Revoke.cash Review: What the Free Plan Does and What Premium Adds

You connected your wallet to that swap protocol eight months ago. One pop-up, one click, one small permission you didn’t read closely. You moved on. The protocol you’ve since forgotten — maybe it’s shut down, maybe you couldn’t name it now if pressed. But right now, tonight, that contract still holds a signed authorisation to move your tokens. No further click from you required. Your keys are untouched. Your seed phrase is safe. The open door is somewhere else entirely. To keep the underlying keys completely offline, an air-gapped wallet like Keystone signs transactions without your seed ever touching a connected device — but that’s a different layer of the same problem.

This revoke.cash review covers what the tool actually does, where it stops, and why a ten-minute Friday habit is the cheapest meaningful defence available in DeFi.

The short version: Revoke.cash is a token-approval manager for EVM wallets. It lists the standing permissions your wallet has given to contracts and lets you cancel the ones you no longer need. The free plan works on 100+ networks, one chain at a time, and charges $1.50 per batch revoke. Paid plans ($99 and $199 a year) add a multichain dashboard, fee-free batching and, at the top tier, automated revoking. It never holds your keys: you sign every revoke yourself. The risk signal it addresses is the “infinite approval”, a permission you sign once that lets a contract move a token from your wallet indefinitely. The fix is a ten-minute weekly habit: scan, review, revoke what is dead.

Why token approvals are a silent security hole

Here is the trap nearly every crypto user walks into. When you swap a token or interact with a DeFi protocol, the app needs permission to move your funds. Rather than asking each time, most apps request an infinite approval — set to MAX_INT in the code, which translates to: “this contract may move this token from my wallet, for ever, no further confirmation needed.”

You sign it once. You close the tab. The signature does not expire when you forget the protocol exists.

That is the reframe: most DeFi drain victims aren’t people whose keys were stolen — they’re people who signed a permission and forgot it was still live. Your seed phrase being secure protects the front door. An infinite approval is a side window left open, and an attacker who later compromises that protocol can climb through it — long after your last visit, while your keys sit perfectly safe and perfectly irrelevant to the misuse.

Not every dangerous approval starts with a legitimate protocol that gets compromised later, either. Sometimes the contract is malicious from the very first signature — fake airdrops, “connect to claim” pages designed to drain your wallet the moment you approve them. WildWildCrypto’s token approval revocation guide walks through that “blank check” version of the same mechanic and how wallet drainers use it to sweep a wallet immediately after you sign.

What infinite approvals actually cost: the documented risk

The danger isn’t hypothetical, and it doesn’t require you to do anything wrong after the initial signature. Front-end compromises and protocol abuses in DeFi have repeatedly drained wallets that held active approvals to the affected contract — including wallets whose owners hadn’t interacted with the protocol in months. The mechanism is consistent: the misuse doesn’t need your keys, it needs your standing allowance.

The defensive logic is simple exposure-time maths. An approval you revoked last week cannot be exploited this week — there is no live permission left to abuse. An approval you left open for a year is a year-long window of risk you gained nothing from keeping open. You can’t predict which protocol gets hit or when. You can shrink how many open allowances you’re carrying when one does. That’s the entire value proposition, and it’s why this is a routine and not a reaction.

By the time a protocol is exploited, the window to act has already closed. The revoke habit works precisely because you run it before anything goes wrong.

How ERC-20 approvals actually work

Understanding the architecture makes the fix obvious. Under the ERC-20 token standard, your wallet tracks two separate numbers for every token you touch:

• Balance — how much of that token you own.
• Allowance — how much of that token a given smart contract is permitted to spend without asking you again.

When you approve a transaction in MetaMask or another wallet, you’re setting that allowance. Most apps set it to MAX_INT — effectively infinity. Revoke.cash reads your wallet’s approval history on the chain you select and shows you every contract currently holding an allowance against you.

Some permissions are on-chain allowances, which cost gas to set and gas to cancel. Others are off-chain permit signatures, which cost nothing to sign and are a separate risk. Do not assume any single checker covers both, and check what a tool says it covers before relying on it.

How Revoke.cash works: the three-phase process

Phase 1: the scan

Connect your wallet — ideally your hardware wallet, or MetaMask — and pick a network. Revoke.cash supports Ethereum and most major EVM chains; on the free plan you scan one chain at a time, so a wallet used on several chains means several scans. Each scan returns the active approvals on that chain.

Phase 2: the triage

You don’t revoke blindly. Scan the list for protocols you still actively use — if you have an open loan on Aave, that approval is doing real work and stays. Dead projects, one-time swaps, impersonation scam spam tokens that tried to bait you into approving them — these get marked for removal.

Phase 3: the execution

Each revoke is an on-chain transaction that resets that contract’s allowance to zero. Once your wallet shows “confirmed”, that contract cannot move the token again without a fresh signature from you. The permission is gone, not paused. Revoke.cash also offers batch revoking, which lets you queue several in one flow: $1.50 per batch on the free plan, no fee on Premium or Ultimate.

The weekly hardening ritual: your sovereign perimeter checklist

Sovereignty here isn’t paranoia — it’s a boring, repeatable routine that takes ten minutes:

• The Friday revoke. Set a recurring reminder. Any approval older than a week that you don’t actively need is a liability with no upside. Build the habit so you run it before you need to.
• Edit the permission before you sign. When an app requests approval, look for the “edit permission” option and change the allowance from unlimited to the exact amount you’re transacting — 100 USDC, not infinity. Close the window before it opens.
• Isolate your wallets. Keep long-term holdings in a wallet that never signs an approval to anything. Use a separate burner wallet for active DeFi. If the burner is ever compromised, you lose only what’s in it — your core holdings stay untouched.
• Consider the browser extension. Revoke.cash publishes one (launched 2022, rebuilt in March 2026). Check its current feature list on revoke.cash before relying on it for warnings at signing time.

Revoke.cash pricing: free vs Premium vs Ultimate

Checked against revoke.cash/premium and revoke.cash/about on 30 September 2026. Prices are USD and can change.

Paid plans are a one-time payment for a year in USDC or USDT, with no auto-renew. If a subscription lapses, the multichain dashboard and tools become unavailable until you renew. Block explorers such as Etherscan also offer their own token-approval checkers; we have not compared their current features, so this review does not rank them against Revoke.cash.

Choose the free plan if your wallets live on one or two chains and you revoke occasionally. Choose Premium if you hold approvals across many chains or several wallets and want one dashboard with no batch fee. Consider Ultimate only if you use a wallet that supports the ERC-7715 standard, such as MetaMask: hardware wallets (Ledger, Trezor) are not supported for automated revoking.

What Revoke.cash does not do — and who it’s the wrong choice for

This is the section most reviews skip, which is exactly why it’s the most useful one here.

It does not protect you from signing a bad approval in the first place. The browser extension may help at signing time, but Revoke.cash is fundamentally a cleanup tool. If you connect to a malicious site and approve a drainer contract, the damage happens in that moment. The weekly habit catches the next one, not the current one.

It cannot reverse a drain that’s already happened. Revoking removes future access but cannot undo a transaction already confirmed on-chain. If you spot a suspicious approval after funds have moved, the revoke closes the door — but it does not recover what’s gone. Act before the misuse, not after.

It does not protect your keys. If your private key or seed phrase is already compromised, revoking approvals achieves nothing. An attacker with key access doesn’t need a standing allowance — they can move funds directly. Revoke.cash addresses the approval layer only. Seed security is a different problem requiring a different solution: hardware wallet, air-gapped signing.

It is the wrong tool if you hold no DeFi positions. If your wallet only holds assets and has never signed an approval to any protocol, there is nothing to revoke. This tool is specifically for wallets that have interacted with DeFi protocols, decentralised exchanges, or any application that requested a token approval.

It does not make revoking free of gas. Every revoke is an on-chain transaction, so you pay the network fee for that chain on top of any Revoke.cash batch fee. The fee varies by chain and by time, so read your wallet’s estimate before confirming.

Automated revoking is best-effort, not a guarantee. Revoke.cash describes automated revoking as best-effort and does not guarantee it will prevent a loss. Automated revoking works on 10 supported networks and with wallets that support ERC-7715; it does not work with Ledger or Trezor accounts.

Use only the official site — no shortcuts

Scammers have built fake “revoke” sites designed to trick you into approving malicious contracts, betting you’ll rush and not check the URL. Only ever use the official domain: revoke.cash — never a look-alike domain. Bookmark it the first time and navigate only from that bookmark afterward. Treat it exactly like a bank login — your standard for the URL bar should be identical.

Decision rule: when to act and what to prioritise

Not every approval carries the same risk. Here is how to triage, ordered by protection gained per effort:

1. If you have never checked your approvals before — run a full scan today on every chain you’ve ever used. The list can be longer than expected.
2. If you hold meaningful value in a DeFi wallet — revoke everything you don’t actively use, starting with protocols you haven’t visited in more than 30 days.
3. If you see an approval to an unknown or suspicious contract — revoke it immediately, regardless of gas cost. Unknown approvals are the highest-risk category.
4. If you have an active loan or deposit (for example on Aave) — revoking will not remove funds already deposited, but you will need to approve again before your next deposit or repayment. Leave a protocol alone until you have finished with it.
5. If you’re about to sign a new approval — edit the allowance to the exact transaction amount before confirming. Prevent the open window rather than cleaning it up afterward.

Frequently asked questions about Revoke.cash

Will revoking an approval break an active loan or position?

Revoking does not remove funds already deposited in a protocol. It does mean you will need to approve again before your next deposit or repayment there. Triage first: revoke approvals for protocols you no longer use, and leave the ones you are actively using until you have finished.

Does Revoke.cash have access to my private keys or seed phrase?

No. It never holds your keys or seed phrase. Every revoke is a transaction you review and sign in your own wallet, so check the recipient and the allowance change in the wallet prompt before you confirm.

How often should I actually run it?

Weekly is the sensible standard if you’re active in DeFi — pick a fixed day so it becomes habit rather than an afterthought. If you only touch DeFi occasionally, monthly is defensible. The principle is constant: the longer an unused approval stays open, the longer your exposure window. Pick a cadence and stick to it.

What if a revoke transaction costs too much gas?

Revoke the highest-risk approvals first (unknown contracts, protocols you have abandoned) and leave low-risk ones for a cheaper moment. Gas varies by chain and time, so check your wallet’s fee estimate. On the free plan, batching costs $1.50 per batch on top of gas; Premium removes that fee.

Can I revoke an approval for a token I no longer hold?

Yes. Approval and balance are independent on-chain records. You can reset a contract’s permission to spend USDC even with a zero USDC balance — it clears the historical permission so a future deposit isn’t exposed to a contract you’d forgotten about.

Revoke.cash and your broader custody stack

This protocol slots into the rest of a sovereign setup: sign approvals with a hardware wallet (Ledger, Trezor) rather than a hot wallet, and route transactions through a VPN or your own node to avoid leaking your IP alongside your on-chain activity. The same discipline that makes revoking worth doing is the same one behind hardware roots of trust like the Purism Librem Key and capital-side moves such as Flash Loans 101. For the identity layer of sovereignty, Global Citizen Solutions sits in the same frame.

You started reading because of that small cold feeling — the half-memory of a permission you signed and never thought about again. That instinct was right, and it’s also the entire fix. Ten minutes on a Friday, a list reviewed, the dead doors closed. It’s boring on purpose. The people who lose everything in the next big misuse won’t be the ones whose keys were cracked — they’ll be the ones who left the windows open. You don’t have to be one of them. Clear the deck. Own the perimeter.

Where to get it: Proton — encrypted email, VPN and drive. Affiliate link — The Unhacked may earn a small commission at no cost to you; our verdict isn’t for sale.

Where to get it: Onboard wallet. Affiliate link — The Unhacked may earn a small commission at no cost to you; our verdict isn’t for sale.