We break down how a crypto user lost 999,999 USDT▲$0.9991 — and how to avoid similar mistakes.
An anonymous crypto wallet owner lost 999,999 USDT in a phishing attack on the Ethereum network. The incident occurred after the user signed a malicious token approval request.
Hot topic: Bitcoin Price Can Soar in July If History Repeats, CryptoQuant Says
Blockchain security platform Scam Sniffer reported that after the approval was granted, attackers used an automated sweeper script that drained the wallet almost instantly. The first transaction was rejected because the requested amount exceeded the balance. But 36 seconds later, the script adjusted the amount and executed three transactions: 639,999, 159,999, and 200,000 USDT.
Contents
How Phishing Works in Crypto
Unlike private key theft, this type of attack doesn’t require access to the victim’s wallet. Attackers trick users into signing a request that grants a malicious smart contract unlimited approval to spend USDT from the address. Once that approval is given, attackers use the Multicall function, which bundles multiple actions into a single transaction. This allows them to drain funds within seconds of signing, leaving the victim virtually no time to cancel.
Blockchain researcher Ryan Coleman explained that these attacks are automated. Scripts immediately sweep funds the moment access is granted. Standard wallet warnings rarely flag this type of exploit, since private keys remain untouched.
Read more: Top 5 Most Common Cryptocurrency Scams — How to Avoid Crypto Fraud in 2026
Token Approval Attacks Are Becoming a Trend in 2026
The USDT case is not isolated. In May 2026, a fake Uniswap site tricked multiple users out of about $400,000 after they approved a malicious contract. In June, a similar attack via a fake airdrop approval drained a HyperSwap user’s wallet in seconds.
According to Scam Sniffer, phishing losses have grown 200% in 2026, with attackers increasingly targeting high-balance wallets. Scammers are using increasingly sophisticated methods–from fake interfaces to masquerading as legitimate services. Many attacks disguise themselves as routine signature requests that users are accustomed to approving without checking.
Read more: Crypto Scam Alert 2026 — 3 Projects Already Red-Flagged by Experts
Security Tips: How to Protect Your USDT
Scam Sniffer analysts recommend:
- Check signature requests, especially contract addresses and approval limits
- Don’t approve permissions on unknown sites
- Revoke unused approvals using tools like Revoke.cash or Etherscan
- Use hardware wallets for extra protection
- Disable automatic transaction confirmation in wallet settings
Token approval phishing remains one of the most underestimated threats in DeFi. The gap between a single click and a drained wallet is shrinking as attacks become increasingly automated.
Learn more: How to Use Ledger Nano & Hardware Wallets: Step-by-Step Guide to Secure Your Crypto in 2026
