How to Check and Revoke Bridge Token Approvals Before You Get Drained
You approved a token once. That approval can drain your wallet years later.
Bridges need token approvals to move your assets, and most ask for "unlimited" approval. This saves you gas fees on every future transfer. It also means the bridge contract can spend your entire balance at any time. That is the time bomb.
Why bridges ask for infinite approval
Gas optimization. Every ERC-20 approval costs you a transaction. If a bridge capped approval at the exact amount you send, you would pay that fee each time. By requesting an unlimited approval, bridges let repeat users skip that step. The trade-off is extreme. If the bridge contract gets exploited, the attacker inherits that approval power and can drain every wallet that ever clicked "approve maximum."
Two incidents prove this is not theoretical.
Multichain. July 2023. An exploit of the bridge's MPC wallet let attackers withdraw assets from user approvals that had never been revoked. Nomad. August 2022. A faulty contract update meant anyone could copy the initial exploit transaction and drain approvals from thousands of wallets. Both were unlimited approval contracts. Both cleaned out users who had not revoked.
Check your approvals today
You have two reliable tools. Both are free.
Revoke.cash. Go to revoke.cash, connect your wallet, and the site scans for every token approval your address has made. It shows the spender contract, the token, and whether the approval is limited or unlimited. Revoke.cash does not charge for the scan. Revoking an approval costs a small Ethereum gas fee - currently around $5-15 depending on network congestion - and you pay this only when you click revoke.
Etherscan's Token Approval Checker. Paste your wallet address into Etherscan, then go to the "Token Approvals" tab under "More." Etherscan shows the same data with a slightly different interface and flags unlimited approvals in red. Both tools work for Ethereum mainnet and most EVM-compatible chains.
What to look for
Open a real approval transaction from a bridge. In Etherscan, find the "Input Data" section and look for the approve function. The "value" parameter will show either a specific number or a maximum uint256 value. A maximum uint256 value equals 2^256 - 1. That is roughly 10^77. No one legitimately needs that many tokens. It means "spend everything I ever hold of this token, forever." Screenshot that. Save it. That is the time bomb.
How to revoke
- Go to Revoke.cash.
- Connect your wallet. The scan runs automatically.
- Find any unlimited approvals to bridge contracts you no longer use.
- Click "Revoke" next to each.
- Confirm the transaction in your wallet and wait for confirmation.
Do this for every bridge you have touched in the past. Even bridges you think are safe. Even bridges that never got hacked. A contract upgrade or governance takeover can turn a perfectly safe approval into a drain vector overnight.
Which approvals to keep
Not all unlimited approvals are dangerous. You may actively use a bridge every week, and revoking would cost you gas fees on every future transfer. That is a reasonable trade-off - as long as you monitor the contract's security. For bridges you use regularly, set a calendar reminder and check Revoke.cash monthly. If you stop using that bridge for more than 60 days, revoke the approval. For bridges you used once two years ago? Revoke immediately. You are not saving gas. You are carrying risk with no benefit.
The pattern that matters
Approval exploits follow one script. Attacker compromises bridge contract or validator set. Attacker calls transferFrom on every unrevoked approval. Users watch their tokens leave their wallets with no way to stop it. No one warns you beforehand. No recovery exists. The only prevention is revocation before the exploit. Check your approvals today and revoke everything you do not actively need. It takes ten minutes, and that ten minutes is cheaper than losing your entire portfolio to a contract you approved twice and forgot.
Not financial advice. basedbratt.xyz publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.