Signed a scam approval with Ledger? Check the affected account, token and network, revoke the exact allowance, and recognize recovery-phrase compromise.
Signing a malicious token approval with Ledger does not, by itself, give someone every account on the device. A standard ERC-20 allowance concerns one token contract, one account and one spender on one network. But that is a conditional answer: first establish what you signed. A stolen recovery phrase, a transfer and an approval need different responses. Ledger's security guidance recommends revoking malicious allowances and treating suspected recovery-phrase exposure separately.
The distinction matters in a first-hand Ledger user's question: after visiting a fake trading site and losing ETH, they worried about other accounts and future transactions. The post does not establish the exact transaction type. A reply cannot certify their wallet's safety, and neither can the word “connected” alone.
This guide covers standard Ethereum and EVM token allowances in Ledger-connected accounts. It does not apply the same procedure to Solana, or diagnose an individual theft from a forum description. Official instructions checked November 11, 2026.
Check the account and permission before buying another device
Keep a private record of the affected public account address, network, suspicious transaction and time. Open the correct chain's explorer independently and inspect the transaction and token approval history. Do not revisit the scam site to investigate.
For an ordinary ERC-20 approval, identify the token contract, owner account, spender and remaining allowance. The ERC-20 standard defines approval as permission for a spender to withdraw from that owner up to a stated amount. The contract records that permission; it is not a device-wide setting.
| What you can establish | What it means | Next check |
|---|---|---|
| A standard ERC-20 allowance exists | That spender has permission over that token from that account, within the allowance | Revoke the unwanted permission on that network |
| A transfer is confirmed | Assets moved; the transfer itself does not establish an ongoing ERC-20 allowance | Check separately for other approvals or signatures |
| The recovery phrase was entered into a site or shared | Account-by-account allowance checks are insufficient | Use the compromise branch below |
| You cannot identify the request | Its scope remains unknown | Stop signing and contact official Ledger support |
MetaMask and Ledger Wallet can display the same underlying address. Check the address rather than assuming two app names mean two separate accounts. Conversely, a standard allowance from Account A is not an allowance from Account B just because both use one Ledger. This follows the owner-and-spender scope in ERC-20; it does not prove that no other harmful requests were signed.
Can the scammer take tokens I receive later?
Yes, an unwanted allowance can remain relevant after the first loss. If permission remains, receiving more of the same approved token into that account on that network can expose it again, up to the remaining allowance. An empty balance is not a revocation.
An unlimited allowance is also different from “all assets.” MetaMask explains that a token approval concerns a specific token type. NFT operator approval can cover a whole collection associated with one contract. Do not interpret either as a blanket permission over every coin on every chain.
Disconnecting the site or unplugging Ledger does not remove an allowance already recorded on chain. Revoke.cash's FAQ explains why hardware key protection does not stop an approved spender: it does not need your key or a fresh device confirmation to use the existing permission.
Inspect first, then revoke the exact unwanted allowance
Open Revoke.cash's Ethereum checker yourself. Its public-address search lets you inspect an account before connecting a wallet. Select the network where the suspicious activity occurred; Ethereum results do not answer a Base or BNB Chain question.
Original browser capture of Revoke.cash's public checker, November 11, 2026. No address entered, wallet connected or transaction signed. Source: Revoke.cash.
Revoke.cash's instructions describe sorting recent approvals and filtering by spender. Match the token contract and spender to your evidence, rather than trusting a familiar logo. Looking up an address is a read-only check; revoking is an on-chain transaction and costs network gas.
For the Ledger signing stage, follow its current Revoke.cash guide. It directs users to select the allowance and choose Revoke, then review the transaction on the device with the Ethereum app open. For an ERC-20 revocation, Ledger says the token Amount should be 0. Stop if the request, account, chain or device details do not match the intended revocation. Never enter a recovery phrase into a checker.
After confirmation, recheck that permission: Ledger says the revoked allowance disappears from the list. A pending transaction or wallet popup is not completion. Revocation cannot reverse tokens already transferred, and an attacker may act before it confirms.
An empty approval list is not an all-clear
If the suspect request was a signed message, retain that distinction. EIP-2612 permit signatures can be signed off chain and activated later. A checker cannot see an unsubmitted signature. Do not conclude “nothing happened” solely because the current allowance list is empty; ask official support to help identify the request without sharing secrets.
If the phrase leaked or fresh gas disappears
A recovery phrase controls accounts derived from it. Creating another account from that same exposed phrase, changing an app password or buying a second Ledger and restoring the old phrase does not remove the attacker's access. Revoke.cash's compromise guidance distinguishes this from a revocable token allowance.
If newly received native ETH immediately disappears, stop repeatedly adding gas and seek official help with the compromise scenario. Do not attempt a test deposit to prove safety. Ledger's guidance calls for a new recovery phrase and new accounts when phrase compromise is suspected; any remaining-asset migration needs careful handling because sweepers can intercept funds. This guide does not provide a rescue transaction recipe or guarantee recovery.
For preserving evidence and finding the genuine reporting route after a MetaMask-connected incident, see our MetaMask scam-reporting guide. The practical result here is narrower: verify the permission's scope, remove the exact unwanted allowance if applicable, and keep unknown signatures or phrase exposure out of the “fixed by revoke” branch.
Official sources
Product interfaces and recovery policies can change. Confirm the current steps before acting.