A cryptocurrency holder lost 999,999 USDT on Ethereum after signing a malicious transaction approval that gave attackers unrestricted access to the wallet, blockchain security platform Scam Sniffer reported.
The incident is the latest reminder that approval-based phishing attacks remain one of the most effective tactics used by cybercriminals targeting digital asset investors.
Blockchain security platform Scam Sniffer reported that the victim lost 999,999 Tether (USDT) after signing what appeared to be a legitimate transaction request on the Ethereum network. The malicious approval enabled attackers to empty the wallet without requiring any additional authorization, illustrating how a single signature can result in catastrophic losses.
The theft comes as blockchain security firms continue to warn that phishing campaigns remain one of the largest sources of crypto-related losses this year, with hundreds of millions of dollars already stolen through similar schemes.
According to Scam Sniffer, the attackers initially attempted to withdraw a rounded figure of $1 million using multicall transactions. However, blockchain records showed that the transfer failed because the victim’s wallet balance was marginally below that amount.
Rather than abandoning the attack, the scammers quickly modified their automated script. Within seconds, the software recalculated the wallet’s exact balance and successfully transferred every remaining token.
“The script recalculated and pulled the exact remaining balance,” Scam Sniffer explained while analyzing the on-chain transaction.
The precision of the attack highlights how automated tools are increasingly being deployed by phishing groups to maximize stolen funds immediately after victims authorize malicious spending permissions.
Unlike private key compromises, approval phishing attacks rely on victims voluntarily signing transactions they mistakenly believe are harmless. Once unlimited spending permission is granted, attackers can transfer tokens from the wallet without requesting another signature from the owner.
The latest Ethereum phishing scam demonstrates how dangerous these approval requests have become, particularly as scammers continue refining their social engineering techniques.
Approval phishing remains one of crypto’s biggest security threats
Cybersecurity researchers have repeatedly identified approval phishing as one of the fastest-growing attack vectors across decentralized finance and self-custody wallets.
According to blockchain security firm CertiK, phishing attacks have resulted in approximately $723 million in losses across 248 separate incidents during 2025. Most of those attacks followed the same pattern: victims unknowingly signed malicious token approval requests that handed attackers unrestricted spending authority over their assets.
The persistence of these scams reflects a broader challenge facing the crypto industry, where transaction signatures often contain complex technical data that many users struggle to interpret.
Earlier this month, another investor reportedly lost around $1.65 million after connecting a wallet to a fraudulent cryptocurrency exchange and signing a malicious smart contract.
Researcher Ryan Coleman described how that attack unfolded.
“The approval gave attackers unlimited access, enabling an automated sweeper to drain funds,” Coleman said while discussing the incident.
Security firms have consistently advised wallet holders to avoid signing approval requests without carefully reviewing the requested permissions, especially when interacting with unfamiliar decentralized applications or websites.
As attacks become more sophisticated, the latest Ethereum phishing scam reinforces the importance of verifying every wallet prompt before confirming any transaction.
Separate on-chain risks continue exposing crypto investors
While phishing remains one of the industry’s largest security concerns, experts note that not every major crypto loss stems from malicious approvals.
Earlier this week, another trader reportedly lost nearly $2 million after executing an Ether swap through a decentralized exchange. In that case, the transaction was routed through a low-liquidity pool, allowing a same-block arbitrage opportunity that extracted most of the trade’s value.
Blockchain security company GoPlus Security said the incident was not linked to phishing but instead resulted from inefficient transaction routing during execution.
The distinction is important because it highlights the multiple technical risks users face when interacting with decentralized finance protocols. While phishing attacks depend on deceptive approvals, poor transaction routing can also produce devastating financial outcomes without any compromise of wallet permissions.
Together, the two incidents demonstrate that investors must pay close attention not only to the signatures they authorize but also to how transactions are executed across decentralized networks.
Although unrelated in their mechanics, both losses emphasize the importance of understanding blockchain interactions before confirming any on-chain activity.
Security experts urge greater caution before signing transactions
Blockchain security companies continue encouraging crypto users to adopt stricter security habits as phishing campaigns evolve.
Scam Sniffer recommends reviewing every wallet signature carefully instead of approving requests automatically. Users are also encouraged to verify website domains, avoid interacting with unsolicited links, and use browser extensions or wallet security tools capable of detecting suspicious approval requests before signatures are submitted.
Industry experts also recommend periodically reviewing and revoking unnecessary token approvals, reducing the likelihood that previously granted permissions can later be exploited by attackers.
The latest Ethereum phishing scam serves as another warning that even experienced cryptocurrency users can become victims of increasingly convincing social engineering attacks. As approval-based phishing campaigns continue generating enormous financial losses across the industry, cybersecurity firms expect attackers to remain focused on exploiting wallet permissions rather than attempting more technically complex network breaches.
With phishing-related losses already reaching hundreds of millions of dollars this year, the recent theft highlights why transaction verification has become one of the most critical habits for anyone managing digital assets. For crypto investors, taking a few extra seconds to examine a signature request may be the difference between completing a legitimate transaction and losing an entire wallet balance in an instant.
