# Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange

- Severity: Critical · Status: Still active (past)
- Chains: Multiple EVM chains · Method: Malicious token and NFT approvals
- Started: Jul 3, 2026 · Last update: Jul 9, 2026 · Reported stolen: $1.6M · Victims: 1
- Who/what: A crypto wallet holder using a fake exchange site

In early July 2026 a crypto wallet holder connected to a fake exchange site and signed a malicious contract approval that gave the attacker unlimited spending rights. An automated sweeper then emptied the wallet of about $1.65 million. Anyone who signs approvals on unfamiliar trading sites is at risk; check and revoke token approvals you do not recognise.

## Am I affected?
Only if you connected a wallet to an unfamiliar exchange or trading site and signed a contract approval there. Check your wallet's token approvals with a revoke tool (for example revoke.cash or your wallet's built-in approvals list) for unlimited approvals to contracts you do not recognise.

## What to do now
Revoke any unknown approvals at once. If funds are still in the wallet, move them to a fresh wallet. Report the attacker address to your wallet provider and to exchanges.

## How to avoid this
Only trade on exchanges you reached by typing the address yourself or from a trusted bookmark. Read every approval prompt: an 'approve' or 'set approval for all' request for an unlimited amount lets the spender take those tokens at any time. Keep large holdings in a separate wallet that never signs approvals on new sites.

## Sources
- Ethereum user loses nearly $1 million USDT in phishing scam (ForkLog, 2026-07-09): https://forklog.com/en/ethereum-user-loses-nearly-1-million-usdt-in-phishing-scam/
- X post reporting the $1.65M fake-exchange approval loss (X (@RyanColeXBT), 2026-07-03): https://x.com/RyanColeXBT/status/2073172860034789620

Full record: https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026 · JSON: https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.