Back
Ethereum user loses 999,999 USDT in phishing approval scam

Ethereum user loses 999,999 USDT in phishing approval scam

The theft highlights how a single malicious approval can let attackers drain tokens within minutes, renewing warnings over unlimited allowances and hard-to-spot signature requests.

ETH
USDT
UNI

Fact Check
The originating primary source, Scam Sniffer's X post (@realScamSniffer), states a user lost $999,999 in USDT after signing a phishing token approval on Ethereum, with victim address and on-chain transaction referenced. Two independent crypto news outlets (Cointelegraph and crypto.news, both dated July 9, 2026) corroborate the exact amount, mechanism (malicious token approval), and detail about the attacker draining the precise remaining balance after a failed $1M multicall. All evidence is consistent.
    Reference: 123
Summary

An Ethereum user lost 999,999 USDT after signing a fraudulent token approval that allowed an attacker to drain the funds without touching the wallet’s private keys. On-chain records show the stolen funds were split into three transfers that landed in Ethereum blocks 25489460 and 25489463 within minutes of the signature, with the attacker using Multicall functions to bundle actions and move the approved USDT quickly. The incident underscores the persistence of approval-phishing in decentralized finance, where users can grant broad or unlimited token allowances that remain active until revoked. It follows similar cases in 2026, including a fake Uniswap phishing site that drained roughly $400,000 in May and a fake airdrop approval scam that emptied a HyperSwap user’s wallet this month. Scam Sniffer said phishing losses have jumped as attackers increasingly target high-value wallets, and analysts again urged users to verify contract addresses, review permission scope carefully and revoke unused approvals regularly.

Terms & Concepts
  • token approval: A permission that allows a smart contract to spend a user's tokens on their behalf.
  • Multicall: A smart contract function that bundles several actions into one transaction sequence.
  • unlimited allowance: A token permission with no spending cap, allowing continued access until the user revokes it.