incident 2026-07-21
PhishingFake revoke sites, explained
Between 06:30 and 17:30 UTC, a search ad for a revoke tool led to revoke-check.example. The page listed each visitor's real approvals, read straight from the chain, and offered to revoke them all with no gas. The button asked for permit signatures that set new, unlimited allowances. 97 wallets signed while trying to be careful.
timeline utc
Eleven hours behind a search ad
- 06:30A sponsored result for revoke approvals starts sending searchers to revoke-check.example.
- 07:15The first visitor connects and sees all 14 of their approvals listed correctly, with a button to revoke them for free.
- 07:16They sign four permits, and the attacker uses them within a minute to take 6,200 USDC and 2.1 WETH.
- 11:40Victims report in support channels that revoking emptied their wallets, and some go back to the same page to try again.
- 17:30The ad is pulled after reports, with 97 wallets signed and about 640,000 USD in tokens gone.
A revoke is a transaction. It writes a zero allowance on chain, so it always costs gas, and the fake page made skipping that cost its selling point.
Every signature it collected named the same spender and the maximum amount. The page had just shown each visitor an accurate list of their approvals, so the button under that list did not look like a risk.
what a check would have shown
The same request, read by Presign
- Permit signature, not a revoke
- Unlimited allowance on 4 tokens
- Spender is not in your approvals
app.swapzone.exampleethereum · mainnet
3 flags03 / flagsapprove(spender, amount)
- Unlimited allowanceThe spender can move every USDC you hold, now or later.
- New contractThe spender was deployed 3 days ago.
- Unverified sourceIts code is not published, so nobody can read it.
A real revoke costs gas every time. If a cleanup tool offers to do it for free, it is asking you to sign something else.
