[{"data":1,"prerenderedAt":567},["ShallowReactive",2],{"page-\u002Fsecurity\u002Fwallet-approval-scams-and-dangerous-permissions\u002F":3,"more-in-group-\u002Fsecurity\u002Fwallet-approval-scams-and-dangerous-permissions":546},{"id":4,"title":5,"body":6,"description":525,"excerpt":526,"extension":527,"meta":528,"navigation":539,"path":540,"publishedAt":541,"seo":542,"stem":543,"updatedAt":544,"__hash__":545},"content\u002Fsecurity\u002Fwallet-approval-scams-and-dangerous-permissions.md","Wallet Approval Scams and Dangerous Permissions",{"type":7,"value":8,"toc":505},"minimark",[9,13,16,29,34,94,100,104,107,110,113,129,142,146,149,152,166,169,172,187,191,198,201,212,219,236,244,248,251,275,278,282,285,290,310,313,317,320,323,327,330,344,347,351,354,361,375,384,395,399,406,410,413,455,459,462,465,480,495,499,502],[10,11,12],"p",{},"Approval scams are dangerous because they do not always steal money immediately.",[10,14,15],{},"Sometimes the attacker gets permission first, then drains tokens later when you stop paying attention. That is why so many victims say, \"I did not send anything\" even though the wallet was still emptied.",[10,17,18,19,24,25],{},"This guide is the practical follow-up to our broader ",[20,21,23],"a",{"href":22},"\u002Fsecurity\u002Fcommon-crypto-scams-and-how-to-avoid-them","common crypto scams guide",". The question here is narrower: ",[26,27,28],"strong",{},"what exactly did you approve, what can still be revoked, and when is revoking not enough?",[30,31,33],"h2",{"id":32},"short-answer","Short answer",[35,36,37,50],"table",{},[38,39,40],"thead",{},[41,42,43,47],"tr",{},[44,45,46],"th",{},"If this just happened",[44,48,49],{},"Safest move",[51,52,53,62,70,78,86],"tbody",{},[41,54,55,59],{},[56,57,58],"td",{},"You connected a wallet to a site you no longer trust",[56,60,61],{},"Disconnect it and review onchain approvals too.",[41,63,64,67],{},[56,65,66],{},"You approved a token allowance or NFT permission",[56,68,69],{},"Revoke the approval as soon as possible and watch for more prompts.",[41,71,72,75],{},[56,73,74],{},"You signed a vague smart-contract action and are not sure what it did",[56,76,77],{},"Stop using that wallet for new dapp activity until you review approvals and balances carefully.",[41,79,80,83],{},[56,81,82],{},"You revealed your seed phrase or private key",[56,84,85],{},"Do not waste time on revokes first. Move funds to a brand-new wallet immediately.",[41,87,88,91],{},[56,89,90],{},"Your long-term wallet was the one interacting with random dapps",[56,92,93],{},"Move valuable assets to a cleaner storage setup after you understand what was approved.",[10,95,96,99],{},[26,97,98],{},"Gas deposits disappearing too? Stop topping up."," That can indicate a sweeper bot with access to your keys, not just an unwanted token allowance. Revoking approvals does not fix exposed keys; see the gas-fee warning below before sending more funds.",[30,101,103],{"id":102},"what-an-approval-scam-actually-does","What an approval scam actually does",[10,105,106],{},"A lot of users think the only dangerous action is pressing Send.",[10,108,109],{},"On EVM chains, many dapps ask for a separate permission first. You may approve a token allowance, NFT permission, permit signature, or other contract access that lets a spender move assets later. That approval can be legitimate for a real swap or marketplace, but the exact same mechanism is what malicious sites abuse.",[10,111,112],{},"The common pattern looks like this:",[114,115,116,120,123,126],"ul",{},[117,118,119],"li",{},"a fake airdrop, mint, claim, bridge, or support page asks you to connect a wallet;",[117,121,122],{},"the wallet prompt looks technical enough that you click through it;",[117,124,125],{},"the site gets permission to spend a token or manage an NFT;",[117,127,128],{},"the draining transaction happens later, sometimes after you think nothing happened.",[10,130,131,132,136,137,141],{},"That is why approval scams overlap with ",[20,133,135],{"href":134},"\u002Fsecurity\u002Fblind-signing-hardware-wallet","blind signing",", ",[20,138,140],{"href":139},"\u002Fsecurity\u002Fcrypto-dusting-attacks","dusting attacks",", and fake wallet-drainer pages. The core mistake is the same: approving an action you did not fully verify.",[30,143,145],{"id":144},"disconnecting-a-dapp-vs-revoking-an-approval","Disconnecting a dapp vs revoking an approval",[10,147,148],{},"This distinction matters.",[10,150,151],{},"Trezor and Coinbase both separate the two ideas:",[114,153,154,160],{},[117,155,156,159],{},[26,157,158],{},"Disconnecting a dapp"," usually stops the app from seeing your connected wallet session, public address, or balances through that connection.",[117,161,162,165],{},[26,163,164],{},"Revoking an approval"," removes or reduces the onchain permission that lets a contract spend tokens or control NFTs.",[10,167,168],{},"If you only disconnect, the approval can still remain live onchain.",[10,170,171],{},"That is why the safer cleanup order after a suspicious interaction is:",[173,174,175,178,181,184],"ol",{},[117,176,177],{},"disconnect the dapp or session;",[117,179,180],{},"review token and NFT approvals on the affected network;",[117,182,183],{},"revoke anything you do not recognize, no longer need, or granted to the wrong site;",[117,185,186],{},"reassess whether the wallet should still be trusted for storage.",[30,188,190],{"id":189},"when-revoking-helps-and-when-it-does-not","When revoking helps, and when it does not",[10,192,193,194,197],{},"Revoking helps when the problem is an ",[26,195,196],{},"onchain permission"," that you granted from the wallet.",[10,199,200],{},"Examples:",[114,202,203,206,209],{},[117,204,205],{},"unlimited token allowance to a fake swap page;",[117,207,208],{},"an NFT approval you no longer trust;",[117,210,211],{},"an old permission you forgot about from a dapp you no longer use.",[10,213,214,215,218],{},"Revoking is ",[26,216,217],{},"not"," a complete fix when:",[114,220,221,224,227,230,233],{},[117,222,223],{},"you typed your seed phrase into a site or app;",[117,225,226],{},"you gave away a private key;",[117,228,229],{},"the attacker already transferred assets out;",[117,231,232],{},"you signed something that changed wallet ownership or broader account permissions outside a normal token allowance;",[117,234,235],{},"the same wallet keeps interacting with new malicious prompts while you are troubleshooting.",[10,237,238,239,243],{},"If the recovery phrase was exposed, skip the debate and move funds to a new wallet you create yourself. For that workflow, read ",[20,240,242],{"href":241},"\u002Fsecurity\u002Fseed-phrase-exposed-what-to-do","seed phrase exposed? what to do",".",[30,245,247],{"id":246},"practical-signs-an-approval-is-dangerous","Practical signs an approval is dangerous",[10,249,250],{},"Pause immediately if you see any of these:",[114,252,253,260,263,266,269,272],{},[117,254,255,256,259],{},"the dapp asks for ",[26,257,258],{},"unlimited"," token access when the amount could have been smaller;",[117,261,262],{},"the prompt appears after clicking a token name, memo link, fake NFT, or social-message link;",[117,264,265],{},"the site URL is slightly different from the real project;",[117,267,268],{},"the wallet shows raw contract data you do not understand;",[117,270,271],{},"the site says you must approve first to \"recover,\" \"verify,\" or \"unlock\" funds;",[117,273,274],{},"the approval is coming from your main storage wallet instead of a smaller activity wallet.",[10,276,277],{},"If the request is not clear, reject it. A missed opportunity is cheaper than a drained wallet.",[30,279,281],{"id":280},"how-to-review-and-revoke-approvals-safely","How to review and revoke approvals safely",[10,283,284],{},"Official wallet support docs all point to the same basic rule: use a trusted interface, confirm the network, and understand that a revoke is a real blockchain transaction.",[286,287,289],"h3",{"id":288},"_1-start-with-the-wallet-or-tool-you-trust-most","1. Start with the wallet or tool you trust most",[114,291,292,298,304],{},[117,293,294,297],{},[26,295,296],{},"Coinbase Wallet"," supports reviewing connected dapps and token approvals from its settings menu.",[117,299,300,303],{},[26,301,302],{},"Ledger"," documents revocation through Ledger's Discover integration with revoke.cash and through explorer-based approval checkers for Ethereum.",[117,305,306,309],{},[26,307,308],{},"Trezor"," points users to review and revoke allowances with trusted third-party tools because many smart-contract interactions happen through MetaMask or other companion apps.",[10,311,312],{},"If a wallet has a built-in approvals screen, use that first. If it does not, use a well-known explorer approval checker or a trusted revoke tool referenced by official wallet support.",[286,314,316],{"id":315},"_2-check-the-correct-network","2. Check the correct network",[10,318,319],{},"Approvals are chain-specific.",[10,321,322],{},"A permission on Ethereum is different from one on Base, Arbitrum, BNB Smart Chain, Polygon, or another EVM network. Review the exact network where you connected the wallet.",[286,324,326],{"id":325},"_3-look-for-the-spender-asset-and-scope","3. Look for the spender, asset, and scope",[10,328,329],{},"Before revoking, identify:",[114,331,332,335,338,341],{},[117,333,334],{},"which token or NFT the approval covers;",[117,336,337],{},"which contract or spender received access;",[117,339,340],{},"whether the allowance is limited or effectively unlimited;",[117,342,343],{},"whether you still intentionally use that dapp.",[10,345,346],{},"If you do not recognize the spender, that alone is a good reason to slow down.",[286,348,350],{"id":349},"_4-expect-a-gas-fee","4. Expect a gas fee",[10,352,353],{},"Revoking is not a free button press.",[10,355,356,357,360],{},"Revoking an onchain token approval requires gas, normally paid in the network's native coin. But ",[26,358,359],{},"do not automatically top up a wallet that may have a leaked seed phrase or private key",". First distinguish an unwanted allowance from an attacker who can sign transactions themselves.",[10,362,363,364,367,368,374],{},"If fresh gas deposits disappear without your action, a ",[26,365,366],{},"sweeper bot"," may be moving them to the attacker before you can use them. Stop depositing funds. Trying to send the next top-up faster is not a reliable rescue plan; an automated bot can act before you do. MetaMask's ",[20,369,373],{"href":370,"rel":371},"https:\u002F\u002Fsupport.metamask.io\u002Fstay-safe\u002Fprotect-yourself\u002Ffighting-back-against-sweeper-bots\u002F",[372],"nofollow","sweeper-bot guidance"," explains this risk and points to specialist recovery options. Availability and recovery success are not guaranteed. Reach help through official documentation, not unsolicited messages from people claiming they can recover your funds.",[10,376,377,378,383],{},"If the problem is an unwanted token allowance and there is no sign of key compromise or unexplained outgoing transfers, a gas top-up may be needed to submit the revoke. Use your wallet's official guidance or a trusted block explorer to identify the affected network and spender first. MetaMask's ",[20,379,382],{"href":380,"rel":381},"https:\u002F\u002Fsupport.metamask.io\u002Fmore-web3\u002Flearn\u002Fhow-to-revoke-smart-contract-allowances-token-approvals\u002F",[372],"approval-revocation guide"," explains why disconnecting the site alone does not remove that permission.",[10,385,386,387,390,391,394],{},"If your recovery phrase was exposed, use a ",[26,388,389],{},"new recovery phrase"," for the replacement wallet. Adding another account under the old phrase, restoring it on a new hardware wallet, or changing the device PIN does not remove the attacker's access. Follow the ",[20,392,393],{"href":241},"seed-phrase exposure guide"," for the migration path, with the sweeper warning above taking priority over any suggestion to add gas.",[286,396,398],{"id":397},"_5-confirm-the-revoke-transaction-like-any-other-transaction","5. Confirm the revoke transaction like any other transaction",[10,400,401,402,405],{},"Ledger's official guidance notes that when revoking token access, the amount shown on the device should be ",[26,403,404],{},"0",". More broadly, the point is simple: do not rush the cleanup and sign another unclear transaction while trying to fix the first one.",[30,407,409],{"id":408},"what-to-do-right-after-a-suspicious-approval","What to do right after a suspicious approval",[10,411,412],{},"If you think you approved something bad but the wallet is not drained yet, use this order:",[173,414,415,420,426,432,437,443,449],{},[117,416,417],{},[26,418,419],{},"Stop connecting that wallet to more sites.",[117,421,422,425],{},[26,423,424],{},"Disconnect the dapp session"," where possible.",[117,427,428,431],{},[26,429,430],{},"Review token and NFT approvals"," on the affected network.",[117,433,434],{},[26,435,436],{},"Revoke suspicious or unnecessary permissions.",[117,438,439,442],{},[26,440,441],{},"Check recent transactions and balances"," for assets that may already have moved.",[117,444,445,448],{},[26,446,447],{},"Move meaningful long-term holdings"," to a cleaner wallet if the same wallet was used casually with random dapps.",[117,450,451,454],{},[26,452,453],{},"Change your habits, not just the setting."," The next bad approval usually comes from the same rushed workflow.",[30,456,458],{"id":457},"the-safer-wallet-setup-for-people-who-use-dapps","The safer wallet setup for people who use dapps",[10,460,461],{},"The best defense is structural, not heroic.",[10,463,464],{},"Keep different jobs in different wallets:",[114,466,467,474],{},[117,468,469,470,473],{},"a ",[26,471,472],{},"long-term storage wallet"," that rarely connects anywhere;",[117,475,469,476,479],{},[26,477,478],{},"smaller activity wallet"," for swaps, mints, bridges, and experiments.",[10,481,482,483,136,487,491,492,243],{},"That is where Tangem, Ledger, and Trezor fit naturally as storage-oriented wallets. They do not make malicious approvals impossible, but they make it easier to keep serious holdings separate from everyday experimentation. If you are still choosing that storage setup, start with ",[20,484,486],{"href":485},"\u002Fwallets\u002Fbest-hardware-wallet-for-beginners","best hardware wallet for beginners",[20,488,490],{"href":489},"\u002Fwallets\u002Ftangem-vs-ledger","Tangem vs Ledger",", and ",[20,493,494],{"href":134},"blind signing on hardware wallets",[30,496,498],{"id":497},"bottom-line","Bottom line",[10,500,501],{},"Approval scams are dangerous because the theft can happen after the moment you stop paying attention.",[10,503,504],{},"If you signed something suspicious, disconnect first, review approvals on the correct network, and revoke anything you do not trust. But remember the bigger rule: revoking fixes onchain permissions, not a leaked seed phrase and not the habit of using your main wallet as a test wallet.",{"title":506,"searchDepth":507,"depth":507,"links":508},"",2,[509,510,511,512,513,514,522,523,524],{"id":32,"depth":507,"text":33},{"id":102,"depth":507,"text":103},{"id":144,"depth":507,"text":145},{"id":189,"depth":507,"text":190},{"id":246,"depth":507,"text":247},{"id":280,"depth":507,"text":281,"children":515},[516,518,519,520,521],{"id":288,"depth":517,"text":289},3,{"id":315,"depth":517,"text":316},{"id":325,"depth":517,"text":326},{"id":349,"depth":517,"text":350},{"id":397,"depth":517,"text":398},{"id":408,"depth":507,"text":409},{"id":457,"depth":507,"text":458},{"id":497,"depth":507,"text":498},"Learn how wallet approval scams work, when revoking token allowances actually helps, and what to do first if you signed something suspicious.",null,"md",{"faqs":529},[530,533,536],{"question":531,"answer":532},"Does disconnecting a dapp revoke token approvals?","No. Disconnecting a dapp usually stops it from viewing your wallet connection, but token approvals can still remain onchain until you revoke them.",{"question":534,"answer":535},"Does revoking a token approval cost gas?","Yes. Revoking an approval is an onchain transaction, so you normally need a small amount of the network's native coin to pay the fee.",{"question":537,"answer":538},"If I entered my seed phrase on a scam site, is revoking approvals enough?","No. If the seed phrase or private key was exposed, treat the whole wallet as compromised and move funds to a new wallet you create yourself.",true,"\u002Fsecurity\u002Fwallet-approval-scams-and-dangerous-permissions","April 8, 2026",{"title":5,"description":525},"security\u002Fwallet-approval-scams-and-dangerous-permissions","November 8, 2026","9rK7vi3q3FEC4Fk7RKTkE_zhAVHp9cn07OylY-o7wDA",{"group":547,"siblings":548},"Scams",[549,555,559,563],{"href":550,"section":551,"group":547,"short":552,"updatedAt":553,"isNew":554,"isArticle":539},"\u002Fsecurity\u002Fcrypto-dusting-attacks\u002F","security","Crypto Dusting Attacks","October 14, 2026",false,{"href":556,"section":551,"group":547,"short":557,"updatedAt":558,"isNew":539,"isArticle":539},"\u002Fsecurity\u002Fhardware-wallet-order-data-leak-phishing\u002F","Hardware Wallet Order Data Leak?","August 20, 2026",{"href":560,"section":551,"group":547,"short":561,"updatedAt":562,"isNew":554,"isArticle":539},"\u002Fsecurity\u002Fcommon-crypto-scams-and-how-to-avoid-them\u002F","Common Crypto Scams and How to Avoid Them","October 26, 2026",{"href":564,"section":551,"group":547,"short":565,"updatedAt":566,"isNew":554,"isArticle":539},"\u002Fsecurity\u002Fcrypto-support-call-scam\u002F","Crypto Support Call Scam","August 9, 2026",1794373506846]