How to Revoke Token Approvals on BNB Chain to Prevent Drainer Attacks

30 October 2026

If you have ever approved a BEP-20 token for spending by a smart contract - which you must do to trade, lend, or stake on BNB Chain - that approval can be exploited if the contract turns malicious or contains a vulnerability. A drainer attack uses your existing approval to transfer tokens from your wallet without further permission. You prevent it by revoking the approval, which removes the contract's permission to move those tokens.

Why approvals are dangerous

Approvals are a standard part of the BEP-20 token standard, the same mechanism used on Ethereum's ERC-20. When you interact with a decentralized application (dApp) like PancakeSwap, Venus, or an unfamiliar token swap, the dApp asks you to authorize a specific contract to spend a certain amount of your tokens. You sign a transaction that records, on the BNB Chain, that contract address A is allowed to move up to X amount of token B from your wallet.

Once approved, the contract can pull those tokens in a future transaction without you signing again. That is how swaps work: the router contract takes your input tokens and sends output tokens back. But if the contract is malicious - or if its private keys are stolen - anyone controlling it can call the transfer function and drain your approved balance.

A drainer attack does not require you to click a "sign" button again. It only needs an existing approval with a high allowance, often set to the maximum possible value (e.g., 2^256 - 1) because many dApps request infinite approval for convenience.

Where to check your approvals

You can view all current token approvals for your BNB Chain address using BscScan's "Token Approvals" tool. Open BscScan, enter your wallet address, and click "Token Approvals" in the menu. The page lists every BEP-20 token you have approved, the spender contract, and the remaining allowance. You can revoke approvals directly from that page.

Alternatively, third-party tools like Revoke.cash or Unrekt.net provide the same service. They connect to your wallet, scan for approvals, and let you batch-revoke them. These tools read data from the blockchain; they do not take custody of your keys.

Step-by-Step: Revoking an Approval on BSC via BscScan

1. Go to BscScan.com and connect your wallet (MetaMask, Trust Wallet, or any Web3 wallet that works with BNB Chain). Click "Connect to Web3" on the top right.

2. Enter your wallet address in the search bar, or let BscScan auto-detect it after connection. Navigate to the "Token Approvals" tab under the "More" dropdown on your address page.

3. Review the list. Each row shows the token contract, the spender contract (the dApp), and the current allowance. Sort by allowance size to spot suspicious entries - an allowance set to a very large number, such as 1,000,000,000,000 or more, is often an infinite approval.

4. Click "Revoke" next to an approval you want to remove. BscScan will open a transaction request in your wallet. The action calls the approve function on the token contract with a new allowance of zero.

5. Confirm the transaction. You must pay gas fees (BNB) for this transaction, just like any other BSC transaction. The cost is typically the same as a simple transfer - around 50,000 to 100,000 gas units, which at current gas prices is a small amount. The exact fee depends on network congestion; check current gas prices on BscScan's Gas Tracker before proceeding.

6. Wait for confirmation. Once the transaction is mined, the approval is revoked. The spender contract can no longer move that token from your wallet.

How to prevent future drainer attacks

• Never approve infinite allowances unless you fully trust the contract. Use the "custom" allowance option in your wallet to set a specific amount, such as the exact number of tokens you intend to swap. Most wallets support this in the transaction confirmation screen.

• Revoke approvals for dApps you no longer use. Old approvals from abandoned projects or test interactions are a common attack vector.

• Use a hardware wallet for high-value accounts. While revoking approvals works the same way, a hardware wallet adds a layer of physical confirmation for every transaction.

• Monitor your approvals regularly. Check BscScan's approval viewer once a month, or after using a new dApp.

What revoking does not protect against

Revoking approvals only removes future permission for a specific contract. It does not reverse a past transfer that already occurred. If a drainer already moved your tokens using a valid approval, revoking will not bring them back. It also does not protect against other attack types such as phishing that tricks you into signing a malicious transaction, or direct private key theft. Keep your seed phrase and private keys offline.

Back to bnb chain