How token approval revocation works—and what it cannot fix

The short answer

Revoking a token allowance removes a contract's permission to spend that token under that allowance. It does not undo a previous transfer, revoke every kind of permission or secure a wallet whose private keys are exposed.

Understand what you originally authorised

Many smart-contract applications need permission to spend a token before performing a swap or another action. An allowance can be limited to a particular amount or be very large. The permission can remain after you leave the website.

The contract receiving permission is commonly called the spender. Its address may not be the same as the website domain or the address that eventually receives stolen tokens. Record the token, spender and network instead of relying on a familiar-looking label.

Disconnecting and revoking do different jobs

Disconnecting a site can stop it from seeing the connected account through that connection or initiating new requests in the same way. It does not, by itself, change an allowance recorded on-chain.

Revocation changes the relevant permission through the network. Follow instructions for your specific wallet and chain. Do not assume an Ethereum-oriented tool covers approvals on every other network, or that fungible-token allowances cover all NFT and delegated permissions.

Reach the tool independently

Start from official wallet documentation, not a direct message telling you to perform an urgent security update. Fraudulent revocation websites can ask you to sign the very permission they claim to remove.

Check the domain, network, token and spender before signing. Read the wallet prompt carefully. You should never need to type recovery words into a revocation website. If the requested action is unclear, reject it and consult the wallet's official support materials.

Understand fees and confirmation

Revocation generally requires an on-chain transaction and the network's fee asset. The cost depends on the network and conditions. A fee is paid for the transaction; it is not a recovery payment to a support agent.

After confirmation, check the permission again using a trusted interface. A rejected or failed transaction may not have changed anything. Revoking one allowance does not necessarily remove other approvals for different tokens, contracts or networks.

Know when revocation is not enough

If the recovery phrase or private key is compromised, an attacker can sign new permissions or transfers. Revocation does not remove that ability. A genuinely new wallet with new keys on a clean device is a different security step.

Nor can revocation recall funds that already left. Preserve the relevant transaction IDs, report the theft and assess remaining permissions without accepting an offer to 'reverse the allowance history' for a fee.

Checklist

• Use official wallet documentation to find a trusted tool.
• Verify chain, token and spender.
• Reject requests for recovery words.
• Confirm the revocation and review other relevant permissions.

Common questions

Should every approval be revoked?

Review permissions you no longer need or do not trust. Costs and permission types vary, so follow wallet-specific guidance rather than blindly signing a batch.

Will revoking an approval refund stolen tokens?

No. It can restrict future spending under that permission, not undo earlier transfers.

Sources

• MetaMask Help Center — How to revoke smart contract allowances/token approvals
• Federal Trade Commission — What To Know About Cryptocurrency and Scams

Related guides

• Wallet drained? What to do before you reconnect
• Seed phrase compromised: why changing your password is not enough
• Liquidity mining scams: when a promised yield becomes wallet access