Ethereum User Loses 999,999 USDT
An Ethereum user lost nearly $1 million in USDT after unknowingly signing a malicious token approval.
An Ethereum user has lost 999,999 USDT after unknowingly approving a malicious request that granted access to their tokens. According to Etherscan data, the stolen funds were split across three transactions and drained from the wallet within minutes of the signature being submitted. The victim's identity has not been disclosed.
Unlike many crypto thefts, the attacker did not steal the victim's password or private keys. Instead, the user was tricked into signing a transaction that authorized a malicious smart contract to manage the USDT stored in the wallet.
This highlights an important aspect of Ethereum. A signature does not always authorize a single action—it can also grant a decentralized application ongoing permission to spend specific tokens without requiring the owner's approval each time.
In this case, the victim had previously granted unlimited spending approval for USDT. After signing the fake request, the attacker immediately used those permissions to transfer the entire balance to their own addresses. The theft was carried out using Ethereum's Multicall function, which allows multiple operations to be executed within a single transaction. The stolen funds were instantly split into three separate transfers.
Because the private keys were never compromised, standard wallet security measures did not detect the attack. From the wallet's perspective, the transaction appeared to be fully authorized by its owner.
The incident serves as another reminder that outdated token approvals can be just as dangerous as clicking on a phishing link. Once granted, these permissions remain active until they are manually revoked.
Similar scams continue to target cryptocurrency users. In May 2026, a fake website impersonating Uniswap led to losses of around $400,000 across multiple wallets. Earlier this month, a HyperSwap user lost funds after approving a fraudulent airdrop. In January, another phishing campaign linked to the OpenClaw token tricked users with fake two-factor authentication messages.
While wallet developers continue to introduce stronger security warnings, the most effective defense remains the same: always review exactly what permissions you are granting before signing any transaction.
