Nobody steals the key along the way. You yourself grant someone else's contract the right to dispose of your token, and from then on it uses that right — as many times as it likes.
How it works
The token standard has a permission built into it: the owner names an address and the amount up to which that address may take tokens out of their wallet. The right is reusable and has no expiry — until the number is set back to zero, the tokens can be taken at any moment. The “unlimited approval” that many sites ask for is simply the largest number there is.
After that your signature is not needed: the transfer is started by whoever holds the permission. Breakdowns of thefts like this show that the money is not taken straight away: the typical scenario is to wait until a fresh top-up from a platform lands in the wallet. A hardware wallet is no help here: nobody was even trying to steal the key.
How to revoke
Revoking is the same operation, only with the amount set to zero: an ordinary transaction, with the network fee paid on it. The route depends on the network, and that is the main thing. On the networks of the Ethereum family the list of permissions is shown by the service revoke.cash and by the approvals tab in the explorer. You can look by address alone, connecting nothing, but to revoke you have to connect that very wallet: you cannot zero out somebody else's permission. And switch the “Show all approvals” setting on in the service straight away — without it the list is not shown in full. Built into MetaMask there is no permissions manager — revoking has been moved out into a separate web app, MetaMask Portfolio. For TRON these routes do not work: revoke.cash supports only EVM networks, and TRON is not one of them. There you look inside TronLink itself — “Wallet Management” → “Approval Management” — or in Tronscan, on the “ACCOUNT” page, the “LIST OF APPROVAL” section.
Measured 19.09.2026: on Ethereum revoking cost about four cents, on TRON about $1.14 for a single permission, because the same surcharge for a congested contract applies there. So on TRON you clear them by priority, starting with the unlimited approvals on USDT. And one separate word of caution: fake “revocation services” turn out to be drainers themselves — in April 2026 five such campaigns were recorded, catching people who had already been robbed.
What revoking does not do
It does not bring back what has already been taken out. This is prevention, not recovery; whoever promises to return stolen funds is most often a fraudster themselves. But permissions that have already been used still have to be revoked — otherwise the same wallet will be emptied again the moment money appears in it.
It does not help if the recovery phrase has leaked. The permissions have not gone anywhere — it is the operation itself that is pointless: the thief has the whole key and signs anything at all, with no permissions needed. There is one way out — a new wallet, and moving what is left across to it.
Revoking in one network does not revoke in another. Each permission applies to one token in one network: having zeroed it on Ethereum, you have changed nothing on BNB Chain. You have to go through them network by network.
And on every address separately. A permission is tied to the owner, so every address inside one wallet has its own set — you have to clear all the ones you used to connect to sites.
Revoking does not touch deposits or staking, though. Zeroing the permissions has no effect on tokens already deposited or staked — there is no need to fear that a clear-out will break your positions. The only consequence: to add more to the same position, the permission will have to be granted again.
“Disconnect the wallet from the site” is not revoking. Disconnecting takes away the site's access to your address, while the permissions you granted stay active.
Zeroing does not cancel a permit that has already been signed but not yet executed — a permission granted by a signature, with no transaction. The current value of the permission is not among the conditions for executing it, and the execution will overwrite your zero. A signature like that is cancelled differently — by spending its counter with a transaction of your own, and the window for that is small. But if the permit has already been executed, ordinary revoking does work, and that is exactly what you should do.
More on this: How to keep your recovery phrase so nobody can coax it out of you