Token Approvals: They Stay Active Until You Revoke Them

Crypto authorizations granted to a contract remain active as long as you don’t withdraw them. From May 5, 2026, attackers exploited this rule. They withdrew approximately 1.42 million dollars from 31 addresses, thanks to authorizations given to a router of the Ekubo protocol. The main victim had granted theirs 158 days earlier, according to the founder of SlowMist. In Brief $1.42 million: that’s how much attackers drained starting May 5, 2026, using approvals users had granted to an Ekubo router. 158 days: the age of the unlimited approval that cost the main victim about 17 WBTC. 60%: the share of unlimited approvals on Ethereum, according to a 2022 study of transactions through July 2021. May 6, 2026: the day after the first drain, Ekubo’s founder proposed ERC-8255, a standard for approvals that expire by default. A crypto authorization does not stop with the transaction To exchange a token on a decentralized application, you first sign an authorization. This message thus allows a contract to withdraw your tokens on your behalf. The ERC-20 standard stipulates that it can do so “multiple times, up to the set amount”. However, your wallet does not always display what you are signing, as shown in our article on clear signing. Moreover, this authorization has no end date. The official ethereum.org guide on revocation states plainly: “There is no expiration date on contract permissions.” They can therefore be used years later. Disconnecting from the site does not change anything either. The authorization exists in the token’s contract, on the blockchain, and not in your browser. According to the same guide, the project therefore retains access to your tokens after disconnection. Your digital wallet does indeed keep your keys, not your authorizations. You must then revoke the authorization to cut this access. The amount then poses a second problem. Many applications request unlimited access, so as not to ask again at each exchange. A university study published in 2022 measured this on transactions made up to July 31, 2021. At the time, 60% of authorizations on Ethereum were for an unlimited amount. Crypto authorizations: what you think you accept When you validate an exchange, you think you authorize only that single operation. In reality, the authorization goes further. It allows the contract to take a token amount, at any time, until withdrawn. As long as the contract functions well, it only withdraws for your own operations. However, a code flaw can allow a third party to trigger the withdrawal. The authorization does not verify who calls the contract. It only checks that the contract has the right to take your tokens. Ekubo has revised its own explanation. On May 8, its report probably attributed large authorizations to users who raised the ceiling themselves.