How to find and revoke risky token approvals
What a token approval is, why old and unlimited ones are a risk, which to revoke first, and how to revoke them across all your wallets.
Updated Nov 8, 2026
In short
When you use a DeFi app, you approve it to move a token for you, often with no limit, and that permission stays until you take it back. Check every wallet for approvals, revoke unlimited ones to contracts you don't use or don't trust first, and approve exact amounts from now on. Revoking is a transaction, so it costs a little gas, and your tokens never move.
Every time you swap on a DEX, deposit into a protocol or list a token for sale, you give a smart contract permission to move a token from your wallet. That permission is an approval, and most apps ask for an unlimited one by default. It doesn't expire. Months later, if that contract is exploited, or was never what it claimed, it can still take that token.
What an approval is
On Ethereum and other EVM chains, a token approval sets an allowance: how much of a token a given contract may move from your wallet. Apps ask for it so they don't need a new approval every time. Some approvals are given by signature rather than a transaction, through standards such as Permit and Permit2, which makes them easy to give without noticing.
Why old approvals are a risk
- The contract is exploited later. A protocol you used once can be hacked years afterwards, and its approvals with it.
- It was malicious all along. Drainer sites ask for approvals that look routine.
- Unlimited means everything. An unlimited allowance covers every unit of that token you'll ever hold in that wallet, not only what you had when you approved.
Which to revoke first
- Unlimited approvals to unverified contracts. These are the riskiest; Burokku flags them for you.
- Approvals to apps you no longer use. There's no reason to keep them.
- Approvals on tokens you hold a lot of. The larger the balance, the more an approval can lose.
How to check and revoke in Burokku
The Approvals tool lists every live allowance across all your wallets and chains: the token, the contract allowed to spend it, how much, when you approved it, a risk score, and the value at risk, which is what risky spenders could take today. Connect the wallet, tick the approvals to take back and sign; where your wallet can batch, each chain's revokes go in one signature. A risky approval alert also tells you as soon as any of your wallets grants an unlimited approval to an unverified contract.
Other ways to check
You don't need Burokku to revoke an approval. Revoke.cash checks one wallet at a time across many chains, and most block explorers have a token approval checker. Burokku's difference is that it checks all your wallets together and keeps checking.
Stop it happening again
- Approve exact amounts when an app lets you, instead of unlimited.
- Read what you sign. Burokku's signature decoder turns a signing request into plain language and flags drainer patterns; its link check tells you whether a site is the real one.
- Run a check-up now and then. The wallet check-up gives each wallet a security score with the fixes that matter most first.
Questions
- Does revoking an approval move my tokens?
- No. It only takes away the app's permission to move them. Your tokens stay where they are.
- Does revoking cost anything?
- Yes, a little gas. A revoke is an onchain transaction on the chain where the approval was given.
- Can I revoke from a wallet I only watch?
- You can see a watched wallet's approvals, but revoking needs a signature, so connect that wallet first. Burokku never signs for you.
- My wallet was drained. What now?
- Move what's left to a new wallet first, then revoke. In Burokku, emergency mode prepares both: revoking every approval and sweeping the funds to a safe address, in as few signatures as possible.