> ## Content Index > Fetch the complete content index at: https://stablecoininsider.org/llms.txt > Use this file to discover other available public pages before exploring further. # How to Check and Revoke USDC and USDT Token Approvals - URL: https://stablecoininsider.org/how-to-revoke-usdc-usdt-token-approvals/ - Published: 2026-11-13T10:34:41.000Z - Updated: 2026-11-13T10:34:46.000Z - Description: How to check and revoke USDC and USDT token approvals with Revoke.cash or Etherscan, what Permit2 changes, and what a revoke costs. Includes our 13 November 2026 analysis of Ethereum approvals: 14.3% of wallet USDC approvals were unlimited. - Author: Milos Djukanovic - Tags: Fundamentals, Stablecoin Security, Stablecoin Scams, USDC, USDT, Ethereum To revoke a USDC or USDT token approval, look up your wallet address in an approval checker such as [Revoke.cash](https://revoke.cash/) or [Etherscan's Token Approval Checker](https://etherscan.io/tokenapprovalchecker), find the spender you no longer use, and send a revoke transaction that sets its allowance to zero. Viewing is free. Each revoke costs one network fee, which was about two US cents on Ethereum on 13 November 2026. Approvals matter because they outlive the app that asked for them. Chainalysis traced the [$7.5 million JaredfromSubway.eth drain](https://www.chainalysis.com/blog/sandwich-attack-jaredfromsubway-hack/) of June 2026 to approvals that "were never revoked", and Scam Sniffer counted [$83.85 million lost to wallet-drainer phishing in 2025](https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/), much of it through approve and permit signatures. This guide covers EVM chains, with Ethereum data read on 13 November 2026. *Last updated: 13 November 2026\. Approval data, gas costs and tool pages re-checked on this date.* ## Key Takeaways - An approval lets a contract move your USDC or USDT later with `transferFrom`, up to a cap you set. Standard ERC-20 approvals do not expire. - In our sample of about 23 hours of Ethereum activity, 14.3% of wallet-signed USDC approvals and 9.4% of USDT approvals were unlimited. - USDT on Ethereum rejects a change from one non-zero allowance to another, so apps reset it to zero first. That explains most USDT "zero" approvals in the data. - Revoking a USDC approval used a median 33,622 gas and a USDT approval 26,420 gas, about $0.02 at the fees wallets actually paid on 13 November 2026. - Disconnecting a wallet from a website does not revoke anything, and a hardware wallet does not protect against an approval you already signed. ## What is a token approval? A token approval is a permission you give a smart contract to spend a set amount of a token from your wallet. Under the [ERC-20 standard](https://eips.ethereum.org/EIPS/eip-20), `approve` "allows `_spender` to withdraw from your account multiple times, up to the `_value` amount." Calling it again overwrites the old amount. For USDC, Circle explains that `approve` writes the cap into the USDC contract itself, and the spender's `transferFrom` calls reduce it ([Circle](https://www.circle.com/blog/four-ways-to-authorize-usdc-smart-contract-interactions-with-circle-sdk)). An "unlimited" approval is simply the largest number the contract can store, so the cap never runs out. ![Diagram of a USDC or USDT approval: approve, allowance stored, spender pulls with transferFrom, revoke sets it to zero.](https://storage.ghost.io/c/73/6a/736af0e4-2274-4543-a329-2952b2b52abc/content/images/2026/11/how-usdc-usdt-token-approval-works-steps-diagram.webp) Graphic: Stablecoin Insider. Source: [EIP-20](https://eips.ethereum.org/EIPS/eip-20), [Circle](https://www.circle.com/blog/four-ways-to-authorize-usdc-smart-contract-interactions-with-circle-sdk) and [Tether WDK docs](https://docs.wdk.tether.io/sdk/wallet-modules/wallet-evm-7702-gasless/guides/transfer-tokens/), read 13 Nov 2026. The risk is the gap between steps 2 and 3\. If the spender is malicious, gets exploited, or is a contract you forgot about, it can pull tokens you receive months later. A drain via an approval needs no access to your seed phrase, which is why [Revoke.cash notes](https://revoke.cash/learn/faq) that hardware wallets "offer no extra protection" here. ## How do you check and revoke USDC or USDT approvals? You check and revoke USDC or USDT approvals in five steps: open a checker, read each stablecoin row, decide what to cut, sign the revoke, then confirm the allowance is zero. Repeat on every chain where you hold stablecoins, because an approval applies to one token on one network. ### Step 1: Open an approval checker and enter your address Type the checker's address yourself rather than following a link from a message. Both Revoke.cash and Etherscan let you search any address without connecting a wallet. Etherscan says connecting is optional and only needed for actions such as revoking, and that a connection "does not automatically sign anything" ([Etherscan](https://info.etherscan.com/connecting-your-wallet-on-etherscan/)). Etherscan runs separate checkers on its other explorers, such as [OP Mainnet](https://optimistic.etherscan.io/tokenapprovalchecker). ### Step 2: Read the USDC and USDT rows Each row shows the token, the approved amount ("Unlimited" or a number), the spender's address or label, and when the approval was last set. Revoke.cash also lets you search by spender address, which is how the screenshot below isolates approvals given to Uniswap's Permit2 contract. ![Revoke.cash approvals list for vitalik.eth filtered to the Permit2 spender, showing an unlimited DAI approval.](https://storage.ghost.io/c/73/6a/736af0e4-2274-4543-a329-2952b2b52abc/content/images/2026/11/revoke-cash-approvals-list-permit2-spender-screenshot.webp) Screenshot: [Revoke.cash](https://revoke.cash/) approvals page for the public address vitalik.eth, filtered by the Permit2 spender address, captured 13 Nov 2026. The example is a public address, chosen because its approvals are visible to anyone. Note the last row: an unlimited DAI approval to Permit2 set in January 2023 is still active almost four years later. ### Step 3: Decide which approvals to revoke Revoke anything you do not recognise, and any approval for an app you no longer use. Revoke.cash calls this "a trade-off between safety and convenience": approvals to well-known protocols are usually fine to keep, while newer contracts deserve more caution ([Revoke.cash](https://revoke.cash/learn/faq)). | What you find | What to do | | ------------------------------------ | -------------------------------------------------- | | Unknown spender, any amount | Revoke now, then check the spender on the explorer | | App you stopped using | Revoke; the app will ask again if you return | | Unlimited approval to an app you use | Keep, or replace with a capped amount | | Spender linked to a reported exploit | Revoke first, then move remaining funds | | Approval already set to 0 | Nothing left to revoke | ### Step 4: Connect your wallet and sign the revoke Click Revoke, then check the wallet pop-up. It may say "approve" or "give permission", because revoking calls the same `approve` function with an amount of zero ([Revoke.cash](https://revoke.cash/learn/faq)). Confirm the token contract, the spender and a value of 0 before you sign. You pay the network fee in the chain's gas token, such as ETH on Ethereum. ### Step 5: Confirm the allowance is zero Refresh the checker after the transaction confirms; the row should disappear or show zero. To double-check the contract you just revoked on, compare it with the issuer's list in our guide to [checking the official USDC or USDT contract](https://stablecoininsider.org/how-to-check-the-official-usdc-or-usdt-contract/). A lookalike token with a revoked approval protects nothing. 🔎 **How we checked this guide:** we pulled every USDC and USDT Approval event on Ethereum for 7,000 blocks (12 Nov 2026 11:58 CET to 13 Nov 2026 11:21 CET) through a [PublicNode](https://www.publicnode.com/) RPC endpoint, classified owners as wallets or contracts by reading their code, and read gas data from 60 standalone revoke transactions per token. Mechanics come from EIP-20, Circle, Tether and Uniswap documentation. Revoke.cash and Etherscan are named as examples; neither paid to be mentioned. See [our methodology](https://stablecoininsider.org/our-methodology/). ## How many USDC and USDT approvals are unlimited? About one in seven USDC approvals signed by wallets on Ethereum was unlimited in our sample, and roughly one in eleven for USDT. Most approvals were capped amounts, often set inside the same transaction as a swap. ![Bar chart: 14.3% of wallet USDC approvals and 9.4% of USDT approvals were unlimited; 26.4% of USDT approvals set zero.](https://storage.ghost.io/c/73/6a/736af0e4-2274-4543-a329-2952b2b52abc/content/images/2026/11/usdc-usdt-unlimited-approvals-share-ethereum-chart.webp) Chart: Stablecoin Insider analysis of Ethereum Approval logs via [PublicNode](https://www.publicnode.com/), blocks 26,398,413 to 26,405,412, read 13 Nov 2026. | Measure (wallet-signed) | USDC | USDT | | ------------------------------------------------------------- | -------------------------- | -------------------------- | | Approval events | 27,212 from 18,063 wallets | 32,799 from 16,581 wallets | | Unlimited (1 trillion tokens or more) | 3,902 (14.3%) | 3,086 (9.4%) | | Set to zero | 1,219 (4.5%) | 8,652 (26.4%) | | Zero reset followed by a new approval in the same transaction | 255 | 7,252 | | Approvals to Permit2 | 765 (420 unlimited) | 983 (579 unlimited) | Two patterns stand out. First, the high USDT zero share is not a wave of security clean-ups. Tether's documentation says USDT on Ethereum "requires an existing non-zero allowance to be reset to 0 before setting a new non-zero allowance" ([Tether](https://docs.wdk.tether.io/sdk/wallet-modules/wallet-evm-7702-gasless/guides/transfer-tokens/)), so apps send a zero first; 7,252 of the 8,652 USDT zero events were exactly that. Second, genuine stand-alone revocations were rare: 768 USDC and 1,157 USDT single-approval transactions sent by plain wallets, against about 7,000 new unlimited approvals across both tokens in the same window. Limitations: the sample covers one day on one chain, counts events rather than live allowances, and counts EIP-7702 delegated accounts as wallets. ## How much does it cost to revoke a USDC or USDT approval? Revoking a USDC or USDT approval on Ethereum cost about $0.02 at the median fee wallets paid on 13 November 2026\. The table multiplies the median gas used by real revoke transactions by several gas prices, at an ETH price of $1,950.03 ([CoinGecko](https://www.coingecko.com/en/coins/ethereum), read 13 Nov 2026 11:25 CET). | Scenario | USDC revoke | USDT revoke | | ---------------------------------------------------------- | --------------------------- | --------------------------- | | Gas used (median of 60 revokes) | 33,622 | 26,420 | | Median fee actually paid (0.34 / 0.41 gwei) | 0.0000114 ETH, about $0.022 | 0.0000109 ETH, about $0.021 | | At 0.11 gwei (median base fee plus tip, last 1,024 blocks) | about $0.007 | about $0.006 | | At 10 gwei (illustrative busy network) | about $0.66 | about $0.52 | At those prices, revoking ten USDC approvals one at a time costs roughly $0.22 in gas. Revoke.cash charges free users $1.50 for its batch revoke feature ([Revoke.cash](https://revoke.cash/learn/faq)), so on a quiet Ethereum day single revokes are cheaper for a handful of approvals. Fees on layer-2 networks follow their own gas markets. ## Do Permit2 and permit signatures need separate revokes? Permit2 and permit signatures do need separate attention, because they do not all live in the same place. Circle lists four ways to authorise USDC, and only two of them write the allowance into the USDC contract ([Circle](https://www.circle.com/blog/four-ways-to-authorize-usdc-smart-contract-interactions-with-circle-sdk)). - **approve**: allowance stored in the token contract. Revoke with `approve(spender, 0)`. - **permit (EIP-2612)**: you sign off-chain and anyone submits it, but the result is the same allowance as approve. Revoke it the same way. USDC supports it. The USDT contract on Ethereum reverted when we queried the EIP-2612 `nonces` and `DOMAIN_SEPARATOR` functions on 13 November 2026, so it has no permit. - **transferWithAuthorization (EIP-3009)**: a one-time signed transfer that creates no allowance, so nothing remains to revoke. - **Permit2**: you approve the Permit2 contract once per token, and Permit2 stores separate, time-limited allowances for each app. Uniswap says it lives at `0x000000000022D473030F116dDEE9F6B43aC78BA3` on every chain it supports except zkSync ([Uniswap](https://developers.uniswap.org/docs/protocols/permit2/overview)). For Permit2 you have two levers. Revoking the token's approval to Permit2 cuts off every app that relies on it for that token. Permit2 also has a `lockdown` function that batch-revokes individual app allowances ([Permit2 source](https://github.com/Uniswap/permit2/blob/main/src/interfaces/IAllowanceTransfer.sol)). Signatures are the bigger danger: Scam Sniffer found that permit and Permit2 signatures caused 38% of 2025 phishing losses in cases of $1 million or more ([Scam Sniffer](https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/)). ## What if an approval was already used to drain your stablecoins? If an approval was already used to drain your stablecoins, revoke it anyway so the spender cannot take tokens you receive later, then move what is left to a fresh wallet. Revoke.cash cannot recover stolen funds ([Revoke.cash](https://revoke.cash/learn/faq)). If ETH you send for gas disappears immediately, your seed phrase is compromised, and the wallet should be abandoned rather than cleaned. Report the theft quickly to the platform the funds reach. Issuers can freeze USDC and USDT at specific addresses, which is why the JaredfromSubway attacker swapped stablecoins into ETH "within minutes" ([Chainalysis](https://www.chainalysis.com/blog/sandwich-attack-jaredfromsubway-hack/)); our explainer on [whether stablecoins can be frozen](https://stablecoininsider.org/can-stablecoins-be-frozen/) covers how that works. AI agent wallets have their own cut-off steps in [how to revoke an AI agent's access to USDC](https://stablecoininsider.org/how-to-revoke-ai-agent-usdc-access/). 💡 **Stablecoin Insider's take:** approvals are the part of wallet security that people forget, because nothing happens when you sign them. A ten-minute check every few months, and capped amounts instead of "Unlimited" for apps you use rarely, cost cents on Ethereum today and remove a risk that a hardware wallet cannot. [Stablecoin Scams: The Top 10 Patterns and How to Spot Them FastThe ten scam patterns that target stablecoin holders, from fake tokens to approval phishing.![](https://stablecoininsider.org/favicon.ico)Stablecoin Insider](https://stablecoininsider.org/stablecoin-scams/) [What is address poisoning?](https://stablecoininsider.org/what-is-address-poisoning/) Worried about lookalike addresses as well as approvals? See [how address poisoning works](https://stablecoininsider.org/what-is-address-poisoning/). For the full picture, see our [Stablecoin Payments and Cards Hub](https://stablecoininsider.org/stablecoin-payments-hub/). ## FAQ #### Does disconnecting my wallet from a website revoke its approvals? Disconnecting your wallet from a website does not revoke its approvals. Revoke.cash explains that disconnecting only stops the site from seeing your address, while "your approvals stay active" (Revoke.cash). Only an on-chain revoke sets the allowance to zero. #### Do token approvals expire? Standard ERC-20 token approvals do not expire; they stay until you change them or the allowance is used up. Chainalysis calls each one "a standing invitation" (Chainalysis). Permit2 allowances are different: each carries an expiration timestamp set when it is granted (Uniswap). #### Will revoking an approval affect my deposited or staked stablecoins? Revoking an approval does not affect stablecoins you have already deposited or staked. Revoke.cash says those tokens stay deposited and can still be withdrawn; you only need a new approval to add more (Revoke.cash). #### Why does USDT sometimes need two approval transactions? USDT sometimes needs two approval transactions because its Ethereum contract will not change one non-zero allowance straight to another. The allowance must be set to zero first, per Tether's documentation. The ERC-20 standard recommends that pattern to avoid a known race condition but does not require contracts to enforce it. #### Is it safe to enter my address on an approval checker? It is safe to enter your public address on an approval checker, because viewing approvals needs no signature. Risk starts when you connect and sign. Etherscan notes that every signature still requires your approval in the wallet (Etherscan). Never type a seed phrase into any site. *Sources:* [*EIP-20: ERC-20 Token Standard*](https://eips.ethereum.org/EIPS/eip-20)*;* [*Circle, Four Ways to Authorize USDC Smart Contract Interactions (16 Sep 2025)*](https://www.circle.com/blog/four-ways-to-authorize-usdc-smart-contract-interactions-with-circle-sdk)*;* [*Tether WDK docs, Transfer Tokens*](https://docs.wdk.tether.io/sdk/wallet-modules/wallet-evm-7702-gasless/guides/transfer-tokens/)*;* [*Uniswap, Permit2 overview*](https://developers.uniswap.org/docs/protocols/permit2/overview)*;* [*Uniswap Permit2, IAllowanceTransfer.sol*](https://github.com/Uniswap/permit2/blob/main/src/interfaces/IAllowanceTransfer.sol)*;* [*Revoke.cash FAQ*](https://revoke.cash/learn/faq)*;* [*Etherscan Information Center, Connecting Your Wallet on Etherscan*](https://info.etherscan.com/connecting-your-wallet-on-etherscan/)*;* [*Chainalysis, JaredfromSubway.eth heist analysis (26 Jun 2026)*](https://www.chainalysis.com/blog/sandwich-attack-jaredfromsubway-hack/)*;* [*Scam Sniffer 2025 phishing report (3 Jan 2026)*](https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/)*;* [*CoinGecko, Ethereum price*](https://www.coingecko.com/en/coins/ethereum)*;* [*Ethereum mainnet Approval logs and receipts via PublicNode RPC*](https://www.publicnode.com/)*. All read on 13 November 2026.* --- This content is provided for informational and educational purposes only and doesn't constitute financial, investment, legal or tax advice. On-chain figures cover Ethereum blocks 26,398,413 to 26,405,412 (12–13 November 2026), and gas costs and the ETH price were read on 13 November 2026; both change constantly. Mentions of USDC, USDT, DAI, Circle, Tether, Uniswap, Permit2, Revoke.cash, Etherscan, Chainalysis or Scam Sniffer are not endorsements. Always verify contract addresses and wallet prompts yourself before signing.