The May 2026 TrustedVolumes exploit that drained $6.7 million from a 1inch resolver contract exposed a vulnerability class that most crypto users do not even know exists: approval harvesting. The attacker did not need users to click anything, sign any transaction, or interact with any malicious interface. They simply leveraged old token approvals — permissions that users had granted months or years earlier during legitimate protocol interactions — to drain funds from wallets that had not touched the protocol in a long time. This advanced tutorial walks you through systematically auditing and revoking token approvals across every chain you use.
The Objective
By the end of this tutorial, you will have a complete inventory of every active token approval across all chains where you hold assets, understand which approvals represent genuine security risks, and have revoked or scoped down every unnecessary permission. You will also implement an ongoing approval management workflow that prevents future approval sprawl.
Token approvals are a fundamental mechanic in Ethereum and EVM-compatible chains. When you interact with a DeFi protocol, you grant the protocol permission to spend tokens from your wallet — up to an unlimited amount in many cases. These approvals persist indefinitely unless you explicitly revoke them. Over time, active crypto users accumulate dozens or even hundreds of outstanding approvals across multiple protocols and chains, creating a sprawling attack surface that is nearly impossible to track mentally.
The TrustedVolumes attack demonstrated exactly why this matters. The attacker registered themselves as a trusted signer through a public function in the resolver contract, then used existing user approvals to drain funds. Users who had interacted with the TrustedVolumes resolver months earlier had their funds stolen without any new action on their part. This attack pattern works against any protocol where you have granted spending approvals that remain active.
Prerequisites
Before starting this tutorial, you need the following tools and access:
Wallet access: You need access to every wallet you use for DeFi interactions across all chains. This includes hardware wallets like Ledger or Trezor, software wallets like MetaMask, Rabby, or Rainbow, and any exchange-linked wallets you use for on-chain transactions.
Approval scanning tools: Install or bookmark the following: Revoke.cash (supports Ethereum, Arbitrum, Optimism, Polygon, Base, and most major EVM chains), Etherscan Token Approval Checker (Ethereum mainnet), and the equivalent block explorers for each chain you use. Rabby Wallet has a built-in approval scanner that provides a unified interface across multiple chains.
Blockchain analytics: Optional but recommended — tools like Blockaid browser extension or PocketUniverse that provide real-time transaction simulation and approval risk assessment when you interact with new protocols.
Step-by-Step Walkthrough
Step 1: Inventory your wallets and chains. List every wallet address you have used for DeFi interactions and every chain where you hold or have held assets. For most active DeFi users, this includes Ethereum mainnet, Arbitrum, Optimism, Base, Polygon, Avalanche, BNB Chain, and potentially newer chains like ZKsync or Scroll. Export or note each address.
Step 2: Scan approvals on each chain. For each wallet address, visit Revoke.cash and connect your wallet. The tool will display all active token approvals for the connected chain. Switch networks and repeat for each chain. Pay particular attention to: approvals for large-value tokens (USDC, USDT, WETH, WBTC), approvals with unlimited spending limits, approvals to contracts you do not recognize or no longer use, and approvals to recently exploited or compromised protocols.
Step 3: Categorize risk levels. Not all approvals carry equal risk. Categorize them as follows. Critical risk: unlimited approvals to unknown or unaudited contracts, any approvals to protocols that have been recently exploited. High risk: unlimited approvals to well-known but non-essential protocols you are not currently using. Medium risk: limited-amount approvals to protocols you occasionally use. Low risk: approvals to core protocols you interact with regularly, especially those with limited spending amounts.
Step 4: Revoke critical and high-risk approvals. On Revoke.cash, click the revoke button next to each critical or high-risk approval. You will need to confirm a transaction in your wallet for each revocation. Note that revocation transactions require gas fees, so batch this work when gas prices are low. For wallets with many approvals, prioritize revoking approvals for high-value tokens first.
Step 5: Implement approval hygiene going forward. Configure your wallet to use limited approvals rather than unlimited ones whenever possible. Rabby Wallet and MetaMask both offer options to set custom spending limits when approving tokens. Set the approval amount to slightly above what you need for the specific transaction. For protocols you use frequently, set a reasonable cap rather than granting unlimited access.
Step 6: Set up a recurring audit schedule. Add a calendar reminder to audit your token approvals at least once per month, or immediately after interacting with any new protocol. The entire scanning process takes 15 to 30 minutes per wallet and can prevent losses that no amount of market analysis or portfolio management can recover from.
Step 7: Advanced — use multi-address segregation. For users with significant crypto holdings, consider segregating DeFi activity across multiple wallets. Maintain a cold storage wallet for long-term holdings with zero DeFi approvals, a warm wallet for active DeFi with carefully managed approvals, and a hot wallet for experimental protocol interactions with minimal funds. This compartmentalization limits the blast radius of any single approval exploit.
Troubleshooting
Problem: Revoke transaction fails with insufficient gas. Some older ERC-20 tokens require higher gas limits for approval revocations. Manually increase the gas limit in your wallet to 100,000 or higher when revoking stubborn approvals.
Problem: Approval shows as revoked but funds were still drained. This indicates that the exploit occurred before you completed the revocation, or that multiple contracts had approvals for the same token. Re-scan to verify all approvals are revoked, and check the transaction history of the compromised token for any unauthorized transfers.
Problem: Cannot find the contract address in Revoke.cash. Some newer chains or obscure protocols may not be indexed by Revoke.cash. Use the native block explorer for that chain and navigate to the token contract directly. Most ERC-20 token contracts on block explorers include an allowance check function that shows your approved spenders.
Problem: Revoking breaks an active DeFi position. If you revoke an approval for a protocol where you have an active position, the position itself is not affected — you will only lose the ability to make new transactions through that protocol. You can re-approve with a limited amount when you need to interact again.
Mastering the Skill
Token approval management is not a one-time task — it is an ongoing operational discipline that separates secure crypto users from those who eventually become exploit statistics. The TrustedVolumes attack was not sophisticated in its technical execution; it succeeded because of the sheer volume of unmonitored approvals that users had accumulated over time. As the DeFi ecosystem continues to expand with Bitcoin near $80,000 and growing institutional participation, the financial stakes of approval hygiene will only increase.
The most advanced practitioners go beyond simple revocation and implement automated approval monitoring using on-chain alerting systems. Tools like Forta Network provide real-time threat detection that can flag suspicious contract interactions before they result in fund drainage. Combining automated monitoring with manual monthly audits creates a layered defense that dramatically reduces the risk of approval harvesting attacks.
Disclaimer: This article is for educational purposes only and does not constitute financial or security advice. Always verify the security of any tool or service before connecting your wallet. Consider consulting with a security professional for high-value crypto holdings.
That $6.7M TrustedVolumes exploit shows exactly why we need regular token approval audits. I’ve had to revoke dozens of old approvals myself
I use a spreadsheet to track all my approvals across different chains. It’s tedious but saved me from a potential exploit last month