Emergency guide

Check and revoke wallet approvals

A prompt to “increase your spending cap” moves no money when you sign it. What it does is hand a contract standing permission to take your tokens later, without asking again — months later, if it likes. This is how to check what holds that permission, and how to shut it off. Ten minutes, and you do not need to be technical.

How do I revoke token approvals after a crypto scam?

First work out which problem you have. Send a pound or two of the network’s own coin to your wallet and watch it. If it vanishes within seconds without you doing anything, your recovery phrase is compromised and revoking will not help. If it stays put, this is an approval problem and you can fix it yourself in a few minutes.

Go to the block explorer’s own approval checker for each chain you used — bscscan.com, etherscan.io, basescan.org, arbiscan.io and so on — enter your wallet address, and revoke anything you do not recognise. Approvals are per chain: one on BNB Smart Chain is invisible from Ethereum, so check every chain separately. Each revocation is an ordinary transaction and costs a small amount of gas.

Type the address yourself or use a bookmark. Fake revoke sites are registered within hours of an incident and pushed into search results and into replies under genuine warnings. Never arrive at a wallet tool from a message, a reply or a video description, and never click a sponsored result. No legitimate tool ever asks for your recovery phrase, or asks you to “verify”, “validate” or “migrate” a wallet.

Read this before you do anything else.

Revoking does not get back money that has already gone. Nothing does. Anyone who contacts you offering to recover it — especially if they found you after you posted about the loss — is almost certainly running the second half of the same scam.

What revoking does is stop the next withdrawal. That is still worth ten minutes.

If you are here from the Aurum / NEYRO alert

You can skip the diagnosis — this one is already established. Aurum and NEYRO drained wallets through an approval, not a stolen recovery phrase. The “airdrop season 2” claim asked you to reconnect, which triggered a MetaMask increase spending cap prompt. Signing it moved no money at the time — it handed the operator’s contract standing permission to pull your USDT and USDC out later, without asking again.

Affected chains: BNB Smart Chain, Ethereum, Base and Arbitrum. Your recovery phrase is not the problem, so go straight to checking and revoking — and do it on every one of those chains you used.

Read the full drainer report, with the decoded contract and the collector addresses →

Step one

First work out which problem you have

Skip this if you know which one you are dealing with — Aurum and NEYRO, for instance, were approval traps and nothing more. Otherwise, start here: the two problems need opposite responses, and getting it the wrong way round wastes the small amount of gas money you may have left. There is a simple test.

The test.
Send a very small amount of the network’s own coin to your wallet — a pound or two of BNB, ETH or TRX. Then watch it.

If it disappears within seconds, without you doing anything, someone has your recovery phrase. Stop. Send nothing else to that wallet.
If it stays put, your recovery phrase is safe and this is an approval problem, which you can fix yourself below.

The coin vanished

Your recovery phrase is compromised

Assets going from several chains or several addresses at once, and any gas you add is taken immediately. Revoking will not help — the attacker does not need permission, they have your keys.

What to do → The coin stayed

It is a token approval

One chain, one address, and your balance of the network’s own coin survives. A contract you approved can still take specific tokens. This is fixable in a few minutes.

How to revoke →

Step two · do not skip this

Fake “revoke” sites are hunting people reading pages like this one

This is the specific, documented trap for someone in your position right now. Attackers register lookalike revoke tools within hours of an incident and push them into search results and into replies under genuine warnings. The site takes what the scheme left behind.

Type the address yourself, or use a bookmark. Never arrive at a wallet tool from a direct message, an email, a reply, a comment or a video description — including one that says it helped them recover funds.
Never click a sponsored or advertised result. Paid ads for fake wallet tools are a standard delivery route. Scroll past the ads.
Read the domain character by character. Fakes use extra words, hyphens, different endings, or sit on free hosting like vercel.app or sites.google.com. Close is not the same.
No legitimate tool ever needs your recovery phrase or private key. Nor does it need you to “verify”, “validate”, “synchronise” or “migrate” your wallet. Any page asking for that is stealing from you, whatever it looks like.
When in doubt, use the block explorer. The explorers below are the safest starting point — the addresses are ones you can check against any transaction you have ever made.

Step three

Check and revoke, chain by chain

Go to the explorer for the chain you used, enter your wallet address, and look at what has permission to spend your tokens. Anything you do not recognise, or belongs to the scheme, gets revoked. Each revocation is an ordinary transaction, so you need a small amount of the network’s coin to pay the fee.

Chain	Where to go	Notes
BNB Smart Chain	`bscscan.com/tokenapprovalchecker`	The chain most Aurum and NEYRO deposits went through.
Ethereum	`etherscan.io/tokenapprovalchecker`	Enter your address, connect, revoke one at a time.
Base	`basescan.org/tokenapprovalchecker`	Same tool, same steps.
Arbitrum	`arbiscan.io/tokenapprovalchecker`	Same tool, same steps.
Polygon	`polygonscan.com/tokenapprovalchecker`	Same tool, same steps.
Avalanche	`snowtrace.io/tokenapprovalchecker`	Same tool, same steps.
TRON	`tronscan.org` → your Account page → List of Approval	TRON is different. Use Tronscan or TronLink. Do not rely on the EVM revoke tools below — they do not read TRON, so they will show you nothing and you may wrongly conclude you are clear.

Those links go to the real explorers and open in a new tab. The addresses are written out in full on purpose — that is what the genuine ones look like, so you can recognise a fake later. The danger is never a link on a page you went to yourself; it is a link that arrives in a message, a reply, an email or an advert.

If you used several chains, a multi-chain tool saves time on the EVM ones — revoke.cash covers Ethereum, BNB Chain, Base, Arbitrum, Polygon, Avalanche and many more. It shows approvals free and revoking one at a time is free beyond the network fee. It does not cover TRON, whatever other guides may tell you — for TRON, use Tronscan.

An empty list is good news, not a guarantee.
Some permissions are given as an off-chain signature rather than a transaction. Those do not appear in any approval list until the moment they are used, so no tool can show them to you. If you signed something on the scheme’s website and the tokens are still there, move them to a fresh wallet rather than trusting a clean list.

If the coin vanished

If your recovery phrase is gone, revoking will not help

Someone with your recovery phrase does not need permission to move your tokens. Automated software watches wallets like this and takes anything that arrives, usually within seconds. The only real fix is to stop using that wallet.

Stop using every account under that recovery phrase.
Not just the one that was drained. Every account created from one recovery phrase is affected together.
Do not send anything else to it.
Including gas money to “rescue” what is left. It will be taken in seconds. This is the mistake that costs people twice.
Create a completely new wallet with a brand-new recovery phrase.
Adding a new account inside the same wallet is not enough — it comes from the same compromised phrase. It has to be a new phrase, written down offline, never typed into any website.
Move anything the sweeper cannot take automatically.
NFTs and staked positions are sometimes missed. If there is a meaningful amount left, this is genuinely difficult and is worth asking about before you try.
Report it.
In the UK, Action Fraud. In the US, the FBI’s IC3. Both build the picture even when they cannot act on your case alone.

Afterwards

What to expect next

Once your loss is visible on-chain or you have posted about it publicly, you will be approached. Expect it, and recognise it.

The people who took it often come back offering to get it returned.
A recovery group forms around a collapsed scheme, the paperwork is always days away, it is always gated behind a lawyer or an NDA, and somewhere in it there is a new token, a membership, or a fee. Legitimate help never requires you to buy anything. If a recovery route is attached to a fresh investment, treat that connection itself as the answer.

If you want the money traced properly — where it went, which exchange it landed at, and a document you can hand to Action Fraud or an exchange — that is what the commissioned work is for. Reporting the scheme to me costs nothing and always will.

Report it — free Commission a trace Read the case files

This page describes publicly documented wallet mechanics and links to well-known block explorers and wallet tools. It is not legal or financial advice, and no tool named here is endorsed or operated by me — check any address yourself before connecting a wallet to it.