Unlimited USDT approvals on TRON: how to check and revoke them
Short answer: search your TRON address on Tronscan and open the approvals list to see which contracts can spend your USDT and how much. Revoke anything you don't recognise or no longer use; that sends approve(spender, 0), a normal contract call that needs a little TRX. Unlimited approvals are how many drainers take USDT weeks after a visit to a fake site.
When you sign a TRC-20 approve(), you give another address permission to move your tokens, sometimes all of them, with no expiry. That’s how decentralised exchanges work, and it’s also how many TRON drainers take USDT weeks after the victim visited a fake site. Checking takes two minutes and revoking costs a little TRX. Here’s how to do both.
What an approval actually is
USDT on TRON follows the TRC-20 standard, which has two ways to move tokens:
transfer(to, amount): you send your own tokens. This is a normal payment.approve(spender, amount), thentransferFrom(you, to, amount): you give the spender an allowance, and from then on the spender can move your tokens up to that amount whenever it likes, without asking you again.
An allowance stays until it’s used up or you change it. An unlimited approval sets it to the largest possible number, so it never runs out. TRON’s own security guide tells users to treat unlimited approvals as high-trust and to revoke unused approvals regularly (TRON security and scam prevention guide).
How approvals get abused
- Fake energy rental. “Cheap energy” sites ask you to authorize the rental. The signature is really an unlimited USDT approval (imToken report #47).
- Airdrop and “verification” pages. Claim a reward, verify your wallet, check your AML score: the button you press signs an approval.
- “Receive payment” tricks. A buyer or employer sends a link to “accept” a USDT payment, and accepting is an approval.
- Old dApps. A real app you used once gets compromised, or its contract has a flaw, and every unlimited approval it holds becomes a way in.
The drain doesn’t have to happen straight away. Some drainers wait until the balance is worth taking, which is why people are surprised when USDT leaves a wallet they haven’t touched in months.
How to check your approvals
On Tronscan (works for any wallet)
- Go to tronscan.org by typing the address yourself. Don’t click a link from a chat or an ad.
- Search your TRON address (it starts with T).
- On the account page, open the approvals list. Tronscan’s help centre describes a list of approvals with each token, spender and amount, plus an approval change history (Tronscan help). The layout changes from time to time, so look for “Approval” or “Authorization”.
In TronLink
TronLink has Approval Management for viewing and cancelling contract approvals in the app (v4.20.0 and later). In the extension it’s under Wallet Management → Approval Management (TronLink help, DApp approval scam guide).
In imToken
In your TRX wallet, swipe the function bar and tap Revoke. It opens Tronscan connected to your wallet, where you open the approval section and cancel (imToken help).
In Trust Wallet
Trust Wallet has an Approvals tab with a revoke button (Trust Wallet), but its announcement doesn’t say which chains are covered. If your TRON approvals don’t show up there, use Tronscan.
What to look for in the list
| You see | What to do |
|---|---|
| A spender you don’t recognise | Revoke. If you can’t say what it is, it shouldn’t be able to spend your USDT. |
| An approval from an energy-rental, airdrop, “verification” or “AML check” site | Revoke now. None of these need to spend your tokens. |
| An unlimited approval to an app you stopped using | Revoke. You can approve again if you ever go back. |
| An approval to an exchange or lending app you use every week | Keep it if you trust it, or replace it with a limited amount. |
| An approval on a fake token (a “USDT” that isn’t the real contract) | It can’t touch your real USDT. imToken notes these can’t be revoked and don’t put real tokens at risk (imToken help). Just ignore the token. |
Real USDT on TRON is the contract TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t. Approvals on that contract are the ones that can move your real USDT.
How to revoke
- Open the approval list in Tronscan or your wallet’s approval manager, as above.
- Connect your wallet if asked. Check you’re on the real site first.
- Press cancel or revoke next to the approval. Your wallet asks you to sign a transaction that sets the allowance to zero:
approve(spender, 0). - Check the signing screen: the function should be
approveand the amount 0. If it asks for anything else, stop. - Confirm. A revoke is a normal contract call, so it uses bandwidth and energy. With no energy of your own, keep a few TRX in the wallet to cover the burn (Tronscan’s help notes this cost too).
If USDT has already been taken
- Revoke the approval anyway, so the spender can’t take USDT you receive later.
- If you also typed your seed phrase anywhere, assume the wallet is compromised. Create a new wallet and move what’s left.
- Check the account’s permissions on Tronscan in case the attacker also changed them. See TRON multisig scams explained.
- Report it with the transaction IDs, and ignore anyone offering paid recovery.
Approvals vs permissions: two different dangers
An approval lets one address spend one token from your account. A permission change (AccountPermissionUpdateContract) hands over control of the whole account. Both start with a signature you didn’t read carefully. Both are in our list of the 11 ways TRON wallets get drained.
How TronTransfer handles approvals
The TronTransfer relay never asks for an approval. To send USDT you sign two transactions: a plain TRX fee and a normal USDT transfer() to the recipient you chose. That’s how 2,059 transfers have run since July 2026. If any site claiming to be TronTransfer asks you to approve USDT, it isn’t us.
In TronTransfer Wallet (in development and early access, not yet released or audited), an unlimited approval request is a red warning that shows the spender and lets you lower the amount before signing. An Approvals screen lists every TRC-20 allowance on your account, highlights unlimited ones and offers a one-tap revoke through the normal review screen.
Sources
- TRON developer docs: security and scam prevention guide
- Tronscan help: approvals list and cancelling approvals
- TronLink help: Approval Management · DApp approval scam
- imToken help: revoke approvals · fake-USDT approvals · energy-rental approval scams (#47)
- Trust Wallet: control and revoke token approvals
Frequently asked questions
How do I check my USDT approvals on TRON?
Search your TRON address on Tronscan and open the approvals list on the account page, which shows each token, the spender address and the approved amount. TronLink (Approval Management) and imToken (the Revoke shortcut in the TRX wallet, which opens Tronscan) also let you view them.
How do I revoke a TRC-20 approval?
Open the approvals list on Tronscan or in your wallet's approval manager, connect your wallet, and cancel the approval. This sends approve(spender, 0) to the token contract. It is a normal contract call, so it uses bandwidth and energy and you need some TRX in the wallet.
Does revoking an approval get my stolen USDT back?
No. Revoking only stops future spending by that address. USDT that was already moved can't be pulled back. If your seed phrase or key may be exposed, move what's left to a new wallet as well.
Is an unlimited approval always a scam?
No. Decentralised exchanges and lending apps often ask for large or unlimited approvals so you don't have to approve every trade. The risk is that an unlimited approval never expires: if the app, or a fake version of it, is malicious or later compromised, it can take the full balance. Approve only what you need, and revoke approvals you no longer use.
Does TronTransfer ask for a token approval?
No. TronTransfer never requests approve(). You sign a TRX fee transfer and an ordinary USDT transfer() to your recipient, nothing else.