# Ethereum user loses 999,999 USDT after signing a phishing token approval

- Severity: High · Status: Still active (past)
- Chains: Ethereum · Method: Malicious token and NFT approvals
- Started: Jul 8, 2026 · Last update: Jul 9, 2026 · Reported stolen: $1000K · Victims: 1
- Who/what: Ethereum USDT holder

On 8 July 2026 an Ethereum user signed a phishing token approval and lost 999,999 USDT, nearly $1M, according to Scam Sniffer. The attacker used multicalls and pulled the funds out in three transactions. One signature on a fake site was enough to empty the stablecoin balance.

## Am I affected?
Any approval you gave to a site you no longer use may still be live. Check your approvals now, especially for USDT and USDC.

## What to do now
- Review and revoke approvals on revoke.cash, starting with unlimited stablecoin approvals to contracts you don't recognise.
- If a drain is under way, move remaining assets to a fresh wallet immediately.

## How to avoid this
- A request to approve or permit a stablecoin on a claim, airdrop or 'verify wallet' page is almost always a drainer.
- Use a separate hot wallet for new sites and keep savings in a wallet that never connects to dapps.
- Keep transaction simulation and drainer warnings on in your wallet.

## Sources
- Trader loses $1M after signing phishing token approval (Cointelegraph, 2026-07-09): https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval

Full record: https://drains.watch/i/usdt-approval-phishing-999999-jul-2026 · JSON: https://drains.watch/i/usdt-approval-phishing-999999-jul-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.