Recommended Free Tools
Do not assume an exploit affects every user of a protocol—or that your wallet is safe because you have no funds deposited there. Compare the affected contract addresses, networks and activity dates in the protocol’s verified incident notice with your own wallet activity. Then check both your current positions and balances and any approvals to the affected contracts.
1. Find the protocol’s verified incident notice
Start from a protocol website or social account you already trust, or verify the official domain independently. Do not follow an incident link sent in a direct message or posted in a reply: attackers often impersonate support teams during a crisis. Look for the project’s incident notice, post-mortem or user-specific warning, and note its publication time and any updates.
As an Amazon Associate I earn from qualifying purchases.
Record the details the notice gives you:
- The affected contract addresses and networks.
- The vulnerable component or feature, such as a router, pool or deposit contract.
- The relevant interaction or exposure window.
- Whether the contracts are paused, upgraded or still vulnerable.
- The project’s exact instructions for users, such as revoking a particular approval, withdrawing or migrating a position.
Use the current notice for that incident. A protocol may use different contracts on different networks, and a warning about one deployment does not establish that every deployment—or every user—is affected.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Check whether your wallet interacted with an affected contract
For each network named in the notice, review the potentially exposed wallet’s transactions in a chain explorer or through the protocol’s official interface. Compare the contract address involved in each transaction with the addresses in the notice, and check whether the interaction falls within the stated time window. If you used the protocol on more than one network, check each one separately.
#1 Best Overall
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
A protocol name alone is not enough to establish exposure. In its historical deposit-contract post-mortem, dYdX said wallets that had not interacted with the vulnerable contract were not affected. It reported that, when the exploit was discovered, 730 addresses had allowances and 180 held funds directly at risk. Those figures describe that incident at that time; they are not a general estimate of how many users an exploit affects.
If you are unsure whether a transaction involved the affected address, inspect its transaction details and recipient or contract address. Keep the transaction hash so you can verify what happened or share it with the project’s official support channel.
3. Check positions, balances and approvals
Look for funds in the affected component
Review positions and assets held in the specific pool, contract or feature named in the notice. That can include deposited tokens, liquidity-provider positions and receipt tokens representing a position. Also check wallet-held tokens or NFTs if the incident notice says an affected contract could spend them. An empty wallet balance does not by itself show that an on-chain position is safe.
Look for permissions to the affected spender
An approval or allowance lets a named contract spend a specified amount of a token; NFT permissions can work differently depending on the token standard. On each affected network, compare the spender address in your approval list with the exact address in the official notice. Check the token or NFT involved and the amount or scope of permission.
Rank #2
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
ethereum.org’s “Scam help & reporting” guidance identifies Revoke.cash, Revokescout and Etherscan’s Token Approval Checker as ways to inspect and revoke approvals. Tool coverage can differ by network and permission type, so first confirm that the checker supports the chain and asset you need to inspect. An approval checker answers a permissions question; it does not establish that a protocol position, private key or signed message is safe.
Seeing an approval does not, on its own, prove that funds were taken. Conversely, not seeing an approval in one checker does not settle other risks. Use the incident notice to determine what exposure the exploit involved.
4. Match your response to the risk the notice describes
If a specific approval is still exploitable
Follow the project’s current, address-specific instructions. If they say a permission remains dangerous, use a trusted approval interface to revoke that permission, check the network, token and spender shown before signing, and verify the revocation transaction in a chain explorer. Recheck the permission afterward. A revocation is an on-chain transaction; the interface’s display alone is not proof that it completed.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Do not revoke every permission blindly or assume the same instruction applies to every exploit. In its huff-router incident report, Ekubo said its affected deployments were immutable and still vulnerable, and told users to revoke infinite approvals to the specified HuffRouter deployments. The report said non-infinite approvals had been whitehatted out. That guidance applied to those deployments and that incident, not to unrelated contracts.
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
If your assets are in an affected position
Use the protocol’s verified notice for the action it specifies, such as whether to withdraw or migrate. Do not interact with a replacement contract or migration page found through an unsolicited message. If the project’s instructions are unclear or the contract may still be vulnerable, seek clarification through a verified official channel before approving a new transaction.
If a recovery phrase or private key may be exposed
Treat suspected key compromise separately from a contract approval. Revoking an allowance does not secure an exposed wallet. ethereum.org advises moving remaining funds to a new, secure wallet if the old key is compromised. Create the new wallet through a trusted route and do not enter the old recovery phrase into a site claiming to scan, secure or recover your funds. A hardware wallet can help protect new keys, but it cannot repair an already exposed key.
Revoking an approval also cannot undo a completed transfer or guarantee that every signature-based risk has been canceled. OWASP’s Smart Contract Security incident-response guidance warns that delayed secondary drains can occur when a drainer kit has already obtained additional signatures. Follow incident-specific instructions and remain alert to unexpected wallet activity.
5. Preserve evidence and avoid recovery scams
Save relevant transaction hashes, wallet and contract addresses, timestamps, screenshots and communications. Share details only through channels you have independently verified. Never disclose a recovery phrase or private key: ethereum.org’s “Ethereum security and scam prevention” guidance says not to share them for any reason.
Rank #4
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
ethereum.org’s “Scam help & reporting” guidance says confirmed Ethereum transactions are final and no central authority can reverse them or recover stolen funds. If an explorer trace suggests stolen assets reached a centralized exchange, it recommends contacting that exchange’s support promptly with transaction details. Reporting may help with warnings or investigations, but it is not a promise of recovery. Do not pay an unsolicited recovery agent.
How to judge an approval checker or incident page
Use approval tools to inspect permissions, but rely on the protocol’s current disclosure to define incident scope. Before signing a revocation or other transaction, check:
- Network and permission coverage: Does the tool support the chain and token or NFT permission type involved?
- Address match: Can you compare the displayed spender with the exact affected address in the incident notice?
- Read and write steps: Can you inspect the permission before signing, then verify the resulting transaction and allowance afterward?
- Incident status: Does the project say whether the deployment is still vulnerable and whether users should revoke, withdraw, migrate or take another action?
- Transaction details: Does the wallet prompt show the intended network, token and spender?
Revoke.cash’s approval-hack tracker provides examples of approval-related incidents and chain-specific directions, but an incident list may be incomplete. It is supplementary context, not a substitute for the affected project’s current instructions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
