Phishing Attack Stole $55 Million From Whale

• A whale signed a transaction request from an unknown source, causing them to lose $55 million in DAI tokens.
• The hacker converted a portion of their exploit into Ether.

A crypto user lost tens of millions on August 20 as they became a victim of a phishing attack. They transferred $55 million worth of stablecoins to the hacker’s wallet by approving a malicious transaction that sought to drain their holdings.

The transaction occurred as they confirmed an unknown transaction request on the Maker protocol, a DeFi stablecoin lending dapp (decentralized application). As they signed the transaction, they lost the millions they held in the DAI stablecoin. They tried to send the assets associated with this malicious transaction to another wallet. However, the first transaction routing the assets to the bad actor’s wallet went through, leaving them with tremendous losses and a massively expensive lesson.

Source: Lookonchain

That lesson is to not confirm any transaction request coming from an unknown source. Users must check every transaction and ensure what they entail before signing them. Blockchain analytics firm Lookonchain echoed the same sentiments as it posted on X, “When you sign a transaction, always double-check before clicking “confirm” and do not sign unknown transactions.”

It also reported on the hack, stating, “The whale carelessly signed an unknown transaction 13 hours ago, setting the owner of his 55.47M $DAI in Maker to the phishing address “0x0000db5c…41e70000”.” The hacker acted swiftly after their exploit to “set the owner to a newly created address “0x5D4b” and withdrew the 54.47M $DAI.” They then exchanged “27.5M $DAI for 10,625 $ETH.” Bad actors often convert their ill-gotten proceeds to ETH to use in crypto mixers and cover their tracks.

Phishing attacks are rising in the crypto space as hackers try to pull a fast one over unsuspecting users. They can occur in multiple ways, including malicious transaction requests. Otherwise, bad actors convince users to download malware capable of stealing private key information or manipulating transactions to route funds to destinations that users did not add as recipient addresses. A CertiK report from July revealed the first half of 2024 witnessed $498 million exploited through phishing attacks.