Token approvals are permissions granted to a smart contract that let it move a specific token from your wallet without asking again, and they're required for nearly every swap or DeFi interaction. The problem is that most interfaces default to requesting unlimited approval to save gas on future transactions, which leaves a standing door open that an exploit or a compromised protocol can walk through without ever touching your private key.
Auditing and revoking dangerous approvals
Trusted tools like Revoke.cash or Etherscan's token approval tracker let you connect a wallet and see every active allowance it has granted across EVM chains including Ethereum, Arbitrum, Base, Polygon, and Optimism. From there, it's worth revoking anything tied to a dApp you no longer use, and especially anything still set to unlimited. Each revocation is its own on-chain transaction, so it costs a small amount of gas, but that cost is trivial next to the risk of leaving an old, forgotten approval sitting active on a wallet holding real value.
What to do after a suspected phishing signature
If you suspect you've signed a malicious transaction, speed matters more than thoroughness. The first move is to transfer whatever assets are still untouched, whether that's ETH, other tokens, or NFTs, to a freshly generated hardware wallet address that has never interacted with the compromised one. Only after the remaining funds are safe should you go back and revoke every allowance on the compromised address, since an attacker who still has an active approval can drain new deposits the moment they land.
Making revocation a habit, not a one-time fix
Wallet hygiene isn't something to do once after a scare and then forget about. Approvals accumulate quietly every time you try a new protocol, and a periodic review, every few months for an actively used wallet, catches the ones you've long since stopped needing before they become a liability.