In the world of Ethereum, smart contracts and DeFi, there is now a very real threat that is more dangerous than a traditional crypto wallet hack – one that does not require the theft of a seed phrase, private key, or a breach of a computer or wallet – all it takes is a single careless, ill-considered digital signature.
Recently, this is exactly how an Ethereum user lost 999,999 USDT after confirming a phishing token approval request. This incident served as yet another example of how token approval phishing has become one of the most effective schemes for stealing assets.
According to information published by Scam Sniffer, the victim simply signed a fraudulent token approval request. At that very moment, an automated script attempted to withdraw exactly 1,000,000 USDT. Although the transaction did not go through due to a shortfall of $631 in the balance, just 36 seconds later the script corrected its own error and transferred the remaining balance to third-party accounts in three transactions: 639,999, 200,000 and 159,999 USDT. Consequently, the user lost 999,999 USDT in an instant. It is worth noting that the owner’s private key was not compromised, as the user had personally authorised the smart contract. The transfers were recorded in Ethereum blocks No. 25489460 and 25489463.
What is token approval phishing?
The `approve()` function, as defined in the ERC-20 standard, allows a smart contract to be granted the right to spend a user’s tokens. This is a standard operating mechanism for many DeFi protocols, such as Uniswap, Aave, Curve, 1inch and several others.
Fraudsters exploit various loopholes, including copying the design of well-known services or offering fake airdrops, NFT mints or ‘wallet verification’. Upon clicking the button, the digital asset holder effectively signs an ‘Unlimited Approval’ authorisation themselves. From that moment on, the smart contract gains the legal right to withdraw assets without further user confirmation. Therefore, such attacks do not constitute a blockchain breach – they merely exploit human trust.
Why it works: five technical factors
1. Unlimited Allowance — unlimited authorisation to use tokens.
2. Multicall — combining several operations into a single transaction, which drastically reduces response time.
3. Scripts instantly adjust the withdrawal amount to the actual balance.
4. Delayed use of approval — funds can be stolen even hours, days, weeks or even months after signing.
5. Inadequate visualisation of signatures in many Web3 wallets, meaning users do not see the real consequences of confirmation.
The human factor remains the decisive factor. It is precisely haste, inattention, the desire to receive a free airdrop or the fear of missing out on a lucrative opportunity (FOMO) that drives people to confirm dangerous requests.
The scale of the problem
Such cases are no longer isolated incidents, and their number is increasing all the time – in 2025 alone, phishing attacks resulted in losses of approximately $723 million across 248 confirmed incidents (according to CertiK). In the first half of 2026, losses from phishing were estimated at a further $366 million. It is worth noting that over the past three years, experts at Scam Sniffer have regularly recorded large-scale thefts via fake approval requests, and the automation of attacks and the use of AI only serve to increase their effectiveness.
How not to become the next victim
The modern crypto market bears less and less resemblance to a battle between hackers and technological systems. These days, the main target is not a technical vulnerability, but the individual. A single careless, ‘hasty’ signature can cost more than years of investment.
Cybersecurity experts recommend never signing messages you do not understand, regularly revoking unnecessary token approvals, and using hardware wallets to store significant sums. At the same time, specialists emphasise the need to have a separate wallet for interacting with new DeFi projects and to carefully check website URLs before connecting your wallet.
