Token approvals: they remain active until revoked
Crypto permissions granted to a contract remain active until you revoke them. Starting May 5, 2026, attackers exploited this rule. They stole approximately $1.42 million from 31 addresses, thanks to permissions granted to an Ekubo protocol router. The main victim had granted theirs 158 days earlier, according to the founder of SlowMist.
$1.42 million: what attackers stole starting May 5, 2026, by exploiting approvals granted to an Ekubo router.
158 days: how long the unlimited approval had been active when it cost the main victim around 17 WBTC.
60%: the share of unlimited approvals on Ethereum, according to a 2022 study of transactions through July 2021.
May 6, 2026: a day after the first theft, Ekubo’s founder proposed ERC-8255, with approvals that expire by default.
A crypto permission doesn’t end with the transaction
To swap a token in a decentralized application, you first sign a permission. This message allows a contract to withdraw your tokens on your behalf. The ERC-20 standard provides that it can do so “multiple times, up to the amount” specified. However, your wallet doesn’t always show you what you’re signing, as our article on clear signing explained.
In particular, this permission has no end date. The official ethereum.org guide to revoking permissions puts it plainly: “There is no expiration date on contract approvals.” So they can remain usable years later.
Disconnecting from the site doesn’t change anything either. The permission is stored in the token contract on the blockchain, not in your browser. According to the same guide, the project retains access to your tokens after you disconnect. Your digital wallet holds your keys, not your permissions. So you need to revoke the permission to cut off that access.
$APE
$TOKEN
$BLOK.ETF
#tokens
Crypto permissions granted to a contract remain active until you revoke them. Starting May 5, 2026, attackers exploited this rule. They stole approximately $1.42 million from 31 addresses, thanks to permissions granted to an Ekubo protocol router. The main victim had granted theirs 158 days earlier, according to the founder of SlowMist.
$1.42 million: what attackers stole starting May 5, 2026, by exploiting approvals granted to an Ekubo router.
158 days: how long the unlimited approval had been active when it cost the main victim around 17 WBTC.
60%: the share of unlimited approvals on Ethereum, according to a 2022 study of transactions through July 2021.
May 6, 2026: a day after the first theft, Ekubo’s founder proposed ERC-8255, with approvals that expire by default.
A crypto permission doesn’t end with the transaction
To swap a token in a decentralized application, you first sign a permission. This message allows a contract to withdraw your tokens on your behalf. The ERC-20 standard provides that it can do so “multiple times, up to the amount” specified. However, your wallet doesn’t always show you what you’re signing, as our article on clear signing explained.
In particular, this permission has no end date. The official ethereum.org guide to revoking permissions puts it plainly: “There is no expiration date on contract approvals.” So they can remain usable years later.
Disconnecting from the site doesn’t change anything either. The permission is stored in the token contract on the blockchain, not in your browser. According to the same guide, the project retains access to your tokens after you disconnect. Your digital wallet holds your keys, not your permissions. So you need to revoke the permission to cut off that access.
$APE
$TOKEN
$BLOK.ETF
#tokens