Whale's $25.6 Million Phishing Loss Highlights Transaction Approval Risks
A crypto whale lost $25.6 million in a phishing attack that exploited a seemingly innocuous transaction approval. The incident occurred in September 2023, when an anonymous Ethereum user's wallet was drained of 4,851 Rocket Pool ETH and 9,579 Lido Staked ETH, worth approximately $24 million.
The attacker did not require the victim to publish their seed phrase online; instead, they exploited the wallet owner's interactions with a phishing link. This allowed them to gain permission to move the tokens through Ethereum's transferFrom function.
This incident highlights the importance of being cautious when interacting with unfamiliar websites or applications in the crypto space. Even self-custodied wallets are not foolproof if users do not exercise proper security protocols, such as revoking old approvals and using hardware wallets for sensitive transactions.