Unlimited token approval phishing and how to check what you signed
A wallet prompt asks you to sign. You glance at it. You click confirm. That single action can hand over every token you own - now, next week, next year. The attacker never needs your private key. They only need an unlimited approval.
What the prompt actually says
When a dApp asks for token permission, the prompt shows a spend limit. The critical difference is whether that limit is a specific number or the word "unlimited."
Capped approval - The prompt reads something like "Allow this dApp to spend up to 100 USDC." The number is fixed. The contract can only move that amount. To spend more, the dApp must ask again. This is the safe default.
Unlimited approval - The prompt says "Allow this dApp to spend an unlimited amount of USDC." Sometimes the wallet displays the maximum possible value - a number like 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,935. That is not a bug. That is the contract code asking for the entire balance now and forever.
Phishing sites rely on you not reading the prompt. The text is small. The "unlimited" label is easy to miss. A fake front end may even pre-approve the transaction in the background so you only see a generic "confirm" button. The scam works because the approval never expires.
How to check what you already approved
If you have connected your wallet to any dApp in the past, you may already hold active approvals you forgot about. Two free tools let you audit them.
Etherscan token approval checker - Paste your wallet address into Etherscan. Click the "Token Approvals" tab. The page lists every token you have approved, the spender address, and the remaining allowance. If the allowance shows "Unlimited" or a number that matches the token's total supply, that approval is dangerous.
Revoke.cash - This site scans the same data across multiple chains. It shows the same information in a cleaner interface. The site does not require you to connect your wallet to view approvals. You only need your address. It works on Ethereum, BSC, Polygon, Arbitrum, and several other EVM chains.
Both tools show you what you signed. Neither can undo a theft that already happened.
The common misunderstanding about revoking
Many people believe revoking an approval will return tokens that were already taken. It will not.
A revoke transaction only cancels future permission. If an attacker drained your wallet an hour ago, revoking does nothing to that loss. The tokens are gone. The transaction that moved them is already confirmed. Revoking only stops the attacker from draining any remaining balance you still hold.
Think of it like cancelling a credit card after the thief already used it. The fraud happened. The cancellation prevents more fraud. It does not reverse the charge.
When to revoke
Revoke any unlimited approval immediately. Do it even if you trust the dApp. A trusted dApp can be exploited tomorrow. An unlimited approval on a compromised contract gives the attacker a direct path to your wallet.
Revoke approvals on dApps you no longer use. Every old approval is an open door you forgot to lock.
Revoke after you finish using a dApp, even if you used a capped approval. The safest approval is no approval at all.
One step further
A growing number of wallets now warn you before signing an unlimited approval. MetaMask, Rabby, and Safe have added alerts that flag the "unlimited" label. These warnings are useful. They are not foolproof. A phishing site can still trick you into ignoring the warning.
The only reliable protection is reading the prompt every time. Every time. If you do not understand what you are signing, do not sign it. Close the tab. Open Etherscan. Check the contract code. Ask someone you trust. The transaction will still be there when you are certain.
Unlimited approvals are a feature of the ERC-20 standard. They were designed for convenience. Phishers weaponised that convenience. The prompt is the only place where the difference is visible. If you never look, you cannot tell the difference between a legitimate transaction and a handover of everything you own.
Not financial advice. rabbitechnology.xyz publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.