Sign inRegister

Token approvals: the permission you forgot about

Old wallets can hold value worth finding and permissions worth closing. A token approval granted in 2024 was used to drain wallets in September 2026. Here's what your address history shows, what it quietly still allows, and how to check and revoke the token approvals you left open.

An open brass padlock with its shackle unlatched, against a black background
Photo: didgeman / Pixabay

Why old wallet history is worth a look

Old addresses aren't always empty. A contract analysis by DNZN, dated 19 March 2026, found approximately 12.57 million UNI (about 8.4% of the allocation) still unclaimed in Uniswap's original 2020 airdrop contract, with claims still arriving as recently as 17 March 2026. Across the 50 biggest airdrops, CoinGecko puts combined value at $26.6 billion, measured at each token's all-time-high price rather than what recipients took home (ranking as of 21 December 2023).

That's why people go back through old wallets. But the same history that can show forgotten tokens also holds forgotten permissions, and those are what attackers look for.

The problem: an approval two years after anyone last used it

In 2024, Magic Eden used Limit Break's Payment Processor protocol to settle trades on its EVM marketplace. Revoke.cash explains that "many users approved it to move their NFTs and tokens like WETH." Magic Eden stopped using the protocol in October 2024, "but those approvals stayed active."

On 24 September 2026, attackers began abusing a flaw that let them act on behalf of any wallet that had approved the protocol. According to Revoke.cash, they took NFTs for free and drained approved tokens. Its incident page puts the thefts at "at least $2.8M" across Ethereum, Polygon, Base, Arbitrum and ApeChain, "and thefts were still ongoing when this was written" (figure unchanged when re-checked on 2 October 2026). A whitehat effort led by Yuga Labs' 0xQuit used the same flaw to move exposed NFTs to safety. According to Decrypt, reporting on 25 September 2026, he put the count at 23,155 NFTs worth more than $5.7 million, and says 660 WETH couldn't be recovered. Both are 0xQuit's own figures. The Crypto Times, also reporting on 25 September 2026, noted they were unaudited at the time and that security monitors had published different numbers for different phases of the incident.

One detail explains the whole case. Revoke.cash writes: "Cancelling your listings does not protect you, because the attack only needs the approval."

KEY FIGURE
23,155 NFTs moved to safety by whitehats, and 660 WETH not recovered, per 0xQuit via Decrypt, 25 September 2026.

Timeline from approvals granted in 2024 to the September 2026 exploit and whitehat rescue
Chart: the Magic Eden / Limit Break approval timeline. Sources: Revoke.cash (incident 24 Sep 2026); Decrypt (25 Sep 2026). Chart built by PoolIndex from the cited data.

Finding 1: Your history is public, and so are your permissions

Every transaction an address has sent is public and permanent. It shows which apps you used, which tokens you held and when you were active. Less obvious is that your history also contains standing permissions. When you approve a contract to spend a token, that approval is recorded on-chain and stays in force after you close the tab. Revoke.cash puts it directly: "if you don't revoke them, the approvals stay active indefinitely." It also warns that when established projects are hacked, users "may be vulnerable even years after [they] last interacted with the project." Primer: what is a token approval?

The Magic Eden case follows that pattern exactly. The marketplace had moved on and the listings were gone, but the permission remained.

PULL QUOTE
"If you don't revoke them, the approvals stay active indefinitely." (Revoke.cash)

Finding 2: The biggest wallet drainer cases ran on permissions, not transfers

Scam Sniffer's 2025 report (3 January 2026) broke down the 11 wallet-drainer cases of $1 million or more by signature type. Permit / Permit2 signatures accounted for $8.72M across 3 cases. Approve / increaseApproval accounted for $5.62M across 3 cases, and setApprovalForAll, the "all NFTs in this collection" permission, for $1.23M in one case. Scam Sniffer's headline finding: "Permit remained primary; EIP-7702 malicious signatures emerged after the Pectra upgrade."

Bars showing losses by signature type: Permit $8.72M, Approve $5.62M, Transfer $4.87M, EIP-7702 $2.54M and setApprovalForAll $1.23M
Chart: signature types in 2025's largest drainer cases. Source: Scam Sniffer, 3 Jan 2026. Chart built by PoolIndex from the cited data.

For a wallet owner, this means the dangerous moment often isn't sending funds. It's signing a permission that lets someone else send them later.

Finding 3: The average cost of one bad signature

Scam Sniffer puts the average wallet-drainer loss per victim at $910 in 2023, $1,488 in 2024 and $790 in 2025. Total 2025 losses were $83.85 million across 106,106 victims, a figure it describes as a lower bound.

Bars showing average drainer losses of $910, $1,488 and $790 per victim in 2023, 2024 and 2025
Chart: average drainer loss per victim. Source: Scam Sniffer, 3 Jan 2026. Chart built by PoolIndex from the cited data.
An old rusty padlock hanging open on a metal hasp
Photo: pixelcreatures / Pixabay

What your address history can tell you

A read-only look at your own address, using only the public address, answers useful questions:

How to check and revoke token approvals

1. Open a token approval checker using only your address

Both Revoke.cash and Etherscan's Token Approvals page let you enter an address and see allowances without connecting. Revoke.cash's own guide says you "can enter your wallet address ... in the search bar or connect your wallet." Etherscan's page is under the "More" menu. Check each chain you've used, because approvals are per network. Walkthrough: the Etherscan token approval checker.

2. Look for unlimited token approvals and unknown spenders

Look for four things: unlimited allowances, spenders you don't recognize, protocols you no longer use, and setApprovalForAll grants on NFT collections (one setApprovalForAll covers every NFT you hold in that collection).

3. Revoke token approvals you don't need

A revoke is an on-chain transaction, so it costs gas and needs your wallet. Do it only from a tool you reached by typing its address yourself. Revoke.cash notes that you can also reduce an allowance instead of removing it.

4. Know what revoking does and doesn't do

Revoke.cash, on the Magic Eden case: "Revoking protects what is still in your wallet, but it does not recover assets that were already taken."

5. Cancelling a listing isn't revoking

As the Magic Eden case showed, cancelling listings or disconnecting a site doesn't remove an on-chain approval.

6. Make it a habit

Review approvals after big DeFi or NFT sessions, and before an old wallet becomes active again.

Diagram of a SPEND key handed to a contract that stays in its lock from 2024 to 2026, with a red hazard triangle
Diagram: built by PoolIndex in code.

DON'T
Never enter a seed phrase to "check approvals." No checker needs it. Don't follow "revoke now" links from DMs or replies. Fake revoke pages are a known lure.

Where PoolIndex fits

Disclosure: PoolIndex publishes this guide.

PoolIndex isn't an approval manager. For approvals, use an approval checker as described above. PoolIndex is a research tool for Windows and Android for the claims side of an address's history (see how to check a wallet address without connecting it). You paste a public 0x address and it searches dozens of trusted public sources. Each result shows the network and how it was checked, and airdrop results link to their official source. Sources that fail are shown as failed, not quietly dropped or turned into a "no." You can also research a claim URL and see what was found on that link, with the evidence and source for each finding. It can't promise there's anything to find.

PoolIndex checks using your public wallet address only, the same address anyone can already see on the blockchain. It never asks for your seed phrase or private key, so it has nothing that could move your funds.

See how PoolIndex works. Get it from the Microsoft Store (Windows) or on Google Play (Android). Free after you register: check 1 wallet and 5 links a month. Windows and Android.

FAQ

What is a token approval?
An on-chain permission that lets a contract move a specific token from your wallet, up to an allowance, without asking you again each time.

How do I check my token approvals?
Enter your address in a token approval checker such as Revoke.cash or Etherscan's Token Approvals page. You don't need to connect a wallet to view them. Check each network you've used, because approvals are per chain.

How do I revoke token approvals?
In the approval checker, select the allowance and revoke it. A revoke is an on-chain transaction, so you connect your wallet and pay gas. Reach the tool by typing its address yourself, never from a DM or reply.

Do token approvals expire?
Revoke.cash says that if you don't revoke them, "the approvals stay active indefinitely."

Are unlimited token approvals safe?
They let the approved contract move any amount of that token. If that contract is later exploited, as in the Magic Eden / Limit Break case, the whole approved balance is exposed. Reduce or revoke allowances you no longer need.

Does disconnecting my wallet revoke approvals?
No. Disconnecting a site only stops it from seeing your address. The on-chain approval stays until you revoke it.

If I revoke an approval, do I get stolen tokens back?
No. Revoking prevents future use of that permission only.

Does cancelling an NFT listing remove the approval?
No. In the Magic Eden case, Revoke.cash warned that cancelling listings "does not protect you."

What is setApprovalForAll?
An NFT permission that lets an operator move every NFT you hold in a collection. In Scam Sniffer's 2025 data, one setApprovalForAll case alone cost $1.23M.

Sources