Investor Falls Victim to Phishing Scam, Loses $3.05M in USDT

Highlights:

• An investor ended up losing $3 million after accidentally approving a fake cryptocurrency transaction.
• The hacker used phishing tricks and later swapped stolen funds for Ethereum.
• Phishing scams remain one of the biggest threats to crypto investors worldwide.

On Wednesday, a well-known blockchain analytics platform reported that an investor unknowingly signed a harmful transaction on August 5, which led to the loss of $3.05 million in USDT. The attacker used a phishing method to gain control of the victim’s Ethereum wallet and successfully transferred the funds out.

Someone fell victim to a phishing attack, signed a malicious transfer, and lost 3.05M $USDT!

Stay alert, stay safe. One wrong click can drain your wallet.

Never sign a transaction you don’t fully understand.

Double-check the URL, double-check all signature requests

Verify… pic.twitter.com/39YYe1LAoz

— Lookonchain (@lookonchain) August 6, 2025

Victim Possibly Tricked by Fake Airdrop in $3M Scam

On-chain data shows the victim initially received 33,839 aEthUSDT during the transaction. It suggests the attacker might have used a fake airdrop or a misleading token transfer to trick the user into signing the malicious approval. Right after that, the attacker took 3,087,821 aEthUSDT from the victim’s wallet, which was worth around $3.05 million at the time of the exploit. 

The stolen funds were later moved to two different wallets. First, 463,173 USDT was sent to a known phishing wallet. The other 2.6 million USDT was moved to an unknown address. Reports indicate that the phishing-labeled address later sent 463,000 USDT to a dead wallet, rendering those funds unrecoverable. At the same time, the unknown wallet distributed the 2.6 million USDT across several addresses, exchanged it for 730 ETH, and eventually staked the Ethereum tokens. After the loss, Lookonchain stressed the need to fully understand transaction prompts before signing. They warned that just one wrong click could lead to losing all the funds in a wallet. 

The latest incident is not the first of its kind. Last year, a well-known DeFi investor lost $55.47 million in DAI after approving a phishing transaction that gave a scammer control of the funds. The funds were stored in Maker and became unreachable once the scammer gained access. The attacker then moved the DAI to another wallet and started swapping it for Ethereum. 

On Sunday, a separate investor fell victim to a complex phishing scheme, resulting in the loss of more than $900,000 in digital assets. The breach occurred 458 days after the individual had unknowingly authorized a harmful approval, which later allowed the scammer to empty their wallet.

🧐After we published an analysis article about the 1155 WBTC phishing incident and a profile of the hacker, it seems like there is a potential turning point in the situation.

3 hours ago, the hacker requested to contact the victim.👀 https://t.co/ZspG0F7bqW pic.twitter.com/4ZUAGttP5c

— SlowMist (@SlowMist_Team) May 9, 2024

Phishing Scams Lead to Major Crypto Losses

Hackers are slowly moving their focus from breaking code to targeting human behavior. Tricking people is often easier than bypassing protocol-level security protections. Phishing scams were the most damaging attack method in the crypto space last year. CertiK’s annual Web3 security report reveals that attackers made off with over $1 billion in digital assets through 296 separate phishing cases. Out of nearly 300 phishing attacks in 2024, at least three caused losses of more than $100 million each.

Crypto investors lost more than $2.2 billion to hacks and scams in early 2025. Most of the damage came from wallet breaches and phishing attacks, as noted in CertiK’s latest report. Wallet-related incidents alone led to $1.7 billion in losses across just 34 cases. Phishing schemes led to over $410 million in losses, spread across 132 individual incidents.

🚨 The Q2 + H1 2025 Hack3d Report is here.

$2.47B lost in the first half of the year.
$801M lost in Q2 alone.
Phishing and wallet compromise dominated the threat landscape.

Dive into the data👇🧵 pic.twitter.com/Sxa6AGejGK

— CertiK (@CertiK) June 30, 2025