{
 "slug": "usdt-approval-phishing-999999-jul-2026",
 "title": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
 "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026",
 "json": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026.json",
 "status": "closed",
 "severity": "high",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "approval-phishing",
 "product": "Ethereum USDT holder",
 "tags": [
  "ethereum",
  "approval-phishing",
  "usdt",
  "scam-sniffer",
  "multicall",
  "drainer"
 ],
 "amountUsd": 999999,
 "victims": 1,
 "startedAt": "2026-07-08",
 "closedAt": "2026-07-09",
 "updatedAt": "2026-07-09T12:00:00Z",
 "summary": "On 8 July 2026 an Ethereum user signed a phishing token approval and lost 999,999 USDT, nearly $1M, according to Scam Sniffer. The attacker used multicalls and pulled the funds out in three transactions. One signature on a fake site was enough to empty the stablecoin balance.",
 "timeline": [
  {
   "date": "2026-07-08",
   "title": "The victim signed a phishing token approval and the attacker pulled 999,999 USDT out in three transactions using multicalls.",
   "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval"
  },
  {
   "date": "2026-07-09",
   "title": "Scam Sniffer posted an alert about the loss.",
   "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Trader loses $1M after signing phishing token approval",
   "url": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval",
   "publisher": "Cointelegraph",
   "date": "2026-07-09"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nAny approval you gave to a site you no longer use may still be live. Check your approvals now, especially for USDT and USDC.\n\n## What to do now\n- Review and revoke approvals on revoke.cash, starting with unlimited stablecoin approvals to contracts you don't recognise.\n- If a drain is under way, move remaining assets to a fresh wallet immediately.\n\n## How to avoid this\n- A request to approve or permit a stablecoin on a claim, airdrop or 'verify wallet' page is almost always a drainer.\n- Use a separate hot wallet for new sites and keep savings in a wallet that never connects to dapps.\n- Keep transaction simulation and drainer warnings on in your wallet.",
 "notes": null,
 "agentBrief": "# Ethereum user loses 999,999 USDT after signing a phishing token approval\n\n- Severity: High · Status: Still active (past)\n- Chains: Ethereum · Method: Malicious token and NFT approvals\n- Started: Jul 8, 2026 · Last update: Jul 9, 2026 · Reported stolen: $1000K · Victims: 1\n- Who/what: Ethereum USDT holder\n\nOn 8 July 2026 an Ethereum user signed a phishing token approval and lost 999,999 USDT, nearly $1M, according to Scam Sniffer. The attacker used multicalls and pulled the funds out in three transactions. One signature on a fake site was enough to empty the stablecoin balance.\n\n## Am I affected?\nAny approval you gave to a site you no longer use may still be live. Check your approvals now, especially for USDT and USDC.\n\n## What to do now\n- Review and revoke approvals on revoke.cash, starting with unlimited stablecoin approvals to contracts you don't recognise.\n- If a drain is under way, move remaining assets to a fresh wallet immediately.\n\n## How to avoid this\n- A request to approve or permit a stablecoin on a claim, airdrop or 'verify wallet' page is almost always a drainer.\n- Use a separate hot wallet for new sites and keep savings in a wallet that never connects to dapps.\n- Keep transaction simulation and drainer warnings on in your wallet.\n\n## Sources\n- Trader loses $1M after signing phishing token approval (Cointelegraph, 2026-07-09): https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval\n\nFull record: https://drains.watch/i/usdt-approval-phishing-999999-jul-2026 · JSON: https://drains.watch/i/usdt-approval-phishing-999999-jul-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}