Token Approvals: They Stay Active Until You Revoke Them

Crypto authorizations granted to a contract remain active as long as you don’t withdraw them. From May 5, 2026, attackers exploited this rule. They withdrew approximately 1.42 million dollars from 31 addresses, thanks to authorizations given to a router of the Ekubo protocol. The main victim had granted theirs 158 days earlier, according to the founder of SlowMist. To exchange a token on a decentralized application, you first sign an authorization. This message thus allows a contract to withdraw your tokens on your behalf. The ERC-20 standard stipulates that it can do so “multiple times, up to the set amount” . However, your wallet does not always display what you are signing, as shown in our article on clear signing . Moreover, this authorization has no end date.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Cointribune.