{
 "tag": "whale",
 "name": "Whale",
 "group": "Other",
 "incidents": [
  {
   "slug": "whale-wallet-25m-drain-aug-2026",
   "title": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026",
   "json": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": null,
   "product": "Unidentified Ethereum whale wallet",
   "tags": [
    "ethereum",
    "whale",
    "phishing",
    "aave",
    "awbtc",
    "peckshield",
    "repeat-victim"
   ],
   "amountUsd": 25600000,
   "victims": 1,
   "startedAt": "2026-08-12",
   "closedAt": null,
   "updatedAt": "2026-08-13T12:00:00Z",
   "summary": "On 12 August 2026 an unidentified whale lost about $25.6M, including about $6.3M in aWBTC, $5.1M in DAI, $4.7M in WBTC and $2.6M in ETH, according to PeckShield. Analyst Specter called it a phishing attack and PeckShield called it a hack; the exact method has not been published. The attacker swapped the funds into DAI and ETH across four addresses. The same wallet lost about $24.2M through malicious token approvals in September 2023."
  },
  {
   "slug": "address-poisoning-4556-eth-jan-2026",
   "title": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026",
   "json": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "address-poisoning",
   "product": "Ethereum whale wallet",
   "tags": [
    "ethereum",
    "address-poisoning",
    "eth",
    "dusting",
    "lookalike-address",
    "tornado-cash",
    "scam-sniffer",
    "whale"
   ],
   "amountUsd": 12250000,
   "victims": 1,
   "startedAt": "2026-01-30",
   "closedAt": "2026-01-31",
   "updatedAt": "2026-01-31T12:00:00Z",
   "summary": "On 30 January 2026 a victim sent 4,556 ETH, about $12.25M, to a lookalike of a regular counterparty's address. The attacker had seeded it into the victim's history with fake token transfers from February 2025 and ETH dust from October 2025; it matched the real address's first and last four characters. About 33 minutes later the ETH was swept to a new wallet, and the next day all of it went into Tornado Cash. Scam Sniffer flagged the loss."
  },
  {
   "slug": "solana-owner-permission-phishing-3m-dec-2025",
   "title": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025",
   "json": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "token-owner-swap",
   "product": "Solana wallet user (single victim)",
   "tags": [
    "solana",
    "token-owner-swap",
    "owner-permission",
    "assign",
    "setauthority",
    "simulation-blind-spot",
    "okx-wallet",
    "phantom",
    "slowmist",
    "signature-phishing",
    "account-takeover",
    "misttrack",
    "whale"
   ],
   "amountUsd": 3000000,
   "victims": 1,
   "startedAt": "2025-12-05",
   "closedAt": null,
   "updatedAt": "2026-10-22T20:36:38.517Z",
   "summary": "A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner."
  },
  {
   "slug": "whale-safe-1of1-key-compromise-nov-2025",
   "title": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025",
   "json": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "Private whale's Gnosis Safe multisig (Ethereum)",
   "tags": [
    "ethereum",
    "key-leak",
    "gnosis-safe",
    "multisig",
    "private-key-compromise",
    "aave",
    "tornado-cash",
    "whale"
   ],
   "amountUsd": 27300000,
   "victims": 1,
   "startedAt": "2025-11-04",
   "closedAt": "2026-01-06",
   "updatedAt": "2026-01-06T12:00:00Z",
   "summary": "A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key."
  }
 ],
 "changes": [
  {
   "incident": "whale-wallet-25m-drain-aug-2026",
   "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-13",
   "title": "PeckShield reported the theft and said the stolen aWBTC, DAI, WBTC and ETH were swapped into DAI and ETH and split across four addresses.",
   "sourceUrl": "https://u.today/crypto-hack-drains-256-million-from-unknown-victims",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026"
  },
  {
   "incident": "whale-wallet-25m-drain-aug-2026",
   "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-13",
   "title": "Specter described the theft as phishing; the same wallet had lost about $24.2M to malicious token approvals in September 2023.",
   "sourceUrl": "https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026"
  },
  {
   "incident": "whale-wallet-25m-drain-aug-2026",
   "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-12",
   "title": "The whale's wallet was drained of about $25.6M in assets.",
   "sourceUrl": "https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-31",
   "title": "All 4,556 ETH was deposited into Tornado Cash in 56 deposits.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-31",
   "title": "Scam Sniffer publicly reported the $12.25M address-poisoning loss.",
   "sourceUrl": "https://www.cryptopolitan.com/address-poison-attack-victim-loses-12-25m/",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-30",
   "title": "The victim sent 4,556 ETH to the lookalike 0x6d9052...2e48 instead of the intended 0x6D90CC...2E48; about 33 minutes later it was swept to a new wallet.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-01-07",
   "title": "OKX Wallet warns the owner-modification phishing technique is spreading on Solana and says it has added warnings; Phantom reportedly added similar alerts.",
   "sourceUrl": "https://coinfomania.com/okx-wallet-warns-of-new-phishing-scam-targeting-solana-users/",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-06",
   "title": "Laundering continued: about 6,300 ETH had been routed through Tornado Cash while the attacker withdrew collateral from a leveraged Aave position in stages.",
   "sourceUrl": "https://www.theblock.co/post/384441/crypto-hacker-launders-more-eth-from-compromised-multisig-as-27m-exploit-unfolds-peckshield",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-18",
   "title": "PeckShield reported about $27.3M drained via a private key compromise, with about 4,100 ETH already sent through Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2025-12-05",
   "title": "SlowMist warns that a Solana phishing signature moved a victim's account Owner permission to an attacker, with over $3M lost.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/1996528328061382860",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2025-12-05",
   "title": "Coinpaper, citing SlowMist, reported a Solana user lost over $3M after a deceptive signature changed the wallet's Owner permission; protocol teams helped recover about $2M in DeFi assets.",
   "sourceUrl": "https://coinpaper.com/12892/solana-user-loses-3-m-as-hidden-wallet-permissions-exploited",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-11-04",
   "title": "The Safe was created at 07:46 UTC and ownership passed to the attacker six minutes later; a first 1,000 ETH went to Tornado Cash that day, per Hacken.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-10-03",
   "title": "The first ETH dust from the lookalike address arrived; another dust ping followed on 29 January 2026.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-02-25",
   "title": "The first forged token transfer tied to the lookalike address appeared, starting the poisoning of the victim's history.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  }
 ]
}