How to Read a Token Approval and Revoke It After a Scam

01 November 2026

A token approval is a permission you gave a smart contract to spend your tokens. After a scam, that permission may still be active, meaning the scammer can keep draining your wallet even after you think the incident is over. You can read and revoke these approvals crypto-on-chain-basics/">using a block explorer or a dedicated revocation tool. This page explains how.

What a token approval actually is

When you interact with a decentralized exchange, lending protocol, or any dApp, you usually have to approve the smart contract to move your tokens. This is a standard ERC-20 (or BEP-20) function called approve. Once approved, the contract can transfer tokens from your wallet up to the amount you specified.

In a scam, the scammer may have tricked you into approving a malicious contract. That approval remains on-chain until you revoke it. Even if you move the rest of your funds to a new wallet, the approval itself stays in the old wallet's transaction history. If you ever send more tokens back to that wallet, the scammer's contract can still take them.

Step 1: find your token approvals

You can see all your active approvals on a block explorer. The process is similar for Ethereum, BNB Chain, Polygon, and other EVM-compatible chains.

1. Go to a block explorer for the network where the scam happened. Examples: Etherscan for Ethereum, BscScan for BNB Chain, Polygonscan for Polygon.
2. Enter your wallet address in the search bar.
3. Look for a tab or section labeled "Token Approvals" or "Approvals." On Etherscan, it is under the "More" dropdown. On BscScan, it is under "Token Approvals" directly.
4. The page will list every contract your wallet has approved, along with:
5. The token being approved (e.g., USDC, ETH, BNB).
6. The approved amount (which may say "unlimited").
7. The contract address that has the permission.
8. The status (active or revoked).

If you see an approval to a contract you do not recognize, or one that has "unlimited" approval for a token you hold, it is a strong sign that approval is dangerous.

Step 2: Read the Approval Details

A block explorer shows you the raw data. Do not rely on the contract name alone - scammers often name their contracts something that looks legitimate.

• Check the contract address. Compare it to the official contract address of the protocol you think you used. A scam contract will have a different address, sometimes with a single character changed.
• Check the token address. The approval might be for a token you do not even hold. That is not an immediate risk, but it is still a sign of a suspicious interaction.
• Check the amount. "Unlimited" means the contract can take every token of that type from your wallet. That is normal for many legitimate protocols (Uniswap, for example), but it is also what a scammer wants.
• Check the transaction history. If you click on the approval transaction, you can see when it was made and what contract called it. If the transaction was part of a phishing site or a fake airdrop claim, that is a clear warning.

Step 3: Revoke the Approval

Revoking an approval means setting the allowed amount to zero. You can do this in two ways.

Method A: using a block explorer

1. On the token approvals page for your wallet, find the approval you want to revoke.
2. Click the "Revoke" button next to it. (Etherscan and BscScan both offer this for most tokens.)
3. Your wallet will prompt you to confirm a transaction. This transaction calls the approve function of the token contract, setting the scam contract's allowance to zero.
4. Pay the gas fee and confirm. The revocation is complete once the transaction is mined.

Method B: using a dedicated revocation tool

Several free tools exist to batch-revoke approvals. They work by scanning your wallet and letting you revoke multiple approvals in one go.

• Revoke.cash is a widely used, open-source tool. It supports multiple chains.
• Unrekt.net offers a similar service.
• Etherscan's Token Approval tool (mentioned above) is also effective for single revocations.

To use a tool like Revoke.cash:

1. Go to the site.
2. Connect your wallet.
3. The tool will display all your active approvals.
4. Select the ones you want to revoke.
5. Confirm the transaction(s) in your wallet.

Warning: Only use well-known, open-source revocation tools. Scammers sometimes create fake revocation sites that steal your private key or prompt you to sign a malicious transaction. Check the URL carefully. Revoke.cash is at revoke.cash - nothing else.

What if you cannot revoke?

Some tokens have non-standard approval functions. A few older or malicious tokens may not have a working approve function at all. In that case, revocation is impossible through normal means.

The only safe option is to stop using that wallet entirely. Move any remaining legitimate tokens to a new wallet. Never send tokens back to the compromised wallet, because the scammer's approval will still be active.

After You Revoke

Revoking the approval stops the scammer's contract from taking more tokens from your wallet. It does not recover the tokens already stolen. That is a separate problem, covered elsewhere on this site (see the articles on tracing stolen crypto and reporting to exchanges).

Revoking does not remove the scam transaction from the blockchain. The approval and the theft remain visible forever. That is normal.

Summary

• A token approval is a permission you gave a smart contract to spend your tokens.
• After a scam, that permission may still be active.
• You can read your approvals on a block explorer like Etherscan or BscScan.
• You can revoke them by sending a transaction that sets the allowance to zero.
• Use a trusted revocation tool or the block explorer's built-in revoke button.
• If revocation is not possible, abandon the wallet.
• Revoking stops future theft but does not recover lost funds.

Back to scam recovery