Revocation is itself a transaction: it costs a fee and must be signed, per token and per contract. Until it confirms, the old permission stands.
Revoke before moving funds. Moving first into an address that still has approvals attached, or leaving a balance behind while you deal with something else, is how second losses happen.
Related terms
Token approval
Permission you grant a contract to move a token on your behalf, which stays in force until you revoke it.
Wallet drainer
A malicious contract or site designed to obtain signatures that let it withdraw a victim's tokens.
Hot wallet
A wallet running on an internet-connected device, such as a browser extension or phone app.
Trying to work out what happened to your funds?
The first review is free and we set out scope and price in writing before any paid work.