Table of Contents
To revoke a USDC or USDT token approval, look up your wallet address in an approval checker such as Revoke.cash or Etherscan's Token Approval Checker, find the spender you no longer use, and send a revoke transaction that sets its allowance to zero. Viewing is free. Each revoke costs one network fee, which was about two US cents on Ethereum on 13 November 2026.
Approvals matter because they outlive the app that asked for them. Chainalysis traced the $7.5 million JaredfromSubway.eth drain of June 2026 to approvals that "were never revoked", and Scam Sniffer counted $83.85 million lost to wallet-drainer phishing in 2025, much of it through approve and permit signatures. This guide covers EVM chains, with Ethereum data read on 13 November 2026.
Last updated: 13 November 2026. Approval data, gas costs and tool pages re-checked on this date.
Key Takeaways
- An approval lets a contract move your USDC or USDT later with
transferFrom, up to a cap you set. Standard ERC-20 approvals do not expire. - In our sample of about 23 hours of Ethereum activity, 14.3% of wallet-signed USDC approvals and 9.4% of USDT approvals were unlimited.
- USDT on Ethereum rejects a change from one non-zero allowance to another, so apps reset it to zero first. That explains most USDT "zero" approvals in the data.
- Revoking a USDC approval used a median 33,622 gas and a USDT approval 26,420 gas, about $0.02 at the fees wallets actually paid on 13 November 2026.
- Disconnecting a wallet from a website does not revoke anything, and a hardware wallet does not protect against an approval you already signed.
What is a token approval?
A token approval is a permission you give a smart contract to spend a set amount of a token from your wallet. Under the ERC-20 standard, approve "allows _spender to withdraw from your account multiple times, up to the _value amount." Calling it again overwrites the old amount.
For USDC, Circle explains that approve writes the cap into the USDC contract itself, and the spender's transferFrom calls reduce it (Circle). An "unlimited" approval is simply the largest number the contract can store, so the cap never runs out.
The risk is the gap between steps 2 and 3. If the spender is malicious, gets exploited, or is a contract you forgot about, it can pull tokens you receive months later. A drain via an approval needs no access to your seed phrase, which is why Revoke.cash notes that hardware wallets "offer no extra protection" here.
How do you check and revoke USDC or USDT approvals?
You check and revoke USDC or USDT approvals in five steps: open a checker, read each stablecoin row, decide what to cut, sign the revoke, then confirm the allowance is zero. Repeat on every chain where you hold stablecoins, because an approval applies to one token on one network.
Step 1: Open an approval checker and enter your address
Type the checker's address yourself rather than following a link from a message. Both Revoke.cash and Etherscan let you search any address without connecting a wallet. Etherscan says connecting is optional and only needed for actions such as revoking, and that a connection "does not automatically sign anything" (Etherscan). Etherscan runs separate checkers on its other explorers, such as OP Mainnet.
Step 2: Read the USDC and USDT rows
Each row shows the token, the approved amount ("Unlimited" or a number), the spender's address or label, and when the approval was last set. Revoke.cash also lets you search by spender address, which is how the screenshot below isolates approvals given to Uniswap's Permit2 contract.
The example is a public address, chosen because its approvals are visible to anyone. Note the last row: an unlimited DAI approval to Permit2 set in January 2023 is still active almost four years later.
Step 3: Decide which approvals to revoke
Revoke anything you do not recognise, and any approval for an app you no longer use. Revoke.cash calls this "a trade-off between safety and convenience": approvals to well-known protocols are usually fine to keep, while newer contracts deserve more caution (Revoke.cash).
| What you find | What to do |
|---|---|
| Unknown spender, any amount | Revoke now, then check the spender on the explorer |
| App you stopped using | Revoke; the app will ask again if you return |
| Unlimited approval to an app you use | Keep, or replace with a capped amount |
| Spender linked to a reported exploit | Revoke first, then move remaining funds |
| Approval already set to 0 | Nothing left to revoke |
Step 4: Connect your wallet and sign the revoke
Click Revoke, then check the wallet pop-up. It may say "approve" or "give permission", because revoking calls the same approve function with an amount of zero (Revoke.cash). Confirm the token contract, the spender and a value of 0 before you sign. You pay the network fee in the chain's gas token, such as ETH on Ethereum.
Step 5: Confirm the allowance is zero
Refresh the checker after the transaction confirms; the row should disappear or show zero. To double-check the contract you just revoked on, compare it with the issuer's list in our guide to checking the official USDC or USDT contract. A lookalike token with a revoked approval protects nothing.
How many USDC and USDT approvals are unlimited?
About one in seven USDC approvals signed by wallets on Ethereum was unlimited in our sample, and roughly one in eleven for USDT. Most approvals were capped amounts, often set inside the same transaction as a swap.
| Measure (wallet-signed) | USDC | USDT |
|---|---|---|
| Approval events | 27,212 from 18,063 wallets | 32,799 from 16,581 wallets |
| Unlimited (1 trillion tokens or more) | 3,902 (14.3%) | 3,086 (9.4%) |
| Set to zero | 1,219 (4.5%) | 8,652 (26.4%) |
| Zero reset followed by a new approval in the same transaction | 255 | 7,252 |
| Approvals to Permit2 | 765 (420 unlimited) | 983 (579 unlimited) |
Two patterns stand out. First, the high USDT zero share is not a wave of security clean-ups. Tether's documentation says USDT on Ethereum "requires an existing non-zero allowance to be reset to 0 before setting a new non-zero allowance" (Tether), so apps send a zero first; 7,252 of the 8,652 USDT zero events were exactly that.
Second, genuine stand-alone revocations were rare: 768 USDC and 1,157 USDT single-approval transactions sent by plain wallets, against about 7,000 new unlimited approvals across both tokens in the same window. Limitations: the sample covers one day on one chain, counts events rather than live allowances, and counts EIP-7702 delegated accounts as wallets.
How much does it cost to revoke a USDC or USDT approval?
Revoking a USDC or USDT approval on Ethereum cost about $0.02 at the median fee wallets paid on 13 November 2026. The table multiplies the median gas used by real revoke transactions by several gas prices, at an ETH price of $1,950.03 (CoinGecko, read 13 Nov 2026 11:25 CET).
| Scenario | USDC revoke | USDT revoke |
|---|---|---|
| Gas used (median of 60 revokes) | 33,622 | 26,420 |
| Median fee actually paid (0.34 / 0.41 gwei) | 0.0000114 ETH, about $0.022 | 0.0000109 ETH, about $0.021 |
| At 0.11 gwei (median base fee plus tip, last 1,024 blocks) | about $0.007 | about $0.006 |
| At 10 gwei (illustrative busy network) | about $0.66 | about $0.52 |
At those prices, revoking ten USDC approvals one at a time costs roughly $0.22 in gas. Revoke.cash charges free users $1.50 for its batch revoke feature (Revoke.cash), so on a quiet Ethereum day single revokes are cheaper for a handful of approvals. Fees on layer-2 networks follow their own gas markets.
Do Permit2 and permit signatures need separate revokes?
Permit2 and permit signatures do need separate attention, because they do not all live in the same place. Circle lists four ways to authorise USDC, and only two of them write the allowance into the USDC contract (Circle).
- approve: allowance stored in the token contract. Revoke with
approve(spender, 0). - permit (EIP-2612): you sign off-chain and anyone submits it, but the result is the same allowance as approve. Revoke it the same way. USDC supports it. The USDT contract on Ethereum reverted when we queried the EIP-2612
noncesandDOMAIN_SEPARATORfunctions on 13 November 2026, so it has no permit. - transferWithAuthorization (EIP-3009): a one-time signed transfer that creates no allowance, so nothing remains to revoke.
- Permit2: you approve the Permit2 contract once per token, and Permit2 stores separate, time-limited allowances for each app. Uniswap says it lives at
0x000000000022D473030F116dDEE9F6B43aC78BA3on every chain it supports except zkSync (Uniswap).
For Permit2 you have two levers. Revoking the token's approval to Permit2 cuts off every app that relies on it for that token. Permit2 also has a lockdown function that batch-revokes individual app allowances (Permit2 source). Signatures are the bigger danger: Scam Sniffer found that permit and Permit2 signatures caused 38% of 2025 phishing losses in cases of $1 million or more (Scam Sniffer).
What if an approval was already used to drain your stablecoins?
If an approval was already used to drain your stablecoins, revoke it anyway so the spender cannot take tokens you receive later, then move what is left to a fresh wallet. Revoke.cash cannot recover stolen funds (Revoke.cash). If ETH you send for gas disappears immediately, your seed phrase is compromised, and the wallet should be abandoned rather than cleaned.
Report the theft quickly to the platform the funds reach. Issuers can freeze USDC and USDT at specific addresses, which is why the JaredfromSubway attacker swapped stablecoins into ETH "within minutes" (Chainalysis); our explainer on whether stablecoins can be frozen covers how that works. AI agent wallets have their own cut-off steps in how to revoke an AI agent's access to USDC.
Worried about lookalike addresses as well as approvals? See how address poisoning works. For the full picture, see our Stablecoin Payments and Cards Hub.
FAQ
Does disconnecting my wallet from a website revoke its approvals?
Do token approvals expire?
Will revoking an approval affect my deposited or staked stablecoins?
Why does USDT sometimes need two approval transactions?
Is it safe to enter my address on an approval checker?
Sources: EIP-20: ERC-20 Token Standard; Circle, Four Ways to Authorize USDC Smart Contract Interactions (16 Sep 2025); Tether WDK docs, Transfer Tokens; Uniswap, Permit2 overview; Uniswap Permit2, IAllowanceTransfer.sol; Revoke.cash FAQ; Etherscan Information Center, Connecting Your Wallet on Etherscan; Chainalysis, JaredfromSubway.eth heist analysis (26 Jun 2026); Scam Sniffer 2025 phishing report (3 Jan 2026); CoinGecko, Ethereum price; Ethereum mainnet Approval logs and receipts via PublicNode RPC. All read on 13 November 2026.
This content is provided for informational and educational purposes only and doesn't constitute financial, investment, legal or tax advice. On-chain figures cover Ethereum blocks 26,398,413 to 26,405,412 (12–13 November 2026), and gas costs and the ETH price were read on 13 November 2026; both change constantly. Mentions of USDC, USDT, DAI, Circle, Tether, Uniswap, Permit2, Revoke.cash, Etherscan, Chainalysis or Scam Sniffer are not endorsements. Always verify contract addresses and wallet prompts yourself before signing.
