, check it before opening it again. Our detector assesses warning signs; it does not revoke approvals or certify that your wallet is clean. Check the suspicious message or link

    Already happened? First steps

    1. Send nothing more and sign nothing new.
    2. Save the transaction hash, the addresses and chat screenshots.
    3. Report it today through official channels; never pay 'recovery' services.
    Where to report crypto theft

    Questions people ask

    Does disconnecting MetaMask from a website remove approvals?

    No. Disconnecting ends the site's connection to your wallet interface. A spending permission stored on the blockchain remains active until it is revoked or otherwise changes on-chain.

    Can an approval steal ETH as well as tokens?

    An ordinary ERC-20 allowance applies to that token, not native ETH. Wrapped ETH (WETH) is a token and can have allowances. Native-coin transfers, exposed keys and account delegations are separate risks; revoking a token permission does not address them.

    Does a zero token balance mean I can ignore an unlimited approval?

    No. The permission can remain active even when the balance is zero. Later deposits of that same token into the same account and network may become spendable by the approved address.

    Will revoking an NFT approval delete my NFTs or unlock staked assets?

    No. Revocation changes transfer authority; it does not burn NFTs or withdraw assets held by a staking, lending or vault contract. Those positions require the protocol's own withdrawal procedure. A marketplace may require approval again before a later sale.

    What if my revocation transaction fails?

    Do not treat it as completed. Check the failure reason, account, network and native-coin balance in your wallet and the explorer. Refresh the permission state before retrying. If fees are unusually high or the token behaves abnormally, stop and consult official support rather than repeatedly signing.

    Does an empty approvals list prove my wallet is safe?

    No. You may be viewing the wrong account or network, data coverage can be incomplete, and unused signatures or account-level permissions may not be represented. It also says nothing about whether your recovery phrase is private.

    Does this procedure work for Bitcoin or Solana wallets?

    No. These instructions describe EVM token and NFT approvals. Bitcoin does not use ERC-20 allowances, and Solana uses different permission mechanisms. Do not follow an EVM revocation prompt as a supposed fix for either network.

    Related case: Operation Atlantic and token-approval phishing.

    Related case: EIP-7702 delegation and wallet-draining risks.

    Keep reading

    Sources

    1. How to revoke token approvals (Revoke.cash)
    2. Approval, NFT, gas and coverage FAQ (Revoke.cash)
    3. What to do when scammed (Revoke.cash)
    4. What are EIP-2612 Permit signatures? (Revoke.cash)
    5. What is Permit2? (Revoke.cash)
    6. ERC-20 token standard: approve and allowance (Ethereum Improvement Proposals)
    7. ERC-721 NFT standard: operator and individual approvals (Ethereum Improvement Proposals)
    8. ERC-1155 multi-token standard: operator approvals (Ethereum Improvement Proposals)

    Got a suspicious message or link? Paste it into the free detector.

    Open detector

    Educational information only — not financial or legal advice.