Ethereum approval phishing costs trader nearly $1M in USDT, Scam Sniffer says

A crypto user has lost nearly $1 million after signing a malicious token approval on Ethereum, according to onchain tracking shared by Scam Sniffer. The case underscores how "approval phishing" has shifted from one-off cons to repeatable, automated draining playbooks. Scam Sniffer said the victim lost 999,999 USDT, tied to a phishing approval on Ethereum. The attacker initially tried to withdraw funds using multicall requests, but the attempt failed because the wallet balance was insufficient. Seconds later, follow-up transfers succeeded and removed the remaining funds. How a single approval can empty a wallet The core tactic relies on token approvals that look routine. Victims are persuaded to sign a transaction framed as a minor step—such as enabling a transfer, interacting with a service, or completing a "verification"—while actually granting a malicious party permission to spend tokens or route funds from the wallet. In this incident, Scam Sniffer said the attacker's script recalculated the victim's remaining balance after the first drain attempt and then pulled the exact amount left. The onchain trail visible on Etherscan shows three transactions that culminated in the 999,999 USDT extraction. Why approval phishing keeps working Approval phishing remains a recurring scam pattern rather than a new technique. Coverage citing CertiK data said phishing losses totaled $723 million across 248 incidents in 2025. The mechanics are consistent: social engineering pushes a victim to click "approve," and that approval hands over spending rights to an attacker-controlled contract. The scalability is what makes the model attractive to criminals. Once token permissions are granted, balances can be drained without further interaction from the victim. The same report noted the crypto sector recorded $366 million in phishing losses in the first half of the year, reinforcing that approval-based permission abuse is part of a broad wave of onchain fraud. Repeat infrastructure: wallets, approvals, and draining scripts Risk increases when attackers reuse the same infrastructure and behavioral patterns. Earlier this month, another victim reportedly lost $1.65 million after connecting to a fake exchange and signing a malicious contract. Researcher Ryan Coleman said the approval provided "unlimited access," enabling an automated sweeper to drain funds. Chainalysis has estimated onchain scams pulled in at least $14 billion in 2025, with investment scams still a leading category. In its discussion of approval phishing, Chainalysis describes permission abuse as a bridge between social engineering and automated onchain theft. The firm has also warned that scammers often reuse wallets, rely on legitimate approval features, and follow consistent cash-out routes across multiple victims. That repetition changes what a single incident can reveal. Chainalysis senior investigator Renato Bastos was quoted in the underlying coverage saying each uncovered case can expose a broader network because scammers repeat wallet usage and operational paths. Analysts typically look for recurring approval signatures, contract patterns, and draining methods as indicators of coordinated campaigns. Address poisoning adds another layer Approval phishing is not the only common theft route. The coverage also pointed to address poisoning, where scammers generate lookalike wallet addresses and send small "dust" transfers to increase the odds victims copy the wrong address from their history. The tactic targets ecosystems where manual copy-and-paste remains common. The article noted that MetaMask launched live address poisoning detection in June. The feature compares pasted addresses against addresses the wallet previously interacted with, aiming to flag suspicious new or unexpected entries that match known deception patterns. What to watch Cases like the 999,999 USDT theft can spread quickly as criminals refine execution and reuse wallet infrastructure. Users are advised to treat any token-approval signature request as high risk, avoid rushing through prompts, verify permission scopes, and consider detection tools. Security teams and onchain analysts are expected to keep tracking shared draining scripts and infrastructure to identify campaigns before they broaden.