A cryptocurrency investor fell victim to a phishing scam that drained approximately $999,999 from their Ethereum wallet through a fraudulent token approval. The loss occurred after the victim unknowingly authorized a malicious contract that granted hackers unlimited access to their funds.
The attackers first attempted to withdraw a rounded $1 million using multiple calls but failed due to insufficient funds, then executed precise follow-up transfers to pull the exact remaining balance seconds later. This sophisticated script adjustment enabled the scammers to empty the wallet in three transactions.
Phishing token approvals have become a prevalent tactic where scammers manipulate victims into signing seemingly harmless approvals. These transactions, once authorized, open the door for attackers to withdraw full wallet balances rather than performing limited actions. Industry data shows these scams accounted for hundreds of millions in losses during the first half of the year.
Crypto security analysts warn that such scams often involve reusing wallets, contract approval features, and withdrawal methods across multiple victims, allowing scammers to operate wider networks with each exploit. One recent case involved a user who lost $1.65 million by connecting to a fake exchange and signing a harmful contract, granting unrestricted access to attackers.
Tech firms specializing in blockchain security recommend caution before approving any transaction signatures. Users should verify the authenticity of signature requests, avoid rushed decisions, and utilize protective tools like scam detection browser extensions to mitigate risks.
Another growing threat is address poisoning, where scammers send small amounts of cryptocurrency to fake addresses resembling legitimate ones, causing users to mistakenly send funds to malicious accounts. In response, popular Ethereum wallets like MetaMask introduced real-time address poisoning detection to compare pasted addresses against known safe contacts and previous transactions.
With onchain scams pulling in an estimated $14 billion across 2025, largely driven by investment fraud and phishing, remaining vigilant during transaction approvals remains critical for crypto holders.