Loading article…
Ethereum phishing token approval drains $999,999 USDT on July 8, 2026; see how the multicall hack worked and what to monitor next.
A trader on Ethereum lost exactly 999,999 USDT after signing a malicious token‑approval request on July 8, 2026, highlighting the growing risk of approval‑phishing attacks that let attackers drain wallets without ever touching private keys [3].
| At a glance | |
|---|---|
| Loss amount | 999,999 USDT |
| Date | 8 July 2026 |
| Attack method | Phishing token‑approval via Multicall |
| Catalyst | Single fraudulent signature granting unlimited allowance |
Scam Sniffer’s on‑chain analysis shows the attacker first tried to pull a round $1 million using a multicall function, but the transaction failed for insufficient funds. Seconds later an automated script recalculated the exact balance and split the remaining 999,999 USDT into three transfers of 639,999, 159,999 and 200,000 USDT [2]. The victim’s wallet never exposed its private key; the approval gave the malicious contract unlimited access, allowing an “automated sweeper” to empty the account [5]. The recipient address is flagged as phishing on Etherscan [3].
Approval‑phishing is a leading vector in DeFi scams. Chainalysis reported that on‑chain scams collected at least $14 billion in 2025, with investment scams dominant and approval phishing a common execution method [1]. In the first half of 2026, security firms recorded $366 million in phishing losses, up from $723 million across 248 incidents in 2025 [5]. A 200 % jump in phishing losses this year has been linked to high‑value wallet targeting, underscoring the scale of the threat [4]. MetaMask introduced live address‑poisoning detection in June to help users avoid similar tricks, but the approval‑phishing method bypasses standard wallet alerts because the private keys remain untouched [1].
The incident shows that a single fraudulent signature can empty a high‑value wallet in seconds, narrowing the window for users to revoke approvals. As phishing attacks increasingly automate the extraction process, on‑chain monitoring of approval patterns will be crucial to detect and deter future breaches.
Coverage is mostly measured — 187 of 189 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 5 outlets · Jul 15, 2026 · How we report
Cryptocurrency allows for rapid movement of funds, offers greater anonymity, and often lacks the fraud protections found in traditional banking or credit card transactions.
Warning signs include high-pressure demands for immediate payment, instructions to keep a transaction secret, and unsolicited requests to deposit cash into a cryptocurrency kiosk.
Experts recommend hanging up immediately, refusing to send funds, and independently verifying the caller's identity by contacting the organization directly through a verified phone number.