Crypto users often give out more access than they realize. A token swap, a deposit or an NFT listing can each give a smart contract permission to move tokens out of a wallet.
Many of these permissions stay active long after the user stops using the app. Scammers know this, and wallet drainer groups build their attacks around it.
This article sets out the key numbers on crypto theft and wallet permissions. It also explains how approvals work, what revoking them does and where the limits are.
Key Statistics at a Glance
The table below sums up the main figures covered in this article. Each one is explained in more detail in the sections that follow.
| Statistic | Figure | Source |
|---|---|---|
| Crypto stolen in hacks, 2024 | About $2.2 billion | Chainalysis |
| Change from 2023 (about $1.8 billion) | Up about 21% | Chainalysis |
| Stolen by wallet drainers, 2024 | About $494 million | Scam Sniffer |
| Addresses hit by drainers, 2024 | About 332,000 | Scam Sniffer |
| Rise in drainer losses vs 2023 | About 67% | Scam Sniffer |
| Networks in MetaMask Portfolio allowance tool | 3 | MetaMask |
| Token standards in Etherscan approval checker | 3 | Etherscan |
| Active delegates per standard Solana token account | 1 | Solana |
| Stolen funds that revoking can recover | None | Revoke.cash |
| Suggested review for active users | Monthly | MetaMask guidance |
Crypto Theft by the Numbers
Crypto theft remains a large problem. Blockchain analysis firm Chainalysis reported that about $2.2 billion was stolen from crypto platforms in 2024.
That was up about 21% from roughly $1.8 billion in 2023. Most of this money came from attacks on exchanges and other services, not from single users.
Wallet drainers target individual users more directly. These are tools and fake websites built to trick people into signing away access to their tokens.
Security firm Scam Sniffer tracks this activity each year. It found that wallet drainers stole about $494 million from roughly 332,000 addresses in 2024.
In 2023, the same firm counted about $295 million taken from around 324,000 victims. Losses rose by about 67% while the number of victims grew by only about 2%.
As a result, the average loss per victim went up. It rose from about $910 in 2023 to about $1,490 in 2024.
| Year | Drainer losses | Victims | Average loss per victim |
|---|---|---|---|
| 2023 | About $295 million | About 324,000 | About $910 |
| 2024 | About $494 million | About 332,000 | About $1,490 |
| Change | Up about 67% | Up about 2% | Up about 63% |
Averages are calculated from Scam Sniffer totals and rounded.
Many drainer attacks work through wallet permissions. The victim approves a contract or signs a message, and the attacker then uses that access to move tokens.
Knowing how these permissions work is the first step to limiting the risk. The next sections explain the main types.
The Three Types of Wallet Permissions
Not every wallet permission gives the same level of access. The three main types are wallet connections, token approvals and transaction signatures.
A wallet connection links your wallet to a website, often called a decentralized app or dApp. The site can then see account details and ask you to sign transactions.
A connection on its own does not let a website move your tokens. Extra permissions or signed transactions are needed for that.
A token approval goes further. Many tokens on Ethereum-compatible chains follow the ERC-20 standard, which lets a holder allow another address to spend a set amount of tokens.
That other address is usually a smart contract, such as a decentralized exchange. Once approved, the contract can move tokens up to its limit without asking each time.
A signature proves that your private key approved an action. Some signatures only confirm who you are, while others approve token spending or transfers.
The risk depends on what you sign. A prompt that looks like a simple login check could hide a spending approval, so each one deserves a careful read.
Limited vs Unlimited Approvals
Some apps ask for an unlimited approval. This lets the contract spend any amount of that token, both now and in the future.
It saves time, since you do not need to approve the same token again for each trade. But it also raises the amount at risk if the contract is hacked or turns out to be malicious.
Take an investor who holds $10,000 in USDC and wants to swap $500. A $500 approval puts $500 at risk, while an unlimited approval puts the full $10,000 at risk.
The gap grows if the investor adds more USDC later. An unlimited approval also covers tokens that arrive in the wallet after the approval was given.
There is a limit to the damage. An approval covers one token, one approved spender and one network, not every coin in the wallet.
| USDC balance | At risk with a $500 approval | At risk with an unlimited approval | Difference |
|---|---|---|---|
| $1,000 | $500 | $1,000 | 2x |
| $5,000 | $500 | $5,000 | 10x |
| $10,000 | $500 | $10,000 | 20x |
| $20,000 | $500 | $20,000 | 40x |
Example only. Assumes the $500 allowance has not yet been used.
Ethereum.org’s security guidance says unlimited allowances increase the possible damage from a malicious contract. The simple rule is to approve only what a transaction needs.
Disconnecting a Wallet Is Not the Same as Revoking
One of the most common mistakes is thinking that disconnecting a wallet from a site removes its permissions. It does not.
Disconnecting removes the link between the site and your wallet. Any token approval you gave stays recorded on the blockchain.
MetaMask’s own support pages confirm this. To remove a token approval, you have to send a separate revocation transaction.
| Action | Disconnect wallet | Revoke token approval |
|---|---|---|
| Removes the app’s wallet connection | Yes | Not necessarily |
| Removes an existing on-chain token allowance | No | Yes, for the selected approval |
| Prevents further spending through that allowance | No | Yes, once confirmed |
| Requires a blockchain transaction | Usually no | Usually yes |
| Requires gas fees | Usually no | Yes, in most cases |
| Removes access to all crypto assets | No | No, only the relevant permission |
| Recovers stolen funds | No | No |
Source: MetaMask.
Of the seven checks above, only revoking removes the allowance and stops further spending through it. Neither action recovers stolen funds.
This matters most for people who try out many new apps. Clearing old connections from a wallet screen does not clear the risk that comes with them.
Tools for Checking and Revoking Approvals
Before revoking anything, you need to see which contracts have access. Three tools are widely used for this: Revoke.cash, the Etherscan Token Approval Checker and MetaMask Portfolio.
Each one works from your public wallet address. On Ethereum-compatible chains this starts with “0x” and does not reveal your private key or seed phrase.
Revoke.cash supports many networks. You can search by address to review approvals without connecting your wallet, then connect only when you want to revoke.
Etherscan’s checker covers Ethereum and three token standards. These are ERC-20 tokens, ERC-721 NFTs and ERC-1155 multi-token assets.
NFT approvals need extra care. Some let an operator move many items from a collection, not just one.
MetaMask says its Portfolio allowance tool supports three networks: Ethereum Mainnet, Polygon and BNB Chain. Users should check the current list before relying on it.
| Tool | Networks | What it checks | Steps in process | Review without connecting |
|---|---|---|---|---|
| Revoke.cash | Many networks | Token and NFT approvals | 6 | Yes |
| Etherscan Token Approval Checker | Ethereum | ERC-20, ERC-721, ERC-1155 | 6 | Yes |
| MetaMask Portfolio | Ethereum, Polygon, BNB Chain | Token allowances | 7 | No |
| Solana SPL Token CLI | Solana | Token delegates | 1 command | Not applicable |
Step counts come from each tool’s published process.
The steps are much the same in each case. You enter your address, pick the network, review approvals, revoke the ones you no longer need, confirm the transaction and check the result.
Approvals are tied to each network. One given on Ethereum will not show up in a Polygon or Base check, so each network you use needs its own review.
Fake copies of these tools exist. Always type the web address yourself instead of clicking links in emails, ads or direct messages.
An unknown contract in the list is not always a threat. Some real apps use several contracts, so compare addresses with the project’s official documents before deciding.
How Solana Permissions Differ
Solana handles spending rights in a different way. Its token program lets an account owner give a “delegate” the right to move or burn a set amount of tokens.
A standard Solana token account can have only one active delegate at a time. ERC-20 tokens, by contrast, can have many approved spenders, each with its own allowance.
Solana’s documentation says the Revoke instruction removes the delegate and resets the delegated amount to zero. People who use the command line can run “spl-token revoke” followed by the token account address.
Ethereum approval checkers do not give full coverage of Solana. Each blockchain needs tools built for it.
| Feature | ERC-20 tokens | NFTs (ERC-721 / ERC-1155) | Solana SPL tokens |
|---|---|---|---|
| Who gets access | Approved spender | Operator | Delegate |
| Active spenders per token | Many | Many | One per token account |
| What revoking does | Sets allowance to zero | Removes operator approval | Removes delegate, resets amount to zero |
| Network fee needed | Yes | Yes | Yes |
What Revoking Costs
Revoking a standard approval is an on-chain transaction. That means it usually costs a network gas fee.
The amount depends on the network and how busy it is. Ethereum Mainnet tends to cost more at busy times, while Layer 2 networks such as Arbitrum and Base usually cost less.
Each approval normally needs its own transaction. Someone with 20 old approvals will pay about ten times as much as someone clearing two, unless a tool offers batching.
The table and chart below use two example fees to show how costs add up. These are not live prices.
| Approvals revoked | Layer 2 example ($0.10 each) | Ethereum Mainnet example ($3.00 each) |
|---|---|---|
| 2 | $0.20 | $6.00 |
| 5 | $0.50 | $15.00 |
| 10 | $1.00 | $30.00 |
| 20 | $2.00 | $60.00 |
Example fees only. Real fees change with network traffic.
The fee should be weighed against what is at risk. Paying a few dollars to cancel an unlimited approval on a large holding is usually worth it.
An old approval on a token worth very little is a lower priority. It makes sense to deal with the riskiest approvals first.
What Revoking Can and Cannot Stop
Revoking an approval cancels one permission. It does not take tokens out of your wallet or close positions in staking or lending apps.
Revoke.cash notes that deposited or staked assets stay where they are. You may need a new approval for future deposits, but that can be given again.
Revoking also has hard limits. It cannot reverse past transactions or bring back stolen funds.
Timing matters with wallet drainers. If an attacker uses an approval before your revocation is confirmed, it comes too late for those tokens.
A leaked seed phrase is a different problem. Anyone with your private keys can sign new transactions and create new approvals after you revoke the old ones.
Signature-based approvals add another gap. Systems such as ERC-2612 permits and Permit2 can create spending rights without the usual approval transaction, and a standard scan may not show them.
How to Respond to a Compromised Wallet
Acting quickly can limit losses. The right response depends on whether the problem is one bad approval or a leak of your private keys.
Ethereum.org and Revoke.cash point to six basic steps. They are listed below in order.
- Stop. Do not approve or sign anything else on suspicious sites.
- Identify the threat. Check your transaction history, token approvals and any sign that your keys were exposed.
- Protect remaining assets. If your keys may be leaked, move funds to a new wallet.
- Revoke bad permissions. Use verified tools and confirm that each revocation succeeds.
- Secure linked accounts. Change passwords and turn on strong two-factor authentication.
- Keep evidence. Save transaction hashes, suspicious addresses and messages.
If keys may be exposed, the new wallet needs a freshly created seed phrase. Importing the old seed phrase into a different wallet app does not make the funds safe.
Be wary of anyone offering to recover stolen crypto for a fee. Ethereum.org warns that blockchain transactions cannot be reversed and that these offers are often a second scam.
Prevention Checklist and Common Mistakes
Revoking old approvals is only one part of wallet safety. A few habits can lower the risk before a problem starts.
Approve only what you need. Swapping $100 of a token does not require unlimited access to that token.
Use separate wallets. Keep long-term holdings in a wallet that rarely connects to websites, and use a second wallet with a smaller balance for new apps.
Hardware wallets protect private keys from some software attacks. They do not cancel approvals you sign, so a bad approval made on a hardware wallet can still be used.
Review permissions on a schedule. MetaMask recommends regular reviews, and monthly is a sensible starting point for active users. Check right away after using an unfamiliar app or hearing about a hack.
| Security measure | Recommended action |
|---|---|
| Wallet connections | Remove access for websites no longer used |
| Token approvals | Review and revoke unneeded allowances |
| Unlimited permissions | Replace with limited allowances where possible |
| Blockchain networks | Check each network the wallet uses |
| NFT permissions | Examine collection-wide operator approvals |
| Wallet storage | Keep long-term holdings in a separate wallet |
| Recovery phrase | Keep it offline and never share it |
| Hardware wallet | Consider one for larger holdings |
| Suspicious activity | Look into unexpected transactions at once |
| Security reviews | Review permissions regularly |
The six most common mistakes when revoking permissions are shown below. Each one can leave a wallet exposed even after the owner thinks it is safe.
| Mistake | Why it matters |
|---|---|
| Thinking disconnecting removes approvals | Connections and on-chain allowances are separate |
| Checking only Ethereum | Approvals may be active on other networks |
| Ignoring NFT approvals | Operators may be able to move a whole collection |
| Trusting any security website | Fake checkers can trick users into signing bad transactions |
| Assuming revoking means safe | A leaked key or other permission can still be used |
| Not checking confirmation | A failed or pending revocation leaves the approval active |
Final Thoughts
Wallet drainer losses climbed to about $494 million in 2024, even though victim numbers barely moved. Attackers are taking more from each person they reach.
Many of these losses rely on permissions that users give away themselves. Approvals stay active until they are revoked, and disconnecting a wallet does not remove them.
Free tools from Revoke.cash, Etherscan and MetaMask make it simple to see and cancel these permissions. The cost is usually a network fee.
Revoking has limits. It cannot recover stolen funds or protect a wallet with a leaked seed phrase, so it works best alongside separate wallets, careful signing and regular reviews.
Disclaimer: This article is for information only. Crypto transactions can be permanent, and security tools cannot promise the recovery or protection of digital assets.
Sources
- Chainalysis: $2.2 Billion Stolen in Crypto in 2024
- Scam Sniffer: 2024 Web3 Phishing Attacks Report
- Scam Sniffer: 2023 Crypto Phishing Scams Report
- Ethereum.org: How to Revoke Smart Contract Access to Your Crypto Funds
- MetaMask: How to Revoke Smart Contract Allowances and Token Approvals
- Etherscan: Token Approvals
- Revoke.cash: Frequently Asked Questions
- Solana: Revoke Delegate
- MetaMask: How to Manage dApp Permissions
- Ethereum.org: Cryptocurrency Scam Help and Reporting
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
