Key Takeaways
- • A cryptocurrency trader lost approximately $1 million after signing a malicious Permit2 approval message, demonstrating how Uniswap's token approval contract—designed to streamline multi-token interactions—can be weaponized through social engineering without requiring protocol exploits or zero-day vulnerabilities.
- • Onchain scams generated at least $14 billion in losses during 2025, up 17% from $12 billion in 2024, with approval phishing accounting for over $1 billion in cumulative losses since 2021 and representing a growing threat vector independent of wallet drainer infrastructure.
- • January 2026 saw $370 million in phishing and social engineering losses across crypto, with a single incident accounting for $284 million, underscoring the concentration risk and magnitude of individual high-value attacks targeting institutional and sophisticated traders.
- • Operation Atlantic (April 2026) resulted in the freezing of approximately $12 million in assets connected to approval phishing schemes, suggesting regulatory and law enforcement coordination is beginning to target this attack vector.
- • Wallet drainer losses declined 83% year-over-year to $84 million in 2025, indicating targeted interventions against drainer infrastructure are effective, but this improvement is offset by the growing sophistication and scale of approval phishing attacks that operate through different technical mechanisms.
Summary
A trader has suffered a $1 million loss to onchain scammers through a phishing attack that exploited Uniswap's Permit2 token approval contract, according to Crypto Briefing. The attack did not require a protocol vulnerability or zero-day exploit; instead, the trader was deceived into signing a malicious Permit2 message that granted a scammer's contract full control over their wallet. Permit2, introduced by Uniswap to simplify user interactions across decentralized applications by enabling single off-chain signatures to cover multiple token approvals, became the attack surface. Once signed, the funds transferred without additional prompts, confirmation screens, or security warnings. A separate incident involved a $VIRTUAL token holder losing approximately $196,000 through the same approval phishing methodology.
The scale of approval phishing attacks reflects a broader surge in onchain scam activity. Chainalysis's 2026 Crypto Crime Report documents that onchain scams netted at least $14 billion in 2025, representing a 17% increase from $12 billion in 2024. CertiK's data reveals elevated risk concentrations: January 2026 alone saw $370 million in losses attributable to phishing and social engineering, with a single incident accounting for $284 million of that total. Approval phishing specifically has accumulated over $1 billion in reported losses since 2021, establishing itself as a persistent and expanding threat category that operates independently of wallet drainer infrastructure—the traditional high-volume attack vector.
The improvement in wallet drainer countermeasures provides limited reassurance. Wallet drainer losses fell to approximately $84 million in 2025, an 83% year-over-year decline that suggests targeted regulatory and infrastructure interventions are producing measurable results. However, this progress is substantially offset by the structural advantages of approval phishing attacks, which do not rely on drainer-specific infrastructure and therefore remain less susceptible to the same defensive measures. Operation Atlantic, conducted in April 2026, resulted in the freezing of approximately $12 million in assets connected to approval phishing operations, demonstrating emerging law enforcement coordination but underscoring the continued scale of unrecovered losses.
For institutional investors and sophisticated traders, these incidents illustrate that signature-based authorization mechanisms—increasingly common across decentralized finance protocols for user experience optimization—introduce material counterparty risk through social engineering. The Permit2 framework, while operationally convenient, concentrates wallet control in a single approval decision with limited user feedback mechanisms. The convergence of protocol design choices favoring frictionless interactions with phishing sophistication capable of targeting high-net-worth individuals represents a persistent vulnerability that neither regulatory intervention nor technical infrastructure hardening has fully resolved.
The scale of approval phishing attacks reflects a broader surge in onchain scam activity. Chainalysis's 2026 Crypto Crime Report documents that onchain scams netted at least $14 billion in 2025, representing a 17% increase from $12 billion in 2024. CertiK's data reveals elevated risk concentrations: January 2026 alone saw $370 million in losses attributable to phishing and social engineering, with a single incident accounting for $284 million of that total. Approval phishing specifically has accumulated over $1 billion in reported losses since 2021, establishing itself as a persistent and expanding threat category that operates independently of wallet drainer infrastructure—the traditional high-volume attack vector.
The improvement in wallet drainer countermeasures provides limited reassurance. Wallet drainer losses fell to approximately $84 million in 2025, an 83% year-over-year decline that suggests targeted regulatory and infrastructure interventions are producing measurable results. However, this progress is substantially offset by the structural advantages of approval phishing attacks, which do not rely on drainer-specific infrastructure and therefore remain less susceptible to the same defensive measures. Operation Atlantic, conducted in April 2026, resulted in the freezing of approximately $12 million in assets connected to approval phishing operations, demonstrating emerging law enforcement coordination but underscoring the continued scale of unrecovered losses.
For institutional investors and sophisticated traders, these incidents illustrate that signature-based authorization mechanisms—increasingly common across decentralized finance protocols for user experience optimization—introduce material counterparty risk through social engineering. The Permit2 framework, while operationally convenient, concentrates wallet control in a single approval decision with limited user feedback mechanisms. The convergence of protocol design choices favoring frictionless interactions with phishing sophistication capable of targeting high-net-worth individuals represents a persistent vulnerability that neither regulatory intervention nor technical infrastructure hardening has fully resolved.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.