USDT Owner Drained of $1M in Phishing Attack as Token Approval Scams Rise

A crypto user lost $1 million USDT in a phishing attack on the Ethereum network. The incident occurred after the user signed a malicious token approval request, granting attackers access to their wallet.

The attackers used an automated sweeper script that drained the wallet almost instantly. The first transaction was rejected because the requested amount exceeded the balance, but 36 seconds later, the script adjusted the amount and executed three transactions: $639,999, $159,999, and $200,000 USDT.

Blockchain security platform Scam Sniffer reported that token approval phishing is becoming a trend in 2026. In May 2026, a fake Uniswap site tricked multiple users out of about $400,000 after they approved a malicious contract. In June, a similar attack via a fake airdrop approval drained a HyperSwap user's wallet in seconds.

According to Scam Sniffer, phishing losses have grown 200% in 2026, with attackers increasingly targeting high-balance wallets. Scammers are using sophisticated methods to disguise themselves as routine signature requests that users are accustomed to approving without checking.