Wallet Approvals & Phishing: How to Revoke Risky Permissions and What to Do If You're Drained

The short answer: most on-chain theft is a signature you gave away

"My wallet got hacked" is almost never what happened. The overwhelming majority of losses come from two actions: approving a malicious contract — in which case your tokens are moved by a perfectly legitimate contract — and signing or typing your seed phrase into a phishing page, which hands over control directly. On-chain transactions are irreversible; one signature can empty an address.

This guide covers two things: how to find and revoke dangerous approvals, and the checks to run before you sign or send — plus what to do in the first hour if you do get drained, which we hope you never need.

Risk one: what token approvals actually are

To use a DApp on-chain — a DEX, a staking protocol, a lending market — you first "approve" it to move a specific token. That's an Approve. The problem is the amount:

• Exact-amount approval: the contract can only move what this transaction needs. Relatively safe;
• Unlimited approval: the contract can move your entire balance of that token, indefinitely. If the contract is malicious, it can drain that token months later, at any moment, with no warning to you.

Two things make this dangerous in practice: many DApps nudge you toward unlimited approvals to "save on future transactions," and phishing sites impersonate legitimate DApps with exactly one goal — getting you to press the approve button.

How to check and revoke

1. Open an approval checker — revoke.cash is the best known, and block explorers offer token approval tools too;
2. Connect your wallet. This step only reads public on-chain data: no seed phrase, no transfer;
3. Review the list. Prioritize "unlimited" allowances for contracts you no longer use;
4. Click revoke and confirm the transaction in your wallet. Revoking is itself an on-chain transaction, so it costs gas;
5. Make it a habit: check every month or two, especially after trying new protocols.

Two cautions. First, verify you're on the real revoke tool — scammers clone those too. Second, don't hand out unlimited approvals to save a few cents of gas; the amount you save is trivially small next to your full balance of that token.

Risk two: six shapes of phishing

1. Lookalike sites

A domain one or two characters off from the official one, with a pixel-perfect copy of the site. They arrive via search ads, shortened links in communities, and DMs promising a "new official site." The defense is boring and effective: bookmark the sites you use and always enter through the bookmark, never through an ad.

2. Fake apps and fake extension updates

A same-named wallet in an app store, or a browser popup saying your extension needs to be reinstalled. Only install from the official store link your wallet's own site provides, and let the browser handle extension updates — never click an "update" button on a third-party page.

3. Impersonated support

"Admins," "support," and "tech help" sliding into DMs to solve your problem, process a refund, or enroll you in an event. Real support does not initiate contact asking you to do things with your assets. Report and block anyone who does.

4. Address poisoning

A scam many people haven't heard of: the attacker sends your address a zero-value or dust transaction from an address whose first and last characters match one of your frequent counterparties. The goal is to pollute your transaction history so that the next time you copy an address from "recent transactions," you copy theirs. Defense: never copy addresses out of your history — use an address book or whitelist, and always compare at least the first and last four to six characters.

5. Fake airdrops and claim pages

"You're eligible for the XXX airdrop" pages where clicking "claim" actually prompts an approval or a transfer. The test: real airdrops never ask you to pay first, approve your entire balance, or enter a seed phrase.

6. Fake wallet "upgrade" or "migration" pages

Pages claiming your wallet version must be upgraded or your assets migrated, asking you to type your seed phrase into a web form or into a counterfeit app. Rule: a seed phrase goes only into the legitimate wallet app you opened yourself. Anything else is phishing.

Three checks before every transfer

1. Verify the address: the first and last four to six characters must match, and for large amounts, check the whole thing. Save recurring recipients to an address book;
2. Send a test amount first to any new address, confirm it lands, then send the rest;
3. Confirm on the hardware wallet screen: if you use one, the address shown in the companion app can be altered by malware — the device screen is the trustworthy display. That's the core value of a hardware wallet, so actually use it.

If you've been drained: the first hour

Order matters, and the first two steps are time-critical:

1. Move whatever is left immediately to a newly generated wallet — fresh seed phrase, ideally created in a clean environment. Don't reuse the compromised wallet, and don't just reinstall the app;
2. Revoke approvals from the compromised wallet. If the cause was an approval or a phishing signature rather than a leaked phrase, revoking fast stops other tokens in that address from being taken;
3. Preserve evidence: the theft transaction hash, the attacker's address, timestamps, amounts, and whatever suspicious URL or extension you interacted with;
4. If funds reached a centralized exchange, contact that exchange's support and compliance channel immediately with the evidence and request a freeze. On-chain transfers can't be reversed, but once stolen funds land in a platform account there's a window where platform controls can help — the earlier you file, the better the odds;
5. File a police report and keep the reference number; chain-analysis tools can continue tracing the fund flow;
6. Find the entry point: was it an approval, a phishing signature, or a leaked phrase? Without knowing, the new wallet can be drained the same way.

An honest caveat: once on-chain assets move, recovery odds are low. That's precisely why every protection step above is worth the time.

Everyday protection checklist

1. Layer your assets: trading funds on an exchange, small balances in a hot wallet for daily activity, long-term holdings on a hardware wallet;
2. Use a dedicated browser profile (or a spare device) for on-chain work — never mixed with everyday browsing;
3. Bookmark everything you use; never click search ads or links from DMs;
4. Read the popup before signing. Signing and approving are different things — approvals are the dangerous ones, so prefer exact amounts over unlimited;
5. Audit approvals monthly and revoke what you no longer use;
6. Never share a seed phrase, private key, or verification code with anyone, for any reason.

FAQ

What's the difference between signing and approving?

A signature usually just proves you control an address and doesn't move assets. An approval grants a contract permission to move a specific token — with a large enough allowance, it can move your funds at will. When an approval dialog appears, read the contract and the amount before confirming.

Does revoking cost money?

Yes — revoking is an on-chain transaction and costs gas, which varies with network congestion. That's an argument for avoiding unlimited approvals from the start rather than cleaning up a long list later.

Is it risky to keep everything in one wallet?

Yes. One wallet means one seed phrase, so a single leak is total. And the wallet you interact with constantly has the most exposure by definition. Split it up: hot wallet for active on-chain funds, hardware wallet for long-term holdings, and trading funds on a well-audited exchange with published reserves — for example Binance, OKX, or Gate.io. Then any single failure stays contained.

Can stolen crypto actually be recovered?

Rarely, but not never. There are two windows: funds arriving at a centralized exchange, where a fast evidence submission can trigger a freeze, and cases where law enforcement and chain-analysis firms get involved. Most of the time the assets are split, bridged, and routed through mixers within hours — which is why prevention is worth vastly more than recovery.

Risk disclosure and affiliate notice: On-chain transactions are irreversible, and approvals and signatures carry real risk of loss. Nothing here is investment advice. This article contains affiliate links; registering through them may earn us a commission at no extra cost to you, and it does not affect our conclusions. Tools and mechanisms described are current as of October 2026 — refer to official documentation.