How To Review And Revoke USDC And USDT Approvals

An Ethereum review found that 14.3% of wallet-signed USDC approvals and 9.4% of USDT approvals were unlimited. An unlimited approval allows a smart contract to spend tokens up to the largest amount supported by the token contract.

The review covered 7,000 Ethereum blocks from Nov. 12 to Nov. 13, 2026, or about 23 hours. It examined 27,212 USDC approval events from 18,063 wallets and 32,799 USDT approval events from 16,581 wallets. Unlimited approvals accounted for 3,902 USDC events and 3,086 USDT events. The figures count approval events, not current balances or live allowances, and include one blockchain.

A token approval gives a smart contract permission to transfer a set amount of USDC or USDT from a wallet. The contract can later use the permission through the transferFrom function. Standard ERC-20 approvals do not expire unless the allowance is used, changed or set to zero.

Users can enter a public wallet address into an approval checker such as Revoke.cash or Etherscan’s Token Approval Checker. Viewing the data does not require a wallet connection or transaction signature. The results show the token, approved amount, spender address or label and, in some cases, when the approval was created.

Users can revoke approvals for spenders they do not recognize or applications they no longer use. An unlimited approval for a familiar application can remain active or be replaced with a smaller allowance. Before signing, users should check the token contract, spender and transaction amount in the wallet window. A standard revocation sets the allowance to zero.

A revocation requires an on-chain transaction and a network fee. In a sample of 60 Ethereum transactions, the median gas use was 33,622 for USDC revocations and 26,420 for USDT revocations. At the fees paid on Nov. 13, the median cost was about $0.02 per transaction, based on an ETH price of $1,950.03. At a gas price of 10 gwei, the estimated cost was about $0.66 for USDC and $0.52 for USDT.

After confirmation, users should refresh the approval checker and verify that the allowance is zero or no longer appears. The process must be repeated on each blockchain where the user holds stablecoins because an approval applies to one token on one network.

USDT on Ethereum commonly requires two approval transactions when an application changes one non-zero allowance to another. The existing allowance must first be set to zero. Of the 8,652 USDT approvals set to zero in the review, 7,252 were followed by a new approval in the same transaction, indicating that most were allowance changes rather than standalone revocations.

Permit2 and other signature-based systems require separate checks. Permit2 stores allowances for individual applications and can assign expiration times. Users can revoke a token’s approval to the Permit2 contract, which affects applications using Permit2 for that token, or use Permit2’s lockdown function to remove individual application allowances. An EIP-2612 permit creates an allowance in the token contract and can be revoked by setting it to zero. An EIP-3009 transfer authorization is designed for one transfer and does not create a lasting allowance.

Disconnecting a wallet from a website does not remove an approval. A hardware wallet also does not protect funds from a permission that was already signed. A malicious, hacked or forgotten contract can use an active allowance to transfer tokens without the wallet’s seed phrase. If funds have already been stolen, revoking the approval can prevent later deposits from being taken, but it cannot recover the stolen assets.