An Ethereum user lost nearly $1 million in USDT after signing a malicious token approval transaction on July 9, 2026. The incident unfolded quickly, with attackers leveraging a phishing-induced approval to drain funds from the victim’s wallet. This case exemplifies a common yet effective tactic in the Ethereum ecosystem where users inadvertently grant excessive permissions to malicious contracts.
According to GoPlus Security, the victim address 0x8C949361…62530F89 was drained through approvals granted to multiple phishing addresses. Phishing campaigns targeting token approvals have become a staple for attackers seeking high-value, low-resistance drains. Victims are often lured through deceptive websites mimicking legitimate DeFi platforms, airdrop claims, or urgent wallet interactions. Once the approval is signed, the malicious contract gains the ability to transfer tokens at any time without additional user confirmation, allowing attackers to strike when balances are favorable.
🚨GoPlus Security Alert:
A user lost $1M in USDT to phishing attackers after signing a malicious #Approve transaction.Victim address:
0x8C949361B49320C48a51F4B1C6f9f83862530F89Phishing addresses:
0x6D8c070338eC3d297f1D0ECEEA296bd7E13a32b9… pic.twitter.com/wG7YUd0YPa— GoPlus Security 🚦 (@GoPlusSecurity) July 9, 2026
The incident also mirrors a previous Ethereum phishing case where a user lost about $1.76 million in USDC after signing a malicious Permit approval. In that attack, the attacker used the approved signature to move funds without requiring another wallet confirmation, showing how both approval and permit-based scams continue to target stablecoin holders.
Attack Mechanics and Execution
The attack relied on a phishing token approval that allowed the malicious contract to spend the victim’s USDT without further confirmations. Attackers first attempted to pull a round $1 million, which failed by a small margin due to insufficient funds. Thirty-six seconds later, the script adjusted and successfully transferred the remaining balance of about 999,999 USDT.
- Victim Address: 0x8C949361…62530F89
- Key Attacker Addresses: 0x6D8c0703…13a32b9, 0xf84c6257…3E68d93, 0xc508a8…70Da1
- Primary Drain Transaction: 0x6e882fd8…f2e6ffb9
Broader Context of Approval Phishing
Token approval exploits remain a leading cause of individual losses in the Ethereum ecosystem. These attacks exploit the ERC-20 standard’s approval mechanism, which lets users delegate spending rights to contracts. Scammers create interfaces that appear routine but set unlimited allowances, enabling future drains even months later. Similar incidents have targeted users via fake airdrops, NFT mints, or impersonated protocols throughout 2026.
A similar phishing pattern was seen in a Google ad campaign impersonating Uniswap, where users were redirected to fake websites and lost more than $400,000 after connecting wallets and approving malicious transactions. That case showed how attackers continue to combine trusted brand impersonation, sponsored ads, and wallet-drainer contracts to exploit routine DeFi interactions.
Security monitoring services have documented numerous parallel campaigns, where attackers use scripted tools to monitor victim wallets and execute transfers rapidly once conditions are met. The persistence of these tactics, despite declining overall phishing losses in some reports, shows that user education and wallet safeguards still lag behind evolving social engineering methods.
Impact and Recommendations
The loss represents a significant personal financial hit for the affected user. No specific protocol was directly exploited; the vulnerability stemmed from user-signed permissions rather than a smart contract flaw in a major platform.
The latest incident fits into a broader 2026 security trend in which attackers are increasingly targeting user-side weaknesses rather than only smart contract bugs. previously reported that compromised private keys accounted for around 40% of crypto hack losses, while Q2 2026 became the most active quarter by number of hack incidents.
Industry-wide, approval phishing continues to pose challenges amid broader trends in crypto fraud, including AI-assisted campaigns and sophisticated wallet drainers. Users are advised to exercise extreme caution with any signature request. Key protective steps include:
- Installing reputable security extensions that flag risky approvals.
- Regularly auditing and revoking token permissions through tools like Revoke.cash.
- Verifying contract addresses independently on blockchain explorers before signing.
- Avoiding interactions with unsolicited links or unverified dApps.
This incident serves as a timely reminder of the importance of deliberate transaction verification in an environment where approvals can have long-lasting consequences. As Ethereum usage grows, strengthening user-side defenses remains critical to reducing such preventable losses.
