To trade a token on almost any DeFi app, you first grant the app an approval — permission to move that token on your behalf. This is normal and necessary. The problem is that many approvals are written for an unlimited amount and never expire. Sign one on a malicious site and the attacker keeps a standing permission to empty that token whenever they choose.
Why unlimited approvals are dangerous
An unlimited approval means the contract can move your entire balance of that token, now or months later. Legitimate apps use it for convenience so you do not re-approve on every trade. Drainers use it because it survives long after you leave the site — the theft can happen days after you forgot the site existed.
Permit and Permit2: the silent version
Newer approvals use Permit and Permit2, which are gasless signatures. They do not appear as a transaction in your history, so victims often never see how the attacker gained access. A single off-chain signature can grant the same sweeping permission as an on-chain approval.
How to revoke approvals
- Use a reputable approval-checker to list every active approval on your address.
- Revoke anything you do not recognize, and anything unlimited on a site you no longer use.
- Prefer setting a specific amount instead of unlimited when an app lets you.
- Re-check periodically — approvals accumulate quietly over time.
Prevention beats revocation
Revoking cleans up after the fact. The better defense is to never sign a dangerous approval in the first place. A security layer that flags unlimited approvals and Permit signatures before you sign gives you the chance to reject the one request that would have cost you everything.