Token approvals: the permission you gave in 2023 that can still drain you today
Every DeFi interaction asks for approval to move your tokens. Unlimited approvals to a contract that later gets exploited are the most common silent loss.
Updated 2026-10-05
Checklist · 3 steps
- Review approvals quarterly with a revoke tool and remove anything you do not actively use.
- Approve exact amounts, not unlimited, when the wallet offers the choice.
- Use a separate wallet for DeFi and never hold long-term savings in it.
When you swap on a decentralised exchange, you first approve its contract to spend your tokens. Most interfaces default to an unlimited approval so you are not asked again. That approval persists until you revoke it.
If that contract is later exploited, or was malicious to begin with, the attacker can call it to move your tokens without any further action from you. Several of the largest individual losses of 2025 were approvals granted years earlier.
⚿