MetaMask token approval scam how to check and revoke
A token approval scam is one of the most common ways users lose crypto. The mechanism itself is not malicious. It is how Ethereum and compatible chains let you spend tokens inside smart contracts. The danger is that many users approve an unlimited amount without understanding what they are signing.
This page explains the approval system. It describes how scammers trick you. It then walks through checking and revoking active allowances using Revoke.cash and Etherscan.
What is a token approval?
When you interact with a DeFi protocol, a marketplace, or any dApp that moves your tokens, that contract needs permission to spend them. You grant this permission via an approval transaction. The approval sets an amount. That amount can be a specific number, or it can be the maximum possible - a so-called unlimited allowance.
An unlimited allowance means the contract can spend your entire balance of that token, now and in the future, until you revoke it. That is convenient if you trade frequently. It is catastrophic if the contract turns out to be malicious.
How scammers exploit approvals
Scammers use several techniques to get you to grant a harmful approval.
Fake airdrop tokens. A scammer sends you a worthless token with a familiar name like “USDC” or “UNI.” The token often has a misleading symbol and a custom logo. When you try to sell or swap it, the dApp you use asks for an approval. That approval is for a malicious contract, not the real token. Once granted, the contract drains the genuine token from your wallet.
Phishing sites posing as DeFi protocols. A site mimics the look of a real protocol like Uniswap, Curve, or OpenSea. It might appear via a search ad or a direct link. The site prompts you to “connect wallet” and then requests an approval. The approval is for a contract controlled by the scammer. They take everything you approve.
Permit signature attacks. Some tokens support a feature called “permit,” which lets you sign a message off-chain to grant approval. The scammer tricks you into signing a permit message, often by making it look like a gasless swap or a login request. That signature alone can give them the power to spend your tokens without any on-chain transaction you see.
Check your active approvals
You need to audit your wallet’s allowances. Two widely used tools make this straightforward.
Using Revoke.cash
Go to revoke.cash. Connect your wallet. The site scans the blockchain for every active token approval your address has made. It shows the token, the spender contract, and the allowance amount.
You can then revoke any approval with a single transaction. This costs gas. Revoke the ones you do not recognise or use.
Using Etherscan token approval tool
Open Etherscan and paste your wallet address. Click the “Token Approvals” tab under the “More” menu. Etherscan lists allowances for tokens on Ethereum. You can revoke directly from the tool. The interface is similar to Revoke.cash but focused on Ethereum only.
Both tools are free. Both require you to confirm the revocation transaction in MetaMask.
When you should revoke
Revoke before interacting with a suspicious token. If you receive a token you did not ask for, do not swap it. Do not try to sell it. The approval step is the trap. Instead, check your allowances for that token’s contract address. If an approval exists, revoke it. Then ignore the token.
Revoke after using a new or obscure dApp. Even legitimate protocols can have bugs or be exploited later. A post-use cleanup removes the risk.
Revoke any approval you do not remember granting. Scammers sometimes sneak approvals into complex transaction bundles.
What lingose.games is
As of August 31, 2026, lingose.games is a website. That is all the available information supports. No on-chain project was found when searching for “lingose.” No liquidity pair. No contract. No launch. The site exists, but nothing on a blockchain ties to it yet.
Do not assume anything about lingose.games based on this page. Treat any token claiming to be linked to it as you would any other unverified asset. Check approvals. Revoke if uncertain.
The bottom line
Token approvals are necessary for DeFi. Unlimited ones are a serious risk. Scammers exploit them constantly. The fix is simple: audit your approvals regularly, especially before touching any token you did not expect. Revoke.cash and Etherscan are reliable tools for the job.
Act as if every unknown token is a trap. That instinct will protect your funds more than any tool.
Not financial advice. lingose.games publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.