# Ethereum · Drain Watch

34 incidents, 9 live. JSON: https://drains.watch/t/ethereum.json · RSS: https://drains.watch/t/ethereum/feed.xml

- [Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet](https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026) (live, Medium, Still active, since Oct 14, 2026)
- [Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M](https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets) (live, Critical, Partly contained, since Oct 9, 2026)
- [Old Permit2 phishing approval used to drain $167K in LINK](https://drains.watch/i/permit2-phishing-link-167k-oct-2026) (live, High, Still active, since Oct 3, 2026)
- [Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances](https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026) (live, Critical, Contained, since Sep 24, 2026)
- [Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise](https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026) (closed, Critical, Contained, since Sep 24, 2026)
- [SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted](https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026) (live, Critical, Partly contained, since Sep 19, 2026)
- [D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron](https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026) (live, Critical, Still active, since Sep 15, 2026)
- [Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief](https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026) (live, Critical, Partly contained, since Sep 15, 2026)
- [Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023](https://drains.watch/i/whale-wallet-25m-drain-aug-2026) (live, Critical, Still active, since Aug 12, 2026)
- [Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON](https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026) (live, Critical, Partly contained, since Jul 24, 2026)
- [Ethereum user loses 999,999 USDT after signing a phishing token approval](https://drains.watch/i/usdt-approval-phishing-999999-jul-2026) (closed, High, Still active, since Jul 8, 2026)
- ['Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses](https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026) (closed, Medium, Still active, since Jun 30, 2026)
- [Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained](https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026) (closed, Critical, Contained, since Jun 25, 2026)
- [Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor](https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026) (closed, High, Still active, since Jun 17, 2026)
- [Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys](https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026) (closed, Critical, Partly contained, since Jun 8, 2026)
- ['Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included](https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026) (closed, Critical, Still active, since May 27, 2026)
- [StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key](https://drains.watch/i/stablr-1of3-multisig-key-may-2026) (closed, Critical, Partly contained, since May 23, 2026)
- [Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak](https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026) (closed, High, Contained, since May 11, 2026)
- [Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key](https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026) (closed, Critical, Still active, since Apr 30, 2026)
- [CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals](https://drains.watch/i/cow-swap-dns-hijack-apr-2026) (closed, Critical, Contained, since Apr 14, 2026)
- [Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts](https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026) (closed, Critical, Partly contained, since Apr 8, 2026)
- [Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys](https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026) (closed, Medium, Partly contained, since Mar 26, 2026)
- [Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens](https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026) (closed, Critical, Contained, since Mar 21, 2026)
- [IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine](https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026) (closed, Critical, Partly contained, since Feb 21, 2026)
- [Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier](https://drains.watch/i/address-poisoning-4556-eth-jan-2026) (closed, Critical, Still active, since Jan 30, 2026)
- [Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer](https://drains.watch/i/address-poisoning-514k-usdt-jan-2026) (closed, High, Still active, since Jan 16, 2026)
- [User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature](https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026) (closed, Critical, Contained, since Jan 3, 2026)
- [Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets](https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025) (closed, Critical, Contained, since Dec 24, 2025)
- [Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history](https://drains.watch/i/address-poisoning-50m-usdt-dec-2025) (closed, Critical, Still active, since Dec 20, 2025)
- [Ethereum user loses $440K in USDC after signing a malicious permit](https://drains.watch/i/permit-phishing-440k-usdc-dec-2025) (closed, High, Contained, since Dec 8, 2025)
- [Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash](https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025) (closed, Critical, Still active, since Nov 4, 2025)
- [THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend](https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025) (closed, Critical, Still active, since Sep 4, 2025)
- [Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key](https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025) (closed, Medium, Partly contained, since Aug 13, 2025)
- [YouTube 'MEV bot' tutorials, some AI-generated, tricked users into deploying drainer contracts; $900K+ taken](https://drains.watch/i/ai-video-mev-bot-tutorials-drainer-contracts-aug-2025) (closed, High, Still active, since Aug 5, 2025)