Approval phishing: how token approvals drain wallets, and how to revoke them

MetaMask defines a token approval as permission for a dapp to access and move a specific type of token from your wallet. Exchanges and other apps need approvals to work, which is why wallets ask for them all the time.

Scammers abuse that. MetaMask notes that requesting essentially unlimited amounts of tokens is how many malicious sites steal: the site looks like an airdrop, a mint or a wallet “verification”, and the approval you sign lets its contract empty those tokens whenever it likes.

Yes. Some tokens support permit signatures, which grant an approval with an off-chain signature and no gas fee. Revoke.cash says these are often used by scammers to trick users into granting approvals. MetaMask warns that off-chain signatures such as Permit2 leave no on-chain record when you sign them, and that if the approval is valid for weeks, the attacker can steal the assets later.

Once a permit has been used it becomes an ordinary on-chain approval, and you can revoke it like any other.

• —Open Etherscan's Token Approvals page (or the equivalent explorer for your network) or Revoke.cash, and enter your wallet address. Both list the contracts approved to spend your tokens.
• —Revoke anything you don't recognise or no longer use, starting with whatever the drain went through.
• —Approvals are on-chain, so revoking them is too: MetaMask notes that each revocation is a transaction and costs gas.
• —Disconnecting a site from your wallet is not the same as revoking its approval. The approval stays live until you revoke it.

An approval only lets a contract move the tokens it was approved for. If you also typed your recovery phrase into a site, treat the whole wallet as compromised and follow our wallet-drained guide instead.

No. Revoke.cash says revoking cannot be used to recover any stolen funds; it protects what's left. It also warns that anyone who promises to recover stolen assets is likely a scammer.

What can still help is speed and a clear record. In April 2026 the US Secret Service described Operation Atlantic, with agencies in the US, UK and Canada, which identified more than $12 million transferred from approval-phishing victims' wallets, later frozen, and disrupted more than $45 million in losses. In an earlier case with Canadian officials in 2025, the Secret Service told victims to report to local police, the FTC and the IC3.

• —Revoke the approval that was used, then any others you don't need.
• —Save the transaction hashes for the approval and for each transfer out, the drainer contract's address, the website address you used and when.
• —Report it to the IC3 and ReportFraud.ftc.gov in the US, Report Fraud in the UK, or your local police, with those details.
• —If the tokens were stablecoins such as USDT or USDC, or were sent to an exchange, our freeze guides explain who can act and what they need.

We trace where drained tokens went, including swaps and bridges after the theft, and document it in a report law enforcement, counsel or an exchange can rely on. The intake review is free, and we'll tell you if a trace is unlikely to help.