A crypto user lost nearly $1 million on Wednesday after signing a phishing token approval on Ethereum, according to onchain data. It comes as the industry recorded $366 million in phishing losses in the first half of the year. 

A Scam Sniffer alert on Thursday revealed a victim lost 999,999 USDt (USDT) to an Ethereum phishing token approval scam. Scammers first tried draining a rounded $1 million via multicalls but failed due to insufficient funds, then succeeded seconds later by pulling the exact remaining balance in follow-up transfers.

“The script recalculated and pulled the exact remaining balance,” Scam Sniffer said.

Social engineering via phishing token approvals has become a common crypto scam tactic. Phishing losses totaled $723 million across 248 incidents in 2025, according to CertiK. Scammers trick a victim into giving a malicious actor access to their wallet, taking the form of an innocuous-seeming transaction. 

The victim falsely believes that clicking “approve” will only initiate a minor task, but malicious links give the attacker approval to drain funds from the wallet. 

Attackers extracted $999,999 in three transactions. Source: Etherscan 

Scammers reuse the same wallets

Earlier this month, a wallet holder reportedly lost $1.65 million after connecting to a fake exchange and signing a malicious contract in a similar incident.

“The approval gave attackers unlimited access, enabling an automated sweeper to drain funds,” researcher Ryan Coleman said on Friday. 

Related: France to strengthen response as crypto wrench attacks hit 77 

Blockchain security firm Chainalysis reported in June that onchain scams pulled in at least $14 billion in 2025. Investment scams remained the dominant category, and approval phishing is how some of them play out onchain, said Chainalysis.  

“Scammers reuse the same wallets, legitimate approval features from contracts, and cash-out routes across victims, which means each report exposes a wider network,” said Renato Bastos, a senior investigator at Chainalysis. 

Scam Sniffer advised crypto users to double-check all signature requests before approving, avoid rushed transactions and use tools such as scam detection extensions.

Address poisoning remains a threat 

Address poisoning is another attack vector that scammers use alongside phishing token approvals. 

Scammers create addresses very similar to their target wallets and send a tiny amount of “dust” funds to the address, so the user mistakenly sends to this address instead of the legitimate one. 

Popular Ethereum wallet MetaMask launched live address poisoning detection in June, a tool that compares each pasted address with addresses that the wallet has previously interacted with.

Features: The biggest blockchain upgrades still to come in 2026