Whale Loses $55 Million in DAI Stablecoin to Phishing Attack

A crypto user lost tens of millions on August 20 as they became a victim of a phishing attack. They transferred $55 million worth of stablecoins to the hacker

A crypto user lost tens of millions on August 20 after falling victim to a phishing attack. The user transferred $55 million worth of stablecoins into the hacker’s wallet after approving a malicious transaction that aimed to drain their holdings.

The transaction occurred when the user confirmed an unknown transaction request on the Maker protocol, a DeFi stablecoin lending dapp (decentralized application). Upon signing the transaction, the user lost the millions they held in the DAI stablecoin. They attempted to send the assets associated with this malicious transaction to another wallet. However, the first transaction routing the assets to the bad actor’s wallet went through, leaving them with massive losses and a very expensive lesson.

That lesson is to never confirm any transaction request that comes from an unknown source. Users must check each transaction and ensure what they entail before signing them. Blockchain analytics firm Lookonchain echoed the same sentiments as it posted on X, “When you sign a transaction, always double-check before clicking “confirm” and do not sign unknown transactions.”

It also reported on the hack, stating, “The whale carelessly signed an unknown transaction 13 hours ago, setting the owner of his 55.47M $DAI in Maker to the phishing address “0x0000db5c…41e70000.” The hacker acted swiftly after their exploit to “set the owner to a newly created address “0x5D4b” and withdrew the 54.47M $DAI.” They then exchanged “27.5M $DAI for 10,625 $ETH.” Bad actors often convert their ill-gotten proceeds to ETH to use in crypto mixers and cover their tracks.

Phishing Attacks Are on the RisePhishing attacks are rising in the crypto space as hackers try to pull a fast one over unsuspecting users. They can occur in multiple ways, including malicious transaction requests. Otherwise, bad actors convince users to download malware capable of stealing private key information or manipulating transactions to route funds to destinations that users did not add as recipient addresses. A CertiK report from July revealed the first half of 2024 witnessed $498 million exploited through phishing attacks.