The quick version. A token approval is a standing permission that lets a smart contract move a particular token out of your wallet whenever it chooses. Most apps ask for an unlimited allowance by default, and that permission stays live long after you have stopped using the app. Reviewing your approvals and revoking the ones you no longer need is one of the cheapest security habits in crypto.
What an approval actually grants
Your token balance does not really sit inside your wallet. For an ERC-20 token, the balance is a row in the token’s own contract saying that your address owns a certain number of units. Your wallet holds the key that lets you tell that contract to move the row.
That creates a problem for any app that needs to move tokens on your behalf. A decentralised exchange cannot sign for you, so the token standard includes a second route. You call the approve function to grant a named contract an allowance, and that contract can then pull up to that amount using transferFrom.
It is why your first swap on a new app usually costs two transactions. The first sets the allowance. The second does the swap, spending the permission you just handed over.
The important detail is what an allowance is not. It is not a one-off ticket that expires when you close the tab. It is a number recorded on-chain that sits unchanged until you or the spender changes it.
Why unlimited became the default
Every approval is a transaction, and every transaction costs a network fee. If apps requested only the exact amount you were about to trade, you would pay a fee before every single swap.
So the industry settled on a shortcut: ask once for a number so large it never runs out. That is a genuine convenience, and it is why the pattern became normal rather than exceptional.
It also quietly changes the risk you are carrying. An unlimited allowance has no expiry, no spending cap and no notion of a session. It survives the app going quiet, the team moving on, and the contract being upgraded to code you never looked at. On an active address these pile up, each one a door left on the latch.
How a drainer site abuses the mechanism
The classic wallet drainer does not go anywhere near your recovery phrase. It only needs you to sign one routine-looking confirmation.
The site looks like a project you recognise, or an airdrop checker, or a migration page that turned up in your feed with a countdown on it. You connect your wallet, a confirmation pops up, and it is an approval naming the attacker’s contract as the spender.
Nothing dramatic happens next, and that is the trick. The attacker calls transferFrom later, sometimes days later, sweeping the approved token from every address that granted them an allowance. By then the site is long closed and the connection between the two events is invisible to you.
There is a gasless variant too. Some tokens support a signed permit message, which grants an allowance from an off-chain signature with no transaction and no fee. “It is only a signature, it costs nothing” is therefore a poor reason to relax. The NFT equivalent is a collection-wide operator approval, broader again because it covers every item you hold now or later.
Safety: Before you confirm anything, read the two fields that matter: which token is being approved, and which contract is named as the spender. If your wallet cannot show you those in plain terms, reject the request. No legitimate support agent, moderator or “wallet validation” bot will ever ask you to sign a transaction to fix an account problem, one of the tactics covered in our walkthrough on how to spot crypto scams.
Reviewing and revoking what you have already granted
Allowances are public. Anyone can look up which contracts your address has approved, because the record lives on-chain in each token contract. A block explorer usually has a token approvals view, and dedicated approval managers present the same data more readably.
Two rules keep this safe. Type the address of the tool yourself instead of following a link from a message or a search advert, because fake revoke sites are a well-worn trap aimed at exactly the people trying to be careful. And cross-check anything surprising against the block explorer, which is the underlying source.
Revoking means writing the allowance back down to zero, which is an ordinary transaction and costs a network fee. Allowances are also per network, so approvals granted on one chain are invisible to a tool pointed at another.
Shrinking the blast radius
The most effective habit is not vigilance, because vigilance fades. It is separation. Keep one wallet for experimenting and a different one for holdings you would be upset to lose.
- Fund the experimenting wallet with an amount you would be genuinely relaxed about losing, and treat everything it touches as disposable.
- Keep long-term holdings on a wallet that never connects to an unfamiliar app, so there is nothing there to approve in the first place.
- Where your wallet lets you edit the allowance, set it close to the amount you are actually trading rather than accepting the default.
- Sweep your approvals on a rhythm you will keep, such as whenever you tidy up your portfolio, and grant collection-wide NFT operator approvals sparingly.
If most of your activity happens in decentralised finance, the approval surface grows quickly, because every new app wants its own permission. Our lesson on DeFi basics and risks puts approvals alongside the other risks of permissionless apps.
What approvals cannot do
An approval does not expose your private key or your recovery phrase. Nobody learns your seed phrase because you approved a contract, and revoking is not a key rotation.
Native coins work differently too. Sending a network’s own coin involves no allowance, because there is no separate token contract to ask permission from. Allowances apply to balances that live inside a smart contract.
And a hardware wallet does not rescue you here. It protects your key from being extracted, but it does not stop you authorising something you did not understand. An approval confirmed on a device is exactly as binding as one confirmed in a browser extension. The hot wallet versus cold wallet distinction is about key exposure, not judgement.
Key takeaways
- An approval is a standing allowance that lets a named contract pull a token from your address, and unlimited is the default for convenience, not for safety.
- Drainers rely on approvals rather than stolen seed phrases, including gasless permit signatures that cost nothing to sign.
- Review approvals per chain using a block explorer or an approval manager you reached by typing the address yourself, then revoke what you no longer use.
- Separating an experimental wallet from your long-term one limits the damage more reliably than trying to be careful every time.
Frequently asked questions
Does revoking an approval get my tokens back?
No. Revoking sets the allowance to zero, which prevents future transfers by that spender. It has no effect on transfers that have already gone through, and an on-chain transfer cannot be reversed by you, by us or by the network. Treat revoking as closing an open door rather than as a recovery tool, which is why doing it early is what counts.
I use a hardware wallet. Do I still need to worry about this?
Yes. A hardware wallet keeps your private key off an internet-connected computer, which defeats key theft very effectively. It does not evaluate transactions for you. If you confirm a malicious approval on the device screen, the outcome is identical to confirming it anywhere else. Use the device’s ability to display transaction details in full, and refuse anything you cannot read.
Is signing a message safer than signing a transaction?
Not automatically. Some signatures are harmless proofs that you control an address, used simply to log in. Others are permit-style authorisations granting an allowance with no transaction and no fee, which is why “it is free” tells you nothing about the risk. Read what the message says before you sign, and be wary of any request whose wording you cannot follow.
Sources
Educational content, not financial advice. Never share your seed phrase or private keys with anyone — including anyone claiming to be CoinCrafty.
Last updated Jul 25, 2026
