How to revoke a malicious crypto token approval
If you signed an approval on an untrusted website, revoke the allowance immediately using a reputable token approval tool or your wallet settings. Disconnecting your wallet alone does not stop spending permissions, so revoking the onchain allowance is necessary to protect any remaining assets.
- This fraud occurs when a deceptive website prompts you to sign a digital permission that grants a third party unlimited authority to transfer specific tokens directly out of your wallet.
- Warning signs include unprompted token giveaways, sudden demands to connect your wallet to claim rewards, or signature requests that contain setApprovalForAll or unlimited token spending parameters.
- Immediately visit an established token allowance manager to revoke active approvals, transfer any remaining unaffected assets to an entirely fresh wallet, and stop interacting with the compromised website.
- Export your complete transaction history, capture full screenshots of the malicious website and the exact approval request prompt, and preserve all associated browser history records for investigative review.
- Report the incident formally to Action Fraud online or by telephone, and notify your UK bank immediately if any fiat funds were used to purchase the cryptocurrency involved.
- A professional onchain trace can map where your stolen tokens moved and identify destination deposit platforms, but it cannot reverse transactions or unilaterally compel an overseas service to freeze funds.
Read next
Written by the Wallsec investigations team. General information only, not legal or financial advice.
Need a case reviewed?
Tell us what happened and we will say honestly whether the onchain data supports a trace.