Token Approvals: They Stay Active Until You Revoke Them

Crypto authorizations granted to a contract remain active as long as you don’t withdraw them. From May 5, 2026, attackers exploited this rule. They withdrew approximately 1.42 million dollars from 31 addresses, thanks to authorizations given to a router of the Ekubo protocol. The main victim had granted theirs 158 days earlier, according to the founder of SlowMist. To exchange a token on a decentralized application, you first sign an authorization. This message thus allows a contract to withdraw your tokens on your behalf.