# Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023 - Severity: Critical · Status: Still active (live) - Chains: Ethereum - Started: Aug 12, 2026 · Last update: Aug 13, 2026 · Reported stolen: $26M · Victims: 1 - Who/what: Unidentified Ethereum whale wallet On 12 August 2026 an unidentified whale lost about $25.6M, including about $6.3M in aWBTC, $5.1M in DAI, $4.7M in WBTC and $2.6M in ETH, according to PeckShield. Analyst Specter called it a phishing attack and PeckShield called it a hack; the exact method has not been published. The attacker swapped the funds into DAI and ETH across four addresses. The same wallet lost about $24.2M through malicious token approvals in September 2023. ## Am I affected? This hit one large wallet. The lesson applies to anyone holding big balances, including Aave positions, in a hot wallet that signs on websites. ## What to do now - Audit token approvals and Permit2 allowances on your main wallet and revoke anything you don't use. - If you have been phished before, assume you are a repeat target: move funds to a brand-new wallet instead of reusing the old one. ## How to avoid this - Keep large holdings in a hardware wallet or multisig that never signs on unfamiliar sites. - Treat any unexpected approve, permit or setApprovalForAll request as hostile until you have verified it. ## Sources - Crypto Hack Drains $25.6 Million From Unknown Victims (U.Today, 2026-08-13): https://u.today/crypto-hack-drains-256-million-from-unknown-victims - Crypto Whale Wallet Loses $25.6M in Another Major Phishing Attack (TronWeekly, 2026-08-13): https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/ Full record: https://drains.watch/i/whale-wallet-25m-drain-aug-2026 · JSON: https://drains.watch/i/whale-wallet-25m-drain-aug-2026.json Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.