The May 2026 TrustedVolumes exploit that drained $6.7 million from a 1inch resolver contract exposed a vulnerability class that most crypto users do not even know exists: approval harvesting. The attacker did not need users to click anything, sign any transaction, or interact with any malicious interface. They simply leveraged old token approvals — permissions that users had granted months or years earlier during legitimate protocol interactions — to drain funds from wallets that had not touched the protocol in a long time. This advanced tutorial walks you through systematically auditing and revoking token approvals across every chain you use.
The Objective
By the end of this tutorial, you will have a complete inventory of every active token approval across all chains where you hold assets, understand which approvals represent genuine security risks, and have revoked or scoped down every unnecessary permission. You will also implement an ongoing approval management workflow that prevents future approval sprawl.
Token approvals are a fundamental mechanic in Ethereum and EVM-compatible chains. When you interact with a DeFi protocol, you grant the protocol permission to spend tokens from your wallet — up to an unlimited amount in many cases. These approvals persist indefinitely unless you explicitly revoke them. Over time, active crypto users accumulate dozens or even hundreds of outstanding approvals across multiple protocols and chains, creating a sprawling attack surface that is nearly impossible to track mentally.
The TrustedVolumes attack demonstrated exactly why this matters. The attacker registered themselves as a trusted signer through a public function in the resolver contract, then used existing user approvals to drain funds. Users who had interacted with the TrustedVolumes resolver months earlier had their funds stolen without any new action on their part. This attack pattern works against any protocol where you have granted spending approvals that remain active.
Prerequisites
Before starting this tutorial, you need the following tools and access:
Wallet access: You need access to every wallet you use for DeFi interactions across all chains. This includes hardware wallets like Ledger or Trezor, software wallets like MetaMask, Rabby, or Rainbow, and any exchange-linked wallets you use for on-chain transactions.
Approval scanning tools: Install or bookmark the following: Revoke.cash (supports Ethereum, Arbitrum, Optimism, Polygon, Base, and most major EVM chains), Etherscan Token Approval Checker (Ethereum mainnet), and the equivalent block explorers for each chain you use. Rabby Wallet has a built-in approval scanner that provides a unified interface across multiple chains.
Blockchain analytics: Optional but recommended — tools like Blockaid browser extension or PocketUniverse that provide real-time transaction simulation and approval risk assessment when you interact with new protocols.
Step-by-Step Walkthrough
Step 1: Inventory your wallets and chains. List every wallet address you have used for DeFi interactions and every chain where you hold or have held assets. For most active DeFi users, this includes Ethereum mainnet, Arbitrum, Optimism, Base, Polygon, Avalanche, BNB Chain, and potentially newer chains like ZKsync or Scroll. Export or note each address.
Step 2: Scan approvals on each chain. For each wallet address, visit Revoke.cash and connect your wallet. The tool will display all active token approvals for the connected chain. Switch networks and repeat for each chain. Pay particular attention to: approvals for large-value tokens (USDC, USDT, WETH, WBTC), approvals with unlimited spending limits, approvals to contracts you do not recognize or no longer use, and approvals to recently exploited or compromised protocols.
Step 3: Categorize risk levels. Not all approvals carry equal risk. Categorize them as follows. Critical risk: unlimited approvals to unknown or unaudited contracts, any approvals to protocols that have been recently exploited. High risk: unlimited approvals to well-known but non-essential protocols you are not currently using. Medium risk: limited-amount approvals to protocols you occasionally use. Low risk: approvals to core protocols you interact with regularly, especially those with limited spending amounts.
Step 4: Revoke critical and high-risk approvals. On Revoke.cash, click the revoke button next to each critical or high-risk approval. You will need to confirm a transaction in your wallet for each revocation. Note that revocation transactions require gas fees, so batch this work when gas prices are low. For wallets with many approvals, prioritize revoking approvals for high-value tokens first.
Step 5: Implement approval hygiene going forward. Configure your wallet to use limited approvals rather than unlimited ones whenever possible. Rabby Wallet and MetaMask both offer options to set custom spending limits when approving tokens. Set the approval amount to slightly above what you need for the specific transaction. For protocols you use frequently, set a reasonable cap rather than granting unlimited access.
Step 6: Set up a recurring audit schedule. Add a calendar reminder to audit your token approvals at least once per month, or immediately after interacting with any new protocol. The entire scanning process takes 15 to 30 minutes per wallet and can prevent losses that no amount of market analysis or portfolio management can recover from.
Step 7: Advanced — use multi-address segregation. For users with significant crypto holdings, consider segregating DeFi activity across multiple wallets. Maintain a cold storage wallet for long-term holdings with zero DeFi approvals, a warm wallet for active DeFi with carefully managed approvals, and a hot wallet for experimental protocol interactions with minimal funds. This compartmentalization limits the blast radius of any single approval exploit.
Troubleshooting
Problem: Revoke transaction fails with insufficient gas. Some older ERC-20 tokens require higher gas limits for approval revocations. Manually increase the gas limit in your wallet to 100,000 or higher when revoking stubborn approvals.
Problem: Approval shows as revoked but funds were still drained. This indicates that the exploit occurred before you completed the revocation, or that multiple contracts had approvals for the same token. Re-scan to verify all approvals are revoked, and check the transaction history of the compromised token for any unauthorized transfers.
Problem: Cannot find the contract address in Revoke.cash. Some newer chains or obscure protocols may not be indexed by Revoke.cash. Use the native block explorer for that chain and navigate to the token contract directly. Most ERC-20 token contracts on block explorers include an allowance check function that shows your approved spenders.
Problem: Revoking breaks an active DeFi position. If you revoke an approval for a protocol where you have an active position, the position itself is not affected — you will only lose the ability to make new transactions through that protocol. You can re-approve with a limited amount when you need to interact again.
Mastering the Skill
Token approval management is not a one-time task — it is an ongoing operational discipline that separates secure crypto users from those who eventually become exploit statistics. The TrustedVolumes attack was not sophisticated in its technical execution; it succeeded because of the sheer volume of unmonitored approvals that users had accumulated over time. As the DeFi ecosystem continues to expand with Bitcoin near $80,000 and growing institutional participation, the financial stakes of approval hygiene will only increase.
The most advanced practitioners go beyond simple revocation and implement automated approval monitoring using on-chain alerting systems. Tools like Forta Network provide real-time threat detection that can flag suspicious contract interactions before they result in fund drainage. Combining automated monitoring with manual monthly audits creates a layered defense that dramatically reduces the risk of approval harvesting attacks.
Disclaimer: This article is for educational purposes only and does not constitute financial or security advice. Always verify the security of any tool or service before connecting your wallet. Consider consulting with a security professional for high-value crypto holdings.
That $6.7M TrustedVolumes exploit shows exactly why we need regular token approval audits. I’ve had to revoke dozens of old approvals myself
the 6.7M TrustedVolumes exploit worked because approvals from 2023 were still active. people revoke once and forget that every new interaction creates fresh ones
people revoke once after a hack makes news, then go back to blindly approving. the TrustedVolumes attack proved old approvals are a ticking time bomb
the real question is why dapps default to unlimited approvals in the first place. the ux convenience argument only goes so far when its users funds at risk
6.7m trustedvolumes exploit shows why dapps still default to unlimited approvals
metamask_wars exactly. unlimited approvals exist because dapp UX designers think requiring re-approval per transaction hurts conversion. theyre not wrong, they just value conversion over security
security_fanatic TrustedVolumes is just the tip. i ran an Etherscan check last week and found 23 active unlimited approvals from 2024 on wallets i barely use anymore. half were on chains i forgot i touched
revoke_tuesday_ 23 unlimited approvals from 2024 is wild. i checked mine last month and found 41 active across 6 chains. most from one frantic DeFi summer where i approved everything that had a TVL number
security_fanatic 23 approvals is nothing. my wallet had 47 after two years of DeFi farming. spent an entire Sunday revoking
etherscan_junkie 47 approvals is rookie numbers. checked my main wallet last month and found 89 active ones across 6 chains. took three hours to clean up
I use a spreadsheet to track all my approvals across different chains. It’s tedious but saved me from a potential exploit last month
spreadsheets work but revisiting every 3 months manually is a chore. there are tools that do this now but trusting a third party with your approval data is its own risk
manual auditing with a spreadsheet is tedious but trusting a third party tool with visibility into all your approvals is a different kind of risk
Pilar V. exactly the paradox. you need a tool to audit approvals but giving that tool visibility into your wallets is another risk vector
agreed on the trust issue. i built my own script that exports approval data to csv without sending anything external. takes 20 min to set up with etherscan api
people revoke once after news then forget until next 2023 approval harvest
the 1inch resolver contract got drained because nobody thought about approvals as a persistent attack surface. 6.7M gone without a single new transaction from the victim
exploit_forensic_ the worst part is the victims probably didnt even know those approvals existed. you interact with a protocol once in 2023 and forget its there forever
TrustedVolumes used approvals from 2023. people forget that unlimited Erc20 approvals dont expire. check etherscan today not next month
the TrustedVolumes exploit draining $6.7M through old approvals is the exact reason revoke.cash should be a bookmarked tab. set a monthly reminder and treat it like paying bills
finally someone talking about the 6.7M TrustedVolumes exploit. those 2023 approvals were just sitting there like a ticking time bomb
same issue with dYdX approvals from 2021 still active. people revoke once and forget every new interaction creates fresh permissions
i built a cron job that automatically revokes all approvals older than 90 days. saved me from a potential exploit last month
found 12 unlimited USDT approvals from 2024 on Arbitrum last week. all from interacting with random yield aggregators I barely remember using
manual spreadsheet auditing works but nobody actually does it every 3 months. set calendar reminders or use on-chain tools. trusted third parties are risky but forgetting is riskier