Users often disconnect a suspicious site and assume the risk has ended. A frontend connection and an on-chain asset permission are different. ERC-20 allowances, NFT operator approvals and permit-style signatures may remain usable until consumed, revoked or expired under the relevant protocol.
Verify the mechanism first
Inspect the abnormal transaction hash, caller, contract, event logs and token contract. If a third party called the token contract and moved assets from the affected wallet, locate earlier Approval, permit or operator events. State the reproducible transaction facts without treating the outcome alone as proof of a particular attacker’s identity.
Preserve evidence before revocation
Record the approval hash, spender, asset contract, allowance, time, suspicious domain and signing screen. Then use the wallet or the relevant explorer’s approval checker to revoke the permission. Revocation is an on-chain transaction and normally requires network fees. If the device or key may also be compromised, revocation alone is insufficient.
Review every chain used
The same EVM address can have separate permissions on Ethereum, BNB Chain, Polygon, Arbitrum and other networks. TRON and Solana use different account and permission models. Build an inventory of networks, assets and dapps and review each one rather than treating one successful revocation as complete containment.
Common mistakes
- Disconnecting a dapp is not allowance revocation.
- No immediate balance change does not make a signature safe.
- Revoking one token does not secure every token and NFT.
- Stop immediately if an unknown tool requests a seed phrase.
Sources: ethereum.org token access guide; MetaMask allowance guide. Reviewed 2026-08-03.