TRC-20 approvals: how they are used to steal USDT and how to revoke them

What an approval is

TRC-20 tokens, including USDT, have an approve function. By signing it you say: “this address may debit up to N tokens from my wallet”. The approved address then calls the debit (transferFrom) itself, and no signature from you is needed for each debit.

This is a normal mechanism: swaps and other apps ask for an approval to perform an exchange. The problem is twofold. Many apps ask for an unlimited approval, and it stays valid until you revoke it — for years.

How it is used to steal

A scammer does not need your recovery phrase. One approve signature to their address is enough. Typical pretexts:

• “Claim an airdrop”, “collect a bonus”, “verify your wallet to withdraw”.
• A fake page of a swap or a well-known app.
• “Support” on Telegram asking you to connect your wallet to a site “for a check”.
• A site to “swap” fake USDT you received “as a gift”.

The wallet window looks routine: “Approve”, “Confirm”, sometimes increaseAllowance. A minute or a month later the approved address debits the whole token balance. The wallet asks nothing: the approval already exists.

How to see granted approvals

Approvals are stored on the blockchain, so they are visible by address without connecting a wallet. Paste your address into GuardPay /check: the report has a section on granted approvals — to whom, for which token and for what amount. Addresses that have already drained others are marked.

How to revoke, and why it needs a signature

Revoking an approval means sending the same approve function with amount 0 to the same spender. It is an ordinary transaction from your wallet, so:

1. You need to connect the wallet that owns the tokens and sign the transaction. Without the owner’s signature nobody can revoke — not us, not an exchange, not wallet support.
2. You need a little TRX or energy for the fee, as for any contract action.
3. One approval — one signature. TRON has no batch sending: “revoke all” means several signatures in a row.

GuardPay /revoke shows your address’s approvals read live from the contract and prepares the revoke in your own wallet: one signature per approval. Your keys and recovery phrase stay with you.

Before signing, check the wallet window: method approve, the token contract is the one you are revoking, the spender is the one you are revoking, the amount is 0. Revoke through a wallet or service you trust, and never enter your recovery phrase on a “revoke” site.

When revoking no longer helps

Revoking stops future debits but does not return what has already been taken. If money is gone, trace its path before it spreads across exchangers: what to do in the first hours.

And if what was stolen is not an approval but the whole key (you entered your recovery phrase on a site, downloaded a “wallet” from an unverified source), revoking is useless: the scammer has the key itself. Then urgently move what is left to a new wallet with a new phrase.

Habits that protect you

• Approve the exact amount of the deal rather than unlimited, if the app allows it.
• Keep your main funds in a separate wallet that you never connect to websites.
• Once a month, check your address in /revoke and revoke what you no longer use.