How To Revoke Token Approvals: 10-Minute Audit

Why a Routine Beats Vigilance

Most wallet compromises don’t exploit something you did today. They exploit something you granted, installed or forgot months ago:

An unlimited token approval to a dApp you used once. Chainalysis estimated that more than $2.4 billion in active unlimited approvals still sits on lost or compromised wallets, waiting to be used.
A browser extension that was harmless when you installed it, then sold to an attacker and updated with malware. In August 2026, five of the 19 extensions in the “Superior” campaign had been bought from their original developers this way.
An old exchange API key still connected to a tax tool or a trading bot you stopped using.
A seed phrase backup you haven’t looked at since the day you wrote it.

You can’t stay alert to all of that all the time. You can check it four times a year.

Revoke Day is the first week of January, April, July and October. It takes about 30 minutes the first time and around 10 minutes after that.

Before You Start: Reach the Tools Safely

Security tools are among the most impersonated sites in crypto, because people arrive at them ready to connect a wallet and sign. The Inferno Drainer kit imitated Revoke.cash among more than 200 brands, and in April 2026 drainers set up fake “revoke” sites within hours of major hacks. In June 2026, PhishFort published a checklist for confirming you are on the real Revoke.cash before connecting.

Type the address yourself — revoke.cash, etherscan.io — or use a bookmark you created.
Never use a link from an email, a DM, a search ad, or a reply under a security alert, however official it looks.

Step 1: Review Token Approvals on EVM Chains (3 minutes)

An approval lets a smart contract move tokens from your wallet. Legitimate dApps need them; forgotten ones are a standing risk.

Open revoke.cash by typing the address.
Paste your wallet address. You don’t need to connect your wallet just to look.
Check each chain you use. Revoke.cash supports more than 100 networks, and approvals on one chain don’t show on another.
Look for the dangerous ones:
- Unlimited approvals to anything you don’t actively use
- Spenders you don’t recognise
- Approvals to an ordinary wallet address rather than a contract — this is a classic sign of a drainer and should be treated as critical
- Approvals for dApps you stopped using, or that no longer exist
Sort by value at risk and start at the top.

Don’t miss Permit2

Many modern apps — Uniswap, 1inch, CowSwap, MetaMask Swaps — use Permit2, a shared approval contract at 0x000000000022D473030F116dDEE9F6B43aC78BA3. It has two layers:

The outer approval — your token approval to the Permit2 contract itself, usually unlimited
The inner allowances — the permissions Permit2 holds for individual apps on your behalf

Revoke.cash shows both. If you’re not actively using an app that relies on Permit2, revoke the outer approval too.

Revoking

To revoke, connect your wallet and confirm each revocation. Each one is an on-chain transaction, so it costs a network fee:

Start with the highest value at risk.
Do it when fees are low, and use the layer-2 networks where you hold funds there anyway.
On a hardware wallet, confirm each revocation on the device, and read what the screen says before you approve.

Etherscan’s Token Approval Checker (reached by typing etherscan.io) does the same job for Ethereum, if you prefer it.

Step 2: Check Solana Permissions (1 minute)

In Phantom, open Settings → Connected Apps and remove every app you don’t actively use.
Revoke.cash also supports Solana, though its coverage there is more limited than on EVM chains. Use it to check token delegations.

Step 3: Disconnect Old Sites (1 minute)

In MetaMask, open the connected sites list and disconnect everything you don’t actively use. Do the same in any other wallet.

Note: disconnecting a site does not revoke its token approvals. Those live on the blockchain and are cleared only in Step 1. You need to do both.

Step 4: Audit Browser Extensions (2 minutes)

Open your browser’s extensions page: chrome://extensions, edge://extensions, or about:addons in Firefox.

Remove anything you haven’t used in the last month. You can’t tell which extensions are safe, so keep fewer of them.
Check that your wallet extension is the official one. Look at the publisher name, and reinstall from the link on the wallet’s own website if you’re unsure.
Watch for extensions you don’t remember installing.

Store removal doesn’t protect you. When the Superior extensions were removed from the Chrome Web Store, users weren’t notified and the extensions kept running. Only removing them yourself works. Related: The Extension You’ve Trusted for Years Can Be Sold to a Thief

Best practice: keep a separate browser profile just for crypto, with your wallet and almost nothing else installed.

Step 5: Check Your Address Book (1 minute)

Confirm that saved addresses are still correct. Check each one against its original source, the full address, not just the first and last characters.
Add any recipient you now send to regularly.
Stop copying addresses from your transaction history. That is exactly where address-poisoning attacks plant lookalikes. Related: Address Poisoning: The Attack That Works Because You Copy and Paste

Step 6: Lock Down Exchange Accounts (1 minute per exchange)

Two-factor login with an authenticator app, not SMS
Withdrawal address whitelist switched on, with a delay before new addresses can be used
API keys: delete any you don’t recognise or no longer use — old tax tools, trading bots, portfolio trackers
Devices and sessions: sign out anything you don’t recognise
Anti-phishing code turned on, if your exchange offers one

Step 7: Check Your Backups (1 minute)

Look at your seed phrase backup. Is it where it should be, legible and undamaged? Don’t type it, photograph it, or read it aloud — just check it’s there and readable.
If you use a passphrase wallet, prove you can still open it, entering the passphrase on the device itself rather than on your computer. This is Trezor’s recommended method:
- When you set it up, you noted the coin and the last 8 characters of the first receive address next to your written passphrase.
- Close both wallets, reopen the passphrase wallet using only your written copy, and compare the address shown on the device.
- If it matches, your passphrase still works.
If you use multi-share backup, confirm that each share is where your records say it is.

Step 8: Check for Breached Accounts (30 seconds)

Check the email address you use for crypto at Have I Been Pwned (type haveibeenpwned.com). If it appears in a new breach:

Change the password for that service, and for anywhere you reused it.
Expect targeted phishing that uses the leaked details.

Step 9: Update Through Official Apps Only (1 minute)

Update your hardware wallet firmware and wallet apps only from inside the official app you already use.

Never update because a letter, email or text told you to. Phishing letters sent to Trezor and Ledger owners in 2025 and 2026 announced “mandatory” checks with deadlines and QR codes. Real updates don’t arrive that way.

Once a Year: The January Extras

Review your inheritance plan. Is the asset inventory current, and does the right person still hold the right instructions? Related: What Happens to Your Crypto When You Die
Export last year’s records for tax before any platform changes or closes. Related: The First DAC8 Reporting Year Closes in December — What EU Crypto Holders Need to Do Now
Dutch residents: record your 1 January balances for Box 3. Related: Crypto and Dutch Tax: How Box 3 Works — and Why 1 January Matters

What This Audit Doesn’t Do

It doesn’t recover stolen funds. Revoking stops further use of a permission; it can’t reverse what has already moved.
It doesn’t protect a seed phrase that has been exposed. If you have ever typed your recovery phrase anywhere, move to a new wallet. Related: Your Crypto Was Just Stolen: What to Do in the First 24 Hours
It doesn’t stop the next bad approval. That is what simulation, spending caps and reading your device screen are for.

Frequently Asked Questions

Does revoking cost money?
Yes. Each revocation is a blockchain transaction with a network fee. Prioritise by value at risk, and revoke when fees are low.

Will revoking break apps I use?
No. The app will ask for approval again the next time you use it. Approve a specific amount rather than an unlimited one.

Do I have to connect my wallet to check approvals?
No. You can paste your address to view them, and only connect when you’re ready to revoke.

Is Revoke.cash safe?
The real site is widely used, free and doesn’t require sign-up. The danger is fake copies, so always type the address yourself.

What if I find an approval I don’t recognise and my funds are still there?
Revoke it now, then work out how it got there. If you can’t explain it, move your funds to a fresh wallet.

The Bottom Line

Put four dates in your calendar: the first week of January, April, July and October. On each, take ten minutes to:

Revoke approvals you don’t need, including both Permit2 layers.
Disconnect old sites and remove extensions you don’t use.
Check your address book, exchange settings and backups.

Most of the attacks on this site succeed because of a door someone opened months earlier and forgot about. Revoke Day closes those doors before anyone finds them.

Want a reminder? The Weekly Threat Brief sends one at the start of each quarter, with a printable checklist. Sign up here.

Transparency: TrueToCrypto has no commercial relationship with Revoke.cash, Etherscan or Have I Been Pwned. This article is educational and is not financial or security consulting advice.

Contact: info@truetocrypto.com

Verified October 2026. Wallet menus and tool features change; if a setting isn’t where described, check the provider’s own documentation.