Wallet Approval Scams and Dangerous Permissions

Approval scams are dangerous because they do not always steal money immediately.

Sometimes the attacker gets permission first, then drains tokens later when you stop paying attention. That is why so many victims say, "I did not send anything" even though the wallet was still emptied.

This guide is the practical follow-up to our broader common crypto scams guide. The question here is narrower: what exactly did you approve, what can still be revoked, and when is revoking not enough?

Short answer

What an approval scam actually does

A lot of users think the only dangerous action is pressing Send.

On EVM chains, many dapps ask for a separate permission first. You may approve a token allowance, NFT permission, permit signature, or other contract access that lets a spender move assets later. That approval can be legitimate for a real swap or marketplace, but the exact same mechanism is what malicious sites abuse.

The common pattern looks like this:

• a fake airdrop, mint, claim, bridge, or support page asks you to connect a wallet;
• the wallet prompt looks technical enough that you click through it;
• the site gets permission to spend a token or manage an NFT;
• the draining transaction happens later, sometimes after you think nothing happened.

That is why approval scams overlap with blind signing, dusting attacks, and fake wallet-drainer pages. The core mistake is the same: approving an action you did not fully verify.

Disconnecting a dapp vs revoking an approval

This distinction matters.

Trezor and Coinbase both separate the two ideas:

• Disconnecting a dapp usually stops the app from seeing your connected wallet session, public address, or balances through that connection.
• Revoking an approval removes or reduces the onchain permission that lets a contract spend tokens or control NFTs.

If you only disconnect, the approval can still remain live onchain.

That is why the safer cleanup order after a suspicious interaction is:

1. disconnect the dapp or session;
2. review token and NFT approvals on the affected network;
3. revoke anything you do not recognize, no longer need, or granted to the wrong site;
4. reassess whether the wallet should still be trusted for storage.

When revoking helps, and when it does not

Revoking helps when the problem is an onchain permission that you granted from the wallet.

Examples:

• unlimited token allowance to a fake swap page;
• an NFT approval you no longer trust;
• an old permission you forgot about from a dapp you no longer use.

Revoking is not a complete fix when:

• you typed your seed phrase into a site or app;
• you gave away a private key;
• the attacker already transferred assets out;
• you signed something that changed wallet ownership or broader account permissions outside a normal token allowance;
• the same wallet keeps interacting with new malicious prompts while you are troubleshooting.

If the recovery phrase was exposed, skip the debate and move funds to a new wallet you create yourself. For that workflow, read seed phrase exposed? what to do.

Practical signs an approval is dangerous

Pause immediately if you see any of these:

• the dapp asks for unlimited token access when the amount could have been smaller;
• the prompt appears after clicking a token name, memo link, fake NFT, or social-message link;
• the site URL is slightly different from the real project;
• the wallet shows raw contract data you do not understand;
• the site says you must approve first to "recover," "verify," or "unlock" funds;
• the approval is coming from your main storage wallet instead of a smaller activity wallet.

If the request is not clear, reject it. A missed opportunity is cheaper than a drained wallet.

How to review and revoke approvals safely

Official wallet support docs all point to the same basic rule: use a trusted interface, confirm the network, and understand that a revoke is a real blockchain transaction.

1. Start with the wallet or tool you trust most

• Coinbase Wallet supports reviewing connected dapps and token approvals from its settings menu.
• Ledger documents revocation through Ledger's Discover integration with revoke.cash and through explorer-based approval checkers for Ethereum.
• Trezor points users to review and revoke allowances with trusted third-party tools because many smart-contract interactions happen through MetaMask or other companion apps.

If a wallet has a built-in approvals screen, use that first. If it does not, use a well-known explorer approval checker or a trusted revoke tool referenced by official wallet support.

2. Check the correct network

Approvals are chain-specific.

A permission on Ethereum is different from one on Base, Arbitrum, BNB Smart Chain, Polygon, or another EVM network. Review the exact network where you connected the wallet.

3. Look for the spender, asset, and scope

Before revoking, identify:

• which token or NFT the approval covers;
• which contract or spender received access;
• whether the allowance is limited or effectively unlimited;
• whether you still intentionally use that dapp.

If you do not recognize the spender, that alone is a good reason to slow down.

4. Expect a gas fee

Revoking is not a free button press.

Coinbase, Ledger, and other wallet flows treat it as an onchain transaction, which means you usually need a small amount of the network's native asset for gas. If you cannot revoke because the wallet has no gas coin left, fund the wallet carefully enough to complete the cleanup or move the remaining assets with extra caution.

5. Confirm the revoke transaction like any other transaction

Ledger's official guidance notes that when revoking token access, the amount shown on the device should be 0. More broadly, the point is simple: do not rush the cleanup and sign another unclear transaction while trying to fix the first one.

What to do right after a suspicious approval

If you think you approved something bad but the wallet is not drained yet, use this order:

1. Stop connecting that wallet to more sites.
2. Disconnect the dapp session where possible.
3. Review token and NFT approvals on the affected network.
4. Revoke suspicious or unnecessary permissions.
5. Check recent transactions and balances for assets that may already have moved.
6. Move meaningful long-term holdings to a cleaner wallet if the same wallet was used casually with random dapps.
7. Change your habits, not just the setting. The next bad approval usually comes from the same rushed workflow.

The safer wallet setup for people who use dapps

The best defense is structural, not heroic.

Keep different jobs in different wallets:

• a long-term storage wallet that rarely connects anywhere;
• a smaller activity wallet for swaps, mints, bridges, and experiments.

That is where Tangem, Ledger, and Trezor fit naturally as storage-oriented wallets. They do not make malicious approvals impossible, but they make it easier to keep serious holdings separate from everyday experimentation. If you are still choosing that storage setup, start with best hardware wallet for beginners, Tangem vs Ledger, and blind signing on hardware wallets.

Bottom line

Approval scams are dangerous because the theft can happen after the moment you stop paying attention.

If you signed something suspicious, disconnect first, review approvals on the correct network, and revoke anything you do not trust. But remember the bigger rule: revoking fixes onchain permissions, not a leaked seed phrase and not the habit of using your main wallet as a test wallet.