Jul 9, 2026
0 new drains, 3 updates.
Updated
-
High✕Still active
Ethereum user loses 999,999 USDT after signing a phishing token approval
On 8 July 2026 an Ethereum user signed a phishing token approval and lost 999,999 USDT, nearly $1M, according to Scam Sniffer. The attacker used multicalls and pulled the funds out in three transactions. One signature on a fake site was enough to empty the stablecoin balance.
Ethereum USDT holder·Ethereum·$1000K stolen·Since Jul 8, 2026·
-
Critical✕Still active
Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange
In early July 2026 a crypto wallet holder connected to a fake exchange site and signed a malicious contract approval that gave the attacker unlimited spending rights. An automated sweeper then emptied the wallet of about $1.65 million. Anyone who signs approvals on unfamiliar trading sites is at risk; check and revoke token approvals you do not recognise.
A crypto wallet holder using a fake exchange site·Multiple EVM chains·$1.6M stolen·Since Jul 3, 2026·
-
High✓Contained
Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys
Attackers who compromised Injective Labs' GitHub repository published @injectivelabs/sdk-ts 1.20.21 to npm, along with 17 related @injectivelabs packages pinned to it. The malicious build hooked the fromMnemonic and fromHex functions and sent seed phrases and private keys to an Injective-looking endpoint whenever an app used them. It was downloaded about 310 times before being deprecated; no thefts had been reported. Any key or seed that passed through 1.20.21 should be treated as stolen; the clean version is 1.20.23.
npm package @injectivelabs/sdk-ts and 17 related @injectivelabs packages·Multiple EVM chains·Since Jun 8, 2026·