Manage your token approvals and protect yourself from scams on 100+ networks. Founded by @RoscoKalis.
Amsterdam, The Netherlands
Joined February 2022
- Tweets3.5K
- Following55
- Followers85.2K
- Likes15.8K
Pinned Tweet
You've asked for a multichain dashboard for years.
Today, it's finally here as the centerpiece of our new paid plans: Revoke Premium & Revoke Ultimate!
Premium brings 100+ networks into one dashboard.
And Ultimate adds automated revoking.
Everything you use today stays free.
Blur is sunsetting. Your approvals aren't.
The Blur app shuts down Nov 12 and Blend stops new loans. NFT approvals to their contracts stay active until you revoke them.
Done with Blur? Clean up at revoke.cash. We now flag all Blur and Blend contracts as deprecated.
Revoke.cash retweeted
As with other deprecated NFT marketplaces, you should revoke all open approvals to Blur and its products no later than November 12th.
Deprecated protocols receive little to no security support and auditing and hackers know it
Use @RevokeCash to clean up active approvals
Revoke.cash retweeted
Last month, the contracts powering Magic Eden were exploited to the tune of millions of dollars. I was lucky enough to be in a position to rescue a good portion of that, but it highlighted the danger of leaving approvals open as adversaries get access to better and better tools for finding holes in contract logic.
Today, Blur announced that they will be deprecating their frontend.
I've investigated Blur and found no exploits within the current contracts. However, the Blur contracts are upgradable, meaning that they could turn malicious at any time.
They currently have eight figures worth of NFTs approved to them. The safety of those NFTs effectively hinges on the opssec of the Blur team, which appears to be disbanding at this time.
If you have open approvals to Blur, I recommend you remove them immediately. Use revoke.cash or similar to ensure that you are protected in case of a contract exploit or later upgrade.
Don't wait. The time is now.
Superboard just added a quest to help users learn about revoking token approvals.
If you want to explore web3 and security through fun quests, check out the Revoke quest below 👇
Meet @RevokeCash, a tool to check and revoke token approvals.
See what you’ve approved, clean up old permissions, and keep your wallet safer.
Join → superboard.xyz/quests/explor…
Revoke.cash retweeted
PSA for new Revoke Ultimate subscribers 🛡️
After last week's Magic Eden exploit, we've seen quite a few new Ultimate subscribers.
Thank you for the trust! Please take 2 minutes to check your setup. Auto-Revoking can only protect a wallet when both of these are true:
1. You granted auto-revoke permissions for that wallet in MetaMask
2. Your wallet is a MetaMask smart account on that network
Step 2 usually happens automatically during step 1. But the upgrade can fail (e.g. if you've already upgraded to a smart account with another wallet).
How to check:
→ Go to revoke.cash/account
→ Open the Auto-Revoking section
→ Look for a yellow warning banner or a ⚠️ icon next to a network. Each one marks a network where you are NOT protected yet.
How to fix it:
→ Switch the account to a smart account in MetaMask
→ If a different wallet app already upgraded your address, switch it back to a regular account in that app first. Then upgrade it in MetaMask.
Also check that every network you use is toggled on, and that each wallet in your subscription granted its own permissions.
If something is unclear, our DMs and Discord are open 🙏
Revoke.cash retweeted
Beware of lowlife losers trying to further exploit victims by piggybacking the recent exploit to lure people onto piggyback phishing sites.
Use revoke.cash to revoke approvals, anything else somebody sends you is probably a scam.
Revoke.cash retweeted
#ALERT 🚨 scammers are in the DMs of limitbreak exploit victims pushing a website “signature(.)site” to revoke permissions on their wallet. DO NOT use this website for obvious reasons.
Use @RevokeCash to revoke ANY AND ALL permissions safely. Stay vigilant.
#cybersecurity
PSA for new Revoke Ultimate subscribers 🛡️
After last week's Magic Eden exploit, we've seen quite a few new Ultimate subscribers.
Thank you for the trust! Please take 2 minutes to check your setup. Auto-Revoking can only protect a wallet when both of these are true:
1. You granted auto-revoke permissions for that wallet in MetaMask
2. Your wallet is a MetaMask smart account on that network
Step 2 usually happens automatically during step 1. But the upgrade can fail (e.g. if you've already upgraded to a smart account with another wallet).
How to check:
→ Go to revoke.cash/account
→ Open the Auto-Revoking section
→ Look for a yellow warning banner or a ⚠️ icon next to a network. Each one marks a network where you are NOT protected yet.
How to fix it:
→ Switch the account to a smart account in MetaMask
→ If a different wallet app already upgraded your address, switch it back to a regular account in that app first. Then upgrade it in MetaMask.
Also check that every network you use is toggled on, and that each wallet in your subscription granted its own permissions.
If something is unclear, our DMs and Discord are open 🙏
Revoke.cash retweeted
REVOKE YOUR APPROVALS
Even if you were not affected on 9/25, you could still be at risk.
PPV2 exploit is still ongoing. Just an hour ago, 0x3B13...3327 lost 0.15246 WETH just one block after receiving it after accepting an offer.
The exploiter tipped 99% of it to Titan Builder and kept only 0.0015 ETH, so there's no way to even reasonably frontrun these to rescue funds.
Keep spreading the word.
Last year we partnered with @pudgypenguins to create a SBT to reward proper wallet security practices. Initially this SBT was only accessible to Pudgy Penguins holders, but today we are opening it up to EVERYONE!
To claim it, you need to enter a cold wallet address with no token approvals. Here's how to claim it:
1. Visit revoke.cash/cold-storage-sbt
2. Enter your eligible wallet address
3. Pass the security quiz
4. The SBT will be sent to your wallet
No wallet connection needed!
Revoke.cash retweeted
The Pudgy Penguins x Revoke Cold Storage Soulbound Token is now claimable by ANYONE!
We launched this SBT last year to protect Pudgy Penguin holders from having dangerous approvals that are frequently exploited.
Last week, everyone saw how important these smart contract approvals are and we are glad that relatively few Penguins were negatively impacted.
In expanding eligibility beyond Pudgy Penguin NFT holders, this SBT is now claimable to any active wallet with 0 open approvals and that passes our short quiz on cold storage.
Already have approvals? Go revoke them, and you'll qualify.
We care deeply about security and safety in NFTs and hope we'll see NFT holders from all communities improve their security and earn a Pudgy Penguins badge at the same time.
Take 5 minutes today, go earn your SBT, and get a permanent reminder to revoke your approvals for years to come!
How to claim your Cold Storage SBT:
1. Visit revoke.cash/cold-storage-sbt
2. Enter your eligible wallet address
3. Pass the security quiz
4. The SBT will be sent to your wallet
The best time to revoke is before an exploit happens.
The Payment Processor approvals drained this week were mostly from 2024. They had been stale for over a year. $2.8M+ stolen so far.
Revoke Ultimate auto-revokes approvals older than 180 days. Subscribe for peace of mind.
This year we've started monetisation, but at heart we are still a public good, working hard to prevent losses.
If you want to support us on that mission, please subscribe to our new paid plans, use our paid batch revoke functionality, or donate directly to revoke.eth 🫡
Wallets that revoked their Magic Eden / Limit Break Payment Processor approvals before the attack kept $3.9M in NFTs and tokens safe, including 70 Bored Apes and 220 WETH.
Make sure to check if you're safe: revoke.cash/exploits/magic-e…
Wallets that revoked their Magic Eden / Limit Break Payment Processor approvals before the attack kept $3.9M in NFTs and tokens safe, including 70 Bored Apes and 220 WETH.
Make sure to check if you're safe: revoke.cash/exploits/magic-e…
This data was gathered using the exploit stats scripts in our open source github repository and can be verified independently: github.com/RevokeCash/revoke…
With today's Limit Break / Magic Eden exploit, we've had several users request support for Glyph. In this time it's important that *everyone* can revoke approvals, so we've quickly added Glyph as a supported option. 🫡
Revoke.cash retweeted
Magic Eden shut down their EVM marketplace yesterday.
But approvals don't disappear when platforms do.
Your NFTs and tokens are one compromised contract away from being drained.
So we added a Magic Eden label on Revoke.cash - to find and revoke them in seconds.
Revoke.cash retweeted
We are sharing an interim update regarding an exploit identified with @limitbreak Payment Processor V2, a NFT trading protocol maintained by the company Limit Break and which Magic Eden adopted to settle trades on EVM in 2024.
Magic Eden stopped using Payment Processor V2 in Oct 2024 and ceased our EVM marketplace altogether in Q1 2026. No live Magic Eden listings were impacted in this exploit. We will provide more updates as we investigate the impact further.
We are also contacting Limit Break as they are the owner & maintainer of the protocol to see what other mitigations can be done, including progress on pausing transfers on the protocol. Thank you to @0xQuit for the whitehat rescue and for bringing this to our collective attention: xitter.cf/0xQuit/status/21034106…
Why are ME listings being shown to be involved?
NFTs listed on ME EVM from approx Feb 2024 to Oct 2024 could be impacted by this issue with the Limit Break Payment Processor v2 contract. Any listings on ME EVM after Oct 2024 should not be impacted here. We are still further refining our investigation and will provide more updates here.
In the meantime, if you listed or traded NFTs on Magic Eden’s EVM marketplace before we shut it down, revoke this contract:
Limit Break: Payment Processor (V2)
0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834
Go through our instructions here: revoke.cash
Ethereum → filter that address → revoke every NFT “approved for all” row
Repeat for the following chainsPolygon
Base
See also 0xQuit’s tweet on revocation for further reference also: xitter.cf/0xQuit/status/21034106…
NOTE: Revoking does not return tokens that already moved.
Again, we will keep the community updated as we investigate further.
Payment Processor V2 on Ethereum: 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834
Payment Processor V3 on ApeChain: 0x9a1D00000000fC540e2000560054812452eB5366
use revoke.cash or similar.