Quick answer: Every time you list an NFT, mint from a new project, or connect to a marketplace, you typically grant that contract standing permission (an “approval”) to move your NFTs at any time, without asking again. That permission does not expire on its own; it sits on the blockchain until you actively revoke it, so a contract you interacted with once in 2023 may still be able to transfer your NFTs today. The risk shows up two ways: a legitimate contract gets compromised later and inherits every approval it was ever granted, or a phishing page tricks you into signing a fresh approval for an attacker’s contract. Free tools, Etherscan’s Token Approval Checker and Revoke.cash, let you review every permission your wallet has granted across chains and revoke the ones you no longer need, each revoke costing only network gas. Running this check every few months, and after minting from unfamiliar projects, is the single most useful piece of wallet hygiene most holders skip.
This is the single most useful piece of wallet hygiene most NFT holders have never done.
What a token approval actually is
Your NFTs live in a smart contract, not in your wallet. Your wallet just holds the key that proves you control them. So when you sell an NFT on a marketplace, the marketplace needs a way to hand that NFT to the buyer at the moment the sale completes, without waking you up to sign a transaction.
The mechanism that makes this work is called an approval. In the ERC-721 and ERC-1155 standards that NFTs are built on, the relevant function is setApprovalForAll. When you call it, you tell the blockchain that a specific contract address is allowed to transfer any NFT you own from a given collection, at any time, without asking you again.
That is a lot of trust to hand over, and it is why the first listing you make on a marketplace triggers an extra transaction that costs gas but does not seem to do anything visible. That transaction was the approval.
There is a narrower version, approve, which grants permission for one specific token ID. Marketplaces rarely use it, because collection-wide access is more convenient for them. Convenient for the marketplace also means broad for you.
Why old approvals turn into a problem
An approval has no expiry date. It stays live until one of two things happens: you revoke it, or the contract holding the permission is somehow disabled.
Think about how many contracts you have approved over the years. Every marketplace you tried once. Every mint site for a project that never shipped. Every NFT game you played for a weekend. Every airdrop claim page. Each one of those may still hold transfer rights over a collection in your wallet.
The risk is not that a legitimate marketplace suddenly turns on you. The risk comes in two other shapes.
The first is a contract that gets compromised or was malicious from the start. If a project’s contract has a vulnerability, or the deployer kept an admin function nobody noticed, an attacker who takes control of that contract inherits every approval users ever granted it. Nothing needs to happen on your end. You do not need to click anything or sign anything. The permission you granted months ago is enough.
The second is phishing that targets the approval itself. A fake mint page or a spoofed marketplace prompt asks you to sign what looks like a routine transaction. What you are actually signing is setApprovalForAll pointing at the attacker’s contract. Once you confirm, they drain the collection at their convenience. Our guide on how to spot a fake or scam NFT project covers the warning signs on the project side, but the approval prompt is the last checkpoint before the loss becomes permanent.
The OpenSea phishing case
In February 2022, a phishing campaign targeted OpenSea users during a scheduled smart contract migration. Users received emails telling them to migrate their listings, which led to a page that collected signatures on malicious orders. Reports at the time varied on the exact scale: some put it at 17 affected users and roughly $1.7 million in losses, others at around 32 users and closer to $2 million, with more than 250 NFTs moved, including Bored Ape Yacht Club and Mutant Ape tokens.
The detail worth keeping is not the dollar figure. It is that the victims were experienced users on a legitimate platform during a real migration event. The signature request looked plausible because a plausible reason to sign one existed that week. Attackers time approval phishing to moments when an unusual prompt seems normal.
How to check what your wallet has approved
Two tools do this well, and both are free to use.
Etherscan Token Approval Checker
Go to etherscan.io/tokenapprovalchecker, connect your wallet, and switch between the ERC-20, ERC-721, and ERC-1155 tabs. The ERC-721 and ERC-1155 tabs are the ones holding your NFT permissions. Etherscan shows each approved contract address alongside what it can access. Only the address owner can revoke, so connecting the wallet is required rather than just pasting an address. Other block explorers run the same tool for their chains, so the Optimism, Arbitrum, and Polygon explorers have their own versions.
Revoke.cash
This is a dedicated approval manager covering more than 100 networks, including Solana alongside the EVM chains. There is no account to create. You connect a wallet, or paste any address to view its approvals read-only, and it lists everything that address has authorized. It also flags approvals granted to contracts involved in known exploits, which is useful when you are looking at a list of 40 addresses and cannot tell which ones matter.
Revoke.cash is free, and you pay only the gas for each revoke transaction you send. The one exception is the batch revoke feature, which carries a small fee of about $1.50 to fund development, and is sponsored on some networks.
How to revoke
Revoking is an on-chain transaction. It changes state on the blockchain, so it costs gas, and the cost scales with network conditions the same way any other transaction does.
From either tool, the flow is the same. Find the approval you want to remove, click Revoke, and confirm the transaction in your wallet. Once it confirms, that contract can no longer move the assets it previously had rights over. If you want to use that marketplace again later, you will be prompted to grant a fresh approval, which costs gas again. That is the tradeoff, and for a marketplace you use weekly it is usually not worth revoking. For a mint site you visited once, it clearly is.
Gas costs are the reason to be strategic. On Ethereum mainnet during a busy period, revoking 20 approvals individually adds up. Prioritize by what is at stake: revoke anything holding rights over a collection you actually care about, and anything pointing at a contract you cannot identify. Batch revoking on Revoke.cash is cheaper than sending them one by one if you have a long list.
Signature requests that do not cost gas
Not every permission is an on-chain approval, and the newer pattern is worth understanding because approval checkers handle it differently.
Permit-style approvals, including Uniswap’s Permit2, work by having you grant one on-chain approval to a single universal contract. After that, individual authorizations happen as off-chain signed messages using the EIP-712 typed data format. Each message specifies a spender, an amount, a deadline, and a nonce. Nothing goes on-chain until the transfer itself, so these signatures cost no gas.
The design has a real benefit. Because each permit carries a deadline, authorizations expire on their own instead of sitting live indefinitely. That removes the dormant infinite allowance, which caused most historical approval losses.
It also creates a different exposure. A signature request is cheaper to trigger and harder to read than a transaction. Permit2 can grant approvals for multiple tokens at once, and the flexibility that makes it efficient also makes the prompt difficult to interpret. Phishing sites use exactly this to get users to sign something broader than they understood. A $1 million loss was reported in 2026 from a single Permit2 signature.
The practical rule: a signature request that costs no gas is not automatically safe. Read what the wallet is showing you, especially the spender address and the amount. If a site asks you to sign a message you did not initiate, close the tab.
A routine that keeps this manageable
Run an approval check every few months, and always after minting from a project you did not know well. It takes a few minutes.
Separate your wallets by purpose. Keep the NFTs you intend to hold in a wallet that never connects to mint sites, and use a second wallet with a small amount of ETH for minting, claiming, and experimenting. If a burner wallet grants a bad approval, the blast radius is whatever was in that wallet. This is the same logic behind moving significant holdings to a hardware device, which our hardware vs. software wallets guide works through in more detail.
Revoke approvals from any project that went quiet. An abandoned project still has a deployed contract, and an abandoned contract is one nobody is watching or maintaining.
Read the prompt before confirming. Your wallet tells you which contract you are authorizing and what it will be able to do. The moment before you click confirm is the last point at which the decision is still yours, and it is the same discipline that protects your recovery phrase. Our guide on protecting your seed phrase from common scams covers the other half of the same problem.
Common questions
Does revoking an approval move or affect my NFTs? No. Revoking only removes a permission. Your NFTs stay exactly where they are, in the same wallet, unchanged.
Can I revoke an approval if my wallet was already drained? You can, and you should, but it will not recover anything already taken. Revoking prevents future transfers under that permission. If a wallet’s recovery phrase itself was exposed, revoking does not help at all, because the attacker holds the keys rather than an approval. In that case, move the remaining assets to a new wallet.
Is there a way to set approvals that expire automatically? With standard ERC-721 approvals, no. Permit-style approvals do carry deadlines, but adoption for NFT marketplaces is not universal, so most of your existing NFT approvals are the indefinite kind.
Do I need to do this on every chain separately? Yes. Approvals are per-chain and per-contract. An approval on Ethereum has no effect on Polygon, and revoking on one chain does nothing on the other. Revoke.cash lets you switch networks in the same interface.