An unknown owner of a cryptocurrency wallet on the Ethereum network lost nearly a million dollars — $999,999 in USDT stablecoins — due to a phishing attack. The tragedy unfolded in a matter of minutes: the victim signed a fraudulent token approval request, after which the attackers instantly drained all the funds.
How It Happened: Anatomy of the Attack
The investor's key mistake was having an unlimited allowance set for the USDT token on their wallet. The scammer did not need to hack private keys — it was enough to fraudulently obtain a signature on a request that granted broad access to the contract. This access remained active until the owner themselves limited or revoked it.
The hacker used the Multicall function to combine several operations into a single transaction. This allowed the funds to be withdrawn almost instantly. The funds were split into three parts and distributed across different wallets in Ethereum blocks 25489460 and 25489463 — just minutes after the request was signed.
This approach minimized the window for revoking the approval. Private keys remained untouched, and standard wallet notifications failed to detect the attack in time.
Why This Is Becoming the Norm
Phishing through token approval requests is a long-known but increasingly dangerous threat. According to analysts, phishing losses have grown by 200% this year. Attackers are increasingly targeting large balances, and their methods are becoming more sophisticated and automated.
Such incidents resemble address poisoning schemes, where scammers exploit transaction features rather than stealing data. In January, a phishing attack on MetaMask users was uncovered, using fake two-factor authentication windows.
How to Protect Yourself: Practical Recommendations
The Scam Sniffer team reminds: before signing any request, it is crucial to carefully verify each signature. The contract address and the level of requested permissions must be checked, and any default actions should be excluded.
One simple way to protect yourself is to regularly revoke unused or unlimited contract allowances. No interface improvements can replace a thorough review of every signature request.
Expert Opinion: The cryptocurrency market is becoming a battlefield where a second of inattention can cost a million. Security tools are improving, but the main shield is user awareness. Do not sign blindly, check every line of the request, and remember: trust in interfaces is the most expensive mistake.