One Signature, $999,999 Gone: A Wallet's Worst "Approve" Button 🚨

A crypto user lost 999,999 USDT (USDT) on Wednesday after signing a phishing token approval on Ethereum, according to on-chain data and a Scam Sniffer alert issued Thursday. Attackers first attempted to drain a rounded $1 million via multicalls but failed due to insufficient funds, then succeeded seconds later by pulling the exact remaining balance in follow-up transfers. "The script recalculated and pulled the exact remaining balance," Scam Sniffer said. The theft landed inside Ethereum blocks 25489460 and 25489463, with the funds split across three transactions from the victim wallet 0x8c949361b49320c48a51f4b1c6f9f83862530f89, per Etherscan. Multicall functions bundled the transfers into a single transaction window, narrowing the victim's opportunity to revoke the approval.

The incident fits a broader pattern of approval-based phishing that has accelerated through 2026. Phishing losses totaled $723 million across 248 incidents in 2025, according to CertiK, with another $366 million recorded in the first half of this year. Earlier this month, a wallet holder reportedly lost $1.65 million after connecting to a fake exchange and signing a malicious contract. "The approval gave attackers unlimited access, enabling an automated sweeper to drain funds," researcher Ryan Coleman said on Friday. A May fake Uniswap phishing site drained roughly $400,000 from several wallets, and a fake airdrop approval scam drained a HyperSwap user within seconds of a single click this month.

Attackers do not need a victim's private keys for these exploits. They trick users into signing a request that grants a contract broad access to a token, an allowance that stays active until someone revokes it. The wallet's private keys stayed untouched throughout the latest attack, and standard wallet alerts rarely flag this type of exploit. Address poisoning is another vector used alongside token-approval phishing, with