You revoked your approvals on Revoke.cash, but your assets were still drained. This usually isn't because the approvals weren't fully removed — it's because you overlooked another type of signature: the Permit2 off-chain signature. These signatures are never recorded on-chain, so you can't see them when you revoke approvals. Yet they remain valid, and hackers can use them anytime to call the Permit2 contract and steal your coins.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Step 1: Understand That On-Chain Approval Revocation and Off-Chain Signatures Are Two Separate Systems
【What to do】 Distinguish what kind of permission you are revoking and what it cannot cover.
【How to do】 Understand Permit2's two-layer design to find the layer you may have missed. Permit2 is built with two core contracts:
AllowanceTransfer (on-chain approval layer): This is the "approval allowance" you see on Revoke.cash. You gave the Permit2 contract unlimited token allowance, and the revocation cancels this layer — it leaves an on-chain transaction record.
SignatureTransfer (off-chain signature transfer layer): This layer completely bypasses allowances. You sign a Permit2 signature in EIP-712 format, granting "immediate transfer" permission to a
spender. The signature itself never goes on-chain.
Revoke.cash can only revoke the first layer (AllowanceTransfer) — it is completely useless against the second layer (SignatureTransfer) signatures. Once a hacker has your signature and it hasn't expired, they can directly call permitTransferFrom to empty your coins, without depending on the approval you revoked.
High risk: Permit2 signatures are signed off-chain. Hackers can save them and use them months later, and you'll never know. In a case recorded by Scam Sniffer, a user's $162,000 was drained 34 days after signing a phishing signature. When you later revoke approvals, that signature could have been sitting on the hacker's server all along.
Common failure reason: Many people think they are safe because Revoke.cash shows no active approvals. They never realize there is a whole "signature" dimension. Permit2's SignatureTransfer mode is designed to work without a hanging approval — meaning the signature is one-time-use. But until it gets used, it's a ticking time bomb that no approval scanner can detect.
Step 2: Check If You've Signed a Permit2 Phishing Signature
【What to do】 Determine if your wallet ever "clicked confirm" on a hacker's Permit2 signature.
【How to do】 Permit2 signatures typically contain these five fields:
Owner: Your wallet addressSpender: The authorized address (if you don't recognize it, it's phishing)Value: Amount authorized (oftenuint256.max— unlimited)Nonce: Signature counterDeadline: Expiration time
If you clicked "confirm" on a signature request from a suspicious "airdrop checker", "free claim", or an unknown website, and the wallet prompted a "Permit2" or "Permit" type signature, then you have signed such a signature.
You cannot find this signature on-chain because it was signed offline. Only after a hacker submits the signature and executes a transfer will you see a permitTransferFrom call recorded on the blockchain. Until that moment, no tool can detect its existence.
High risk: An attacker only needs you to sign a message that looks like a "login" to capture your Permit2 signature. You don't need to spend money, grant any allowance, or connect to a dApp — just clicking "sign" creates the risk. Many users are phished when they try to "check airdrop eligibility".
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Step 3: How to Block a Permit2 Signature (Remedies)
【What to do】 While no tool can directly "revoke" a signed Permit2 signature, you can still block its use.
【How to do】 Even if the signature exists, a hacker needs two conditions to use it: the signature hasn't expired + your wallet still holds enough assets. Your defense is to make those conditions fail:
Emergency asset transfer (if funds are still there): Immediately move all assets from that wallet to another safe wallet you control. The hacker's signature can only drain the old address; once it's empty, the signature becomes useless. This is the most effective block.
Check and revoke old approvals: Although signatures bypass approvals, Permit2 signature execution still checks the AllowanceTransfer layer's allowance. If you change the Permit2 contract allowance from unlimited to 0, a signature call will fail because of insufficient allowance. Do this through Revoke.cash.
Wait for the signature to expire: If the
deadlinefield has a set time, the signature expires automatically. But you don't know how much time is left, so don't simply wait.
How to verify the fix: After moving the assets, check on a block explorer that the old address balance is zero and the new address holds everything. Then, on Revoke.cash, confirm the Permit2 contract's allowance is zero. If you are not sure whether you've signed a phishing signature, it's still recommended to follow these steps — better safe than sorry.
