Crypto holder loses US$25.6 million in wallet-drain phishing attack, second major loss from same wallet
An unidentified crypto holder lost about US$25.6M on 12 Aug 2026 to a reported phishing attack. No funds returned in the reports we found. The same wallet lost US$24M in 2023. Never sign approvals from links or pop-ups; check them with a hardware wallet.
Nothing to update. If you hold crypto, never sign a wallet approval you reached through a link, ad or pop-up, and use a hardware wallet. Review and revoke old token approvals regularly, and keep large holdings in a wallet you rarely connect to websites.
What’s happening
On 12 August 2026 an unidentified crypto holder, often called a whale, lost about US$25.6 million in tokens from a single wallet. On-chain analyst Specter flagged the drain, and the security firm PeckShield traced the proceeds to four newly created attacker wallets. The attacker swapped the haul into roughly 20 million DAI and about 3,000 ETH. The largest single loss was about US$6.3 million of aWBTC. Reports describe the cause as phishing, meaning the victim was tricked into approving transfers. One tracker says the victim signed malicious approvals through a fake front end and that no smart contract was exploited. Another report does not describe the method, and the exact mechanism is not independently confirmed. The same wallet lost about US$24.2 million in September 2023 through malicious token approvals, and around 90 per cent of that was later returned. In this case, the reports we found say no funds have been returned. We found no later update on recovery, arrests or the victim's identity. This is not a software flaw, so there is nothing to update.
- What
- Scam
- Affects
- Crypto wallet of an unidentified large holder (Ethereum tokens)
- Fixed in
- Nothing to patch
- Since
- 12 Aug 2026
- Closed
- 16 Aug 2026
Timeline
- Update
Blockchain Breaches classed the theft as phishing in which the victim signed malicious approvals through a fake front end. It said no smart contract was exploited, investigators were watching the four addresses for movement to mixers or exchanges, and no recovery was reported.
- Update
Reports said the attacker swapped the stolen tokens into about 20 million DAI and 3,000 ETH. The largest single loss was about US$6.3 million of aWBTC, and no funds had been returned.
- Made publicNothing to patch
An unidentified crypto holder was drained of about US$25.6 million. On-chain analyst Specter flagged it, and PeckShield traced the proceeds to four newly created attacker wallets.
Sources
- Crypto Whale Wallet Loses $25.6M in Another Major Phishing AttackTron Weekly · 13 Aug 2026
- Repeat Whale Phishing Drain (August 2026)Blockchain Breaches · 16 Aug 2026