Token approvals are one of crypto’s quietest risks. Every time you trade, lend, or mint on a decentralized app, you hand that app permission to move tokens out of your wallet. If you never clean those permissions up, a compromised contract — or a fake lookalike site — can drain funds you thought were safe.
That’s why learning how to spot fake revoke cash site lookalikes matters. The real Revoke.cash is a handy tool for reviewing and cancelling token approvals, but scammers build near-identical copies to trick you into signing malicious transactions instead. In this guide, you’ll learn what the real tool does, how fake sites drain wallets, the five checks that separate the genuine site from a phishing copy, what to do if you connected to a fake one, and a safe revoking routine you can follow every month.
id=”what-revoke-cash-does”>What Revoke.cash Actually Does
Revoke.cash is a free token-approval management tool. Type its address into your browser yourself — never click a link someone sends you — and it shows every approval your wallet has granted: which tokens, which contracts, and how much they can move. From that dashboard you can cancel (revoke) approvals you no longer need, usually by submitting a small on-chain transaction that sets the allowance back to zero.
The tool exists because of how the ERC-20 standard works. Most dApps ask for an unlimited approval the first time you use them, meaning that contract can move any amount of that token from your wallet at any time until you revoke it. That’s convenient, but it turns every approved contract into a potential target. If one of them gets exploited, the attacker’s first stop is wallets with live unlimited approvals. If you want the deeper mechanics, read our guide on how to avoid unlimited token approvals.
Two things the real tool will never do: it will never ask for your seed phrase, and it will never ask you to “upgrade” your wallet or connect twice. Keep that in mind — it’s the baseline every check below builds on.
How Fake Sites Drain Wallets
A fake Revoke.cash site looks exactly like the real one. Same layout, same colors, sometimes even a working-looking list of your approvals. The difference is invisible: the buttons on the fake site don’t send a revocation transaction. They ask your wallet to sign a malicious approval — often hidden inside what looks like a normal signature request.
Here’s the typical attack sequence. You search for the tool, click the top result (which may be a paid ad), and land on something like revokke.cash or revoke-cash.app. You connect your wallet. The site shows a plausible dashboard. Then a popup asks you to sign a “permit” message to “verify” your wallet or “refresh” approvals. That signature is actually an off-chain authorization — under standards like EIP-2612 or Seaport orders — that lets the scammer’s contract pull your tokens. No on-chain transaction appears until your funds are already gone, which is why these attacks are sometimes called silent drainers.
Scammers also distribute fake sites through social media DMs, fake airdrop announcements, and SEO-poisoned search results. The motive is simple: approval-revoking tools attract security-conscious users with valuable wallets, which makes the tool’s own name a high-value lure. This is the same playbook behind approval-drainer phishing campaigns targeting other tools too.
The 5 Verification Checks
Run through these five checks every time before you connect a wallet to any revocation tool.
Check 1: Type the URL yourself, then check the spelling. The genuine domain is revoke.cash — type it by hand. Scammers register lookalikes: double letters (revokke.cash), extra words (revoke-cash.net), different endings (revoke.cash.app, revoke-cash.io), and Unicode tricks that look identical on screen. Read the address bar character by character, not just the favicon or the page design.
Check 2: Bookmark the real site and never Google it. Attackers buy search ads and poison results for exactly these queries. The safest workflow is simple: verify the domain once using official social channels you type in yourself, bookmark it, and always arrive through the bookmark. If you must search, ignore the sponsored results at the top and look for subtle mismatches in the URL before clicking.
Check 3: Watch what the site asks you to sign. The real tool connects your wallet, displays approvals, and — only when you click a revoke button — proposes an on-chain transaction to that chain’s official approval manager. A fake site instead pushes unexpected signature requests: “verify wallet ownership”, “refresh your session”, or a permit message you didn’t initiate. Open your wallet’s signature preview: if the message mentions a contract you don’t recognize or grants allowances, reject it.
Check 4: Check the chain and contract details. When a revocation transaction is proposed, your wallet shows which contract you’re interacting with and on which network. Revocation transactions should go to the token contract itself (setting allowance to zero). If the destination contract is unknown, the network doesn’t match what you selected, or the transaction does anything beyond approval management, stop.
Check 5: Confirm through the official channels. The real project announces its only official domain on its verified social accounts and documentation. If you’re unsure about a URL, cross-check it there — typing those addresses in by hand, not clicking links. Treat any discrepancy as a no-go: a legitimate tool never needs three different “official” domains.
Real vs Fake: Side-by-Side Signals
| Signal | Genuine tool | Fake lookalike |
|---|---|---|
| URL | revoke.cash, typed or bookmarked | Lookalike domain: extra letters, words, or TLDs |
| Entry point | Your own bookmark or typed address | Search ad, DM link, airdrop announcement |
| Connection flow | Wallet connects, approvals listed | Connects, then pushes odd signature requests |
| Signature requests | None except standard revoke transactions you click | “Verify”, “permit”, or refresh messages you didn’t ask for |
| Transaction destination | The token contract (allowance set to zero) | Unknown contract or unexpected network |
| Urgency tactics | None — revoking can wait | Countdowns, “wallet at risk” banners, pressure to sign now |
| Official domains | One domain, confirmed on official channels | Multiple “official” domains or mismatched social links |
What to Do If You Connected to a Fake Site
First, don’t panic — but act quickly and in the right order. What matters is whether you signed something, not just whether you connected.
Step 1: Disconnect and close the site. In your wallet’s connected-sites settings, remove the site’s access, then close the tab. Disconnection alone doesn’t cancel a signed malicious approval, but it stops further interaction.
Step 2: Check what you signed. Open your wallet’s activity or signature history. If you only connected and signed nothing, you’re almost certainly fine. If you signed a permit-style message or approved a transaction to an unknown contract, treat it as compromised: the attacker may now hold an allowance on your tokens.
Step 3: Move funds to a fresh wallet. If a malicious approval exists, the attacker can pull approved tokens at any time — revoking after the fact may be too slow. The safest move is to transfer your funds to a brand-new wallet address (new seed phrase, written down offline) before attempting any cleanup. Start with the most valuable assets.
Step 4: Revoke the malicious approval — from the real tool. Once funds are safe, go to the genuine revoke.cash (typed by hand, bookmarked) and revoke any approvals you don’t recognize. This closes the hole so it can’t be used against future deposits to the old address.
Step 5: Watch the old wallet. Monitor the compromised address for a while. Some attackers wait days before draining. Never send new funds to the old address. If significant funds were lost, document everything — transaction hashes, timestamps, the fake URL — before deciding whether to report it.
A Safe Revoking Routine
Approval hygiene takes about ten minutes a month. Here’s a routine that keeps your exposure low:
1. Schedule a monthly review. Pick a day — the first of the month works — and audit every wallet you actively use. Old approvals from projects you tried once and abandoned are the most common forgotten risk.
2. Always arrive at the tool the same safe way. Use your bookmark or type revoke.cash by hand. Never arrive through a link in a DM, email, or social post, even from someone you trust — their account may be compromised.
3. Sort by risk, revoke generously. Unlimited approvals to contracts you no longer use should go first. Then approvals to projects that have since been exploited or gone quiet. Keeping an approval “just in case” is how wallets stay exposed for years.
4. Prefer limited approvals going forward. Wherever a dApp offers it, approve only the amount you need for that session rather than unlimited. Fewer live unlimited approvals means less for a fake site or an exploited contract to work with.
5. Use a separate wallet for risky interactions. Keep a small “hot” wallet for trying new dApps and airdrop claims, and your main funds elsewhere. If you ever connect the hot wallet to something shady, the damage is contained. This pairs well with general fake-airdrop awareness: the same scammers run both scams.
FAQs
The Bottom Line
Fake revoke.cash sites succeed because they borrow trust — a familiar name, a familiar layout — and convert it into a single careless signature. You don’t need to memorize every lookalike domain; you just need the five checks: typed URL, bookmarked entry, careful signature review, contract verification, and an official-channel cross-reference. Build the monthly revoking routine, keep risky experiments in a separate wallet, and treat every unexpected signature request as hostile until proven otherwise.
This guide is for education only — not financial advice.
