Crypto Token Approval Exploit List

approval-exploit-list contains a list of known crypto exploits that abuse token approvals in order to steal funds from users.

Check if you are affected by these exploits

Revoke.cash offers a tool to check if you are affected by any of these exploits. You can find it here.

Format

Every exploit is one JSON file, exploits/<slug>.json. The slug uses lowercase letters, digits and single hyphens, and it is also the page URL: https://revoke.cash/exploits/<slug>. index.json lists every slug, sorted by file name.

Field	Type	Meaning
name	string	The name of the exploit.
description	string	One short paragraph in English. Markdown is allowed.
longDescription	string, optional	Up to 3 paragraphs in English, separated by a blank line. Markdown is allowed.
date	YYYY-MM-DD	The day the exploit started.
amount	number or null	The amount stolen, in millions of USD (0.1 is $100k). null while the amount is unknown, for example while the exploit is still ongoing.
fixed	boolean, optional	true when the addresses are no longer dangerous, for example after the contract was upgraded. A missing value means false.
addresses	array	At least one { "chainId": number, "address": string }: the approved addresses that users should revoke. chainId is an EVM chain ID, and address is a checksummed 0x address.
metaArticleUrls	array of strings	Links to write-ups or transactions. Can be empty.

A file has no other fields. EXPLOIT_TEMPLATE.json is a starting point for a new file.

Fields are never renamed or removed. New optional fields can be added, so ignore any field that you do not know. If you read the list from your own code, fetch index.json and the files from a pinned commit and cache them, instead of fetching main on every request.

The data/ folder is a one-time export from 2025 of the revocations made on Revoke.cash for these exploits, with the losses they prevented. It is not updated and is not part of the format.

Report an exploit

Issues are turned off in this repository. To report a new exploit or a correction, open an issue in the revoke.cash repository. Include the affected addresses and chains, the date, and links to write-ups or transactions. We will check the information and add it to the list. You can also open a pull request that adds or changes a file in exploits/, with its slug in index.json.

Report new Exploit

Useful Sources

To create the initial list of exploits, we used sources from several companies. The most important ones are listed below:

• Neptune Mutual
• SlowMist
• Rekt.news
• Halborn
• ScamSniffer
• Peckshield