Story perspectives

Phishing Approval Attacks Surge, Cost Ethereum User $1 Million

7/10/2026

Summary

Story summary

On July 8 2026, an Ethereum user lost $999,999 USDT after approving a malicious request.
The attacker first tried a $1 million withdrawal, failed, then 36 seconds later sent three transfers of 639,999, 159,999 and 200,000 USDT, exploiting an unlimited approval that let a sweeper drain the wallet with Multicall, bundling transfers into one transaction.
Phishing token-approval attacks rose 200 % in 2026, causing $1.32 billion losses after scams of $1.65 million in July and $400,000 in May.

History

Historical Context

The DAO’s June 2016 hack stole 3.6 million Ether (about $50 million) and forced a contentious hard fork that split Ethereum into ETH and Ethereum Classic. That breach exposed how unchecked contract approvals can be abused, a risk echoed on July 8 2026 when a user lost $999,999 USDT through a Multicall phishing attack. Regulators and the Ethereum Foundation now stress tighter audits and approval limits.

1 of 2

Story summary

On July 8 2026, an Ethereum user lost $999,999 USDT after approving a malicious request.
The attacker first tried a $1 million withdrawal, failed, then 36 seconds later sent three transfers of 639,999, 159,999 and 200,000 USDT, exploiting an unlimited approval that let a sweeper drain the wallet with Multicall, bundling transfers into one transaction.
Phishing token-approval attacks rose 200 % in 2026, causing $1.32 billion losses after scams of $1.65 million in July and $400,000 in May.

1 / 2