Every time you swap tokens, stake, or list an NFT, your wallet signs a token approval. That approval is a standing permission: it lets a smart contract move a specific token out of your wallet, up to an approved amount, without asking you again. The trouble is that approvals do not expire on their own. Months after you last used an app, its contract may still hold permission to move your funds, and if that project is later hacked or turns malicious, your old approval becomes the attacker's way in.

A token approval is not the same as holding a token or owning an account. It is an allowance recorded on the blockchain for one token, one spender contract, and one network. Many apps ask for an unlimited allowance because it is convenient: approve once, trade forever, no more pop-ups. Unlimited means the contract can move your entire balance of that token at any time, not just the amount of your next trade. Approvals are also per network, so an approval you granted on BNB Smart Chain does not show up when you check Ethereum, and the reverse is true.

Start your clean-up by opening a reputable approval checker. Revoke.cash and the Etherscan Token Approval Checker are the two most widely used options, and both let you paste a public wallet address to audit without connecting a wallet at all. That read-only option is the safest way to start: you can see every approval without signing anything. Work through one network at a time and look for three warning signs: allowances marked as unlimited or showing an enormous number, spenders you do not recognise, and apps you have not used in months.

When you find an approval you no longer need, revoking it is a normal on-chain transaction. Select the approval, confirm the revoke in your wallet, and pay a small gas fee in that network's native token. After the transaction confirms, refresh the checker and confirm the allowance is gone or set to zero. Revoking does not move your tokens or change your balances; it only removes the contract's permission to move them. If you later return to that app, it will simply ask for a fresh approval. Some chains support batch revoking, but on Ethereum mainnet each revocation is usually a separate transaction, so budget a little gas for each one.

NFT approvals deserve the same attention. Marketplaces often request operator approval for an entire collection rather than a single token, which means the marketplace contract can move any NFT from that collection in your wallet. If you only list occasionally, keep those operator approvals disabled until you actually need them, then revoke them again after the sale. The same rule applies to any app you tried once and abandoned: if you do not use it, it does not need standing access to your wallet.

A few habits make future clean-ups much shorter. When a wallet or app lets you edit the approval amount, approve only what the trade needs instead of unlimited. Keep a separate hot wallet with small balances for new sites, airdrops, and experiments, and keep savings in a wallet that never connects to anything new. Put approval reviews on a schedule, for example once a month, rather than waiting until something goes wrong. And never type your seed phrase or private key into an approval checker: a legitimate checker never needs either, and any site that asks for them is a scam.

Cleaning up approvals takes only a few minutes per network, and it removes one of the most overlooked risks in self-custody. Your tokens stay where they are, your balances do not change, and the only thing you lose is the silent access that forgotten apps held over your wallet.