An unlimited approval lets a contract spend every token of one type you own, for as long as you hold them, until you revoke it.
When you approve a token, you are not sending it. You are giving a contract standing permission to take it later, on its own initiative. Nothing moves at the moment you sign.
The number that appears in an unlimited approval is 2²⁵⁶ − 1 — the largest value the format can hold. Wallets display it as "unlimited" because no real balance could ever exceed it. It is used because it saves you paying gas to approve again on every trade, which is a genuine convenience and why every major exchange asks for it.
The cost of that convenience is that the permission has no expiry and no cap. It survives long after you have finished using the site. If the contract holding the approval is malicious, or is upgraded, or is later exploited, it can take your entire balance of that token at any moment — years afterwards, without you signing anything else.
This is not a hypothetical. A large share of drained wallets are drained through approvals granted long before the theft, to contracts the victim had forgotten about.
The safe habit: approve only the amount you actually need, and periodically revoke approvals you are no longer using. Revoking is itself just an approval of zero.
See this decodedOpens the decoder with this exact payload loaded.