Oct 4, 2026
1 new drain, 1 update.
New
-
High✕Still active
User loses about $305K in DAI after copying a poisoned lookalike address from history
On 4 October 2026 GoPlus Security flagged a loss of about $305,000 in DAI. The attacker made an address with the same first and last characters as the victim's usual recipient, sent dust transfers so it appeared in the victim's history, and the victim copied it for a large transfer. GoPlus warned these campaigns are now fully automated, from finding targets to laundering. Reports did not name the chain.
A DAI holder sending to a regular counterparty·Multiple EVM chains·$305K stolen·Since Oct 4, 2026·
Updated
-
High✕Still active
Old Permit2 phishing approval used to drain $167K in LINK
Scam Sniffer flagged a user who lost $167,342 in LINK on Ethereum when an attacker used a phishing approval targeting Permit2 to move the tokens on 3 October 2026. The victim had signed the approval long before (Incrypted dates it to 18 August 2025), which shows a malicious approval can sit unused for weeks or months before the drain. Anyone who has signed unfamiliar approvals should review and revoke them now.
An Ethereum LINK holder·Ethereum·$167K stolen·Since Oct 3, 2026·