{
 "slug": "fake-exchange-unlimited-approval-1-65m-jul-2026",
 "title": "Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange",
 "url": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026",
 "json": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "multi-evm"
 ],
 "method": "approval-phishing",
 "product": "A crypto wallet holder using a fake exchange site",
 "tags": [
  "multi-evm",
  "approval-phishing",
  "unlimited-approval",
  "fake-exchange",
  "sweeper",
  "phishing"
 ],
 "amountUsd": 1650000,
 "victims": 1,
 "startedAt": "2026-07-03",
 "closedAt": "2026-07-09",
 "updatedAt": "2026-07-09T12:00:00Z",
 "summary": "In early July 2026 a crypto wallet holder connected to a fake exchange site and signed a malicious contract approval that gave the attacker unlimited spending rights. An automated sweeper then emptied the wallet of about $1.65 million. Anyone who signs approvals on unfamiliar trading sites is at risk; check and revoke token approvals you do not recognise.",
 "timeline": [
  {
   "date": "2026-07-03",
   "title": "An X post by an on-chain commentator reported that a wallet holder lost $1.65M after connecting to a fake exchange and signing a malicious contract.",
   "sourceUrl": "https://x.com/RyanColeXBT/status/2073172860034789620"
  },
  {
   "date": "2026-07-09",
   "title": "ForkLog reported the case alongside a separate 999,999 USDT approval-phishing theft, noting the approval gave attackers unlimited access and a sweeper drained the funds.",
   "sourceUrl": "https://forklog.com/en/ethereum-user-loses-nearly-1-million-usdt-in-phishing-scam/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Ethereum user loses nearly $1 million USDT in phishing scam",
   "url": "https://forklog.com/en/ethereum-user-loses-nearly-1-million-usdt-in-phishing-scam/",
   "publisher": "ForkLog",
   "date": "2026-07-09"
  },
  {
   "kind": "social",
   "title": "X post reporting the $1.65M fake-exchange approval loss",
   "url": "https://x.com/RyanColeXBT/status/2073172860034789620",
   "publisher": "X (@RyanColeXBT)",
   "date": "2026-07-03"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nOnly if you connected a wallet to an unfamiliar exchange or trading site and signed a contract approval there. Check your wallet's token approvals with a revoke tool (for example revoke.cash or your wallet's built-in approvals list) for unlimited approvals to contracts you do not recognise.\n\n## What to do now\nRevoke any unknown approvals at once. If funds are still in the wallet, move them to a fresh wallet. Report the attacker address to your wallet provider and to exchanges.\n\n## How to avoid this\nOnly trade on exchanges you reached by typing the address yourself or from a trusted bookmark. Read every approval prompt: an 'approve' or 'set approval for all' request for an unlimited amount lets the spender take those tokens at any time. Keep large holdings in a separate wallet that never signs approvals on new sites.",
 "notes": null,
 "agentBrief": "# Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange\n\n- Severity: Critical · Status: Still active (past)\n- Chains: Multiple EVM chains · Method: Malicious token and NFT approvals\n- Started: Jul 3, 2026 · Last update: Jul 9, 2026 · Reported stolen: $1.6M · Victims: 1\n- Who/what: A crypto wallet holder using a fake exchange site\n\nIn early July 2026 a crypto wallet holder connected to a fake exchange site and signed a malicious contract approval that gave the attacker unlimited spending rights. An automated sweeper then emptied the wallet of about $1.65 million. Anyone who signs approvals on unfamiliar trading sites is at risk; check and revoke token approvals you do not recognise.\n\n## Am I affected?\nOnly if you connected a wallet to an unfamiliar exchange or trading site and signed a contract approval there. Check your wallet's token approvals with a revoke tool (for example revoke.cash or your wallet's built-in approvals list) for unlimited approvals to contracts you do not recognise.\n\n## What to do now\nRevoke any unknown approvals at once. If funds are still in the wallet, move them to a fresh wallet. Report the attacker address to your wallet provider and to exchanges.\n\n## How to avoid this\nOnly trade on exchanges you reached by typing the address yourself or from a trusted bookmark. Read every approval prompt: an 'approve' or 'set approval for all' request for an unlimited amount lets the spender take those tokens at any time. Keep large holdings in a separate wallet that never signs approvals on new sites.\n\n## Sources\n- Ethereum user loses nearly $1 million USDT in phishing scam (ForkLog, 2026-07-09): https://forklog.com/en/ethereum-user-loses-nearly-1-million-usdt-in-phishing-scam/\n- X post reporting the $1.65M fake-exchange approval loss (X (@RyanColeXBT), 2026-07-03): https://x.com/RyanColeXBT/status/2073172860034789620\n\nFull record: https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026 · JSON: https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}