We didn't think it could happen again. Not to the same wallet. Not to the same person. But here we are: a crypto whale who lost $24.2 million in a phishing attack back in September 2023 just got hit again—this time for $25.6 million. Same wallet, same attacker pattern, almost the same amount. Two years apart, and the industry's most basic security flaw is still bleeding eight-figure sums.
Let me be clear: this isn't a new exploit. It's not a zero-day in some fancy ZK proof or a flash loan attack on a bleeding-edge AMM. It's the oldest trick in the DeFi book—a malicious token approval. The victim signed a transaction that gave the attacker permission to spend their tokens. And once that permission was granted, the attacker drained everything they had permission to touch.
The numbers are staggering. In 2023, the attacker walked away with 4,851 rETH and 9,579.2 stETH—roughly $24.2 million at the time. Then, in August 2026, they struck again, taking a portfolio that read like a DeFi power user's dream: 630,000 aWBTC ($6.3 million), 5.1 million DAI, 470,000 WBTC, 260 million ETH, plus smaller bags of cbBTC, USDS, LDO, and CRV. Total: $25.6 million. Combined, the same wallet has lost nearly $50 million to the same attacker.
Context: The Quiet Horror of Token Approvals
Let me rewind for a moment. If you've ever used a DeFi protocol—Uniswap, Aave, Curve, Lido—you've signed an approval transaction. It's that moment when your wallet asks you to "allow this contract to spend your tokens." Most of us click "approve" without a second thought. But here's the thing: that approval is a power of attorney. It gives the contract—or in this case, a malicious actor—the ability to transfer your tokens at any time, for any amount, until you revoke it.
EIP-2612 introduced the "permit" function, which allows gasless approvals via off-chain signatures. That's even more dangerous because a phishing site can trick you into signing a message that looks like a harmless login but actually grants full token access. The 2023 and 2026 attacks both exploited this same mechanism. The victim, likely a sophisticated whale running multiple DeFi strategies, was lured into signing a malicious approval. Game over.
What's remarkable is that this whale didn't just sit on their tokens. They were deeply engaged in DeFi: holding aWBTC (Aave's interest-bearing token), stETH and rETH (liquid staking), LDO and CRV (governance tokens). They were actively farming yields, which means they were constantly interacting with protocols and signing approvals. That's the perfect trap for a phisher.
Core: The Attack Chain and What It Reveals
Let me walk through the technical chain, because the details matter. Based on my years working with DAO treasuries and security audits, I've seen this pattern play out dozens of times. The attacker first identifies a high-value target—often through on-chain monitoring or phishing emails. They craft a fake UI that mimics a legitimate DeFi app, then trick the victim into signing an approval transaction. Once the approval is in place, the attacker can silently drain the authorized tokens at any time.
In this case, the attacker moved quickly. They converted all the stolen assets—aWBTC, DAI, WBTC, ETH, cbBTC, USDS, LDO, CRV—into 20 million DAI and 3,000 ETH. Then they split the funds across four different addresses. This is a classic money-laundering tactic: convert to two high-liquidity assets, then spread across multiple wallets to complicate tracking.
Why DAI and ETH? DAI is a decentralized stablecoin that cannot be frozen by a central entity like Circle or Tether. ETH is the most liquid asset on Ethereum. The attacker deliberately avoided USDC and USDT, which have centralized blacklisting capabilities. This tells me the attacker is professional—likely part of a sophisticated group that understands the regulatory landscape.
But here's what really bothers me: the largest single loss was aWBTC—$6.3 million. aWBTC is an interest-bearing token from Aave. It's a wrapper that represents a deposit of WBTC in the Aave lending pool. That means the victim had to approve aWBTC for transfer, likely through a complex multi-step interaction. Aave's interface can be confusing: you approve the aToken, not the underlying asset. If the user approved the aToken contract for a phishing site, the attacker could drain the aWBTC balance. This is a UX failure disguised as a feature.
And this isn't just a whale problem. The same vulnerability affects every DeFi user. The industry has built tools like Revoke.cash, Token Approval Checker, and Fire to help users manage approvals. But adoption is pitifully low. Most people don't know what an approval is, and even those who do rarely check their active approvals. The whale in this case clearly didn't revoke the 2023 approval, or the attacker used a different approval vector. Either way, the security posture didn't improve.
Contrarian: The Real Problem Isn't the User—It's the Protocol
Here's the counter-intuitive take: maybe we're blaming the victim too much. Yes, the whale should have been more careful. Yes, they should have used a hardware wallet with a separate approval wallet. But the fact that the same attack can succeed twice, two years apart, on the same wallet, points to a systemic failure in how DeFi protocols handle authorization.
Identity isn't about who you are—it's about what you can prove. In DeFi, we've outsourced identity to a wallet address and a private key. But we've never built a proper consent layer. Every approval is a binary all-or-nothing grant. You can't say "approve this contract to spend up to 1000 DAI for one day." You can't say "approve only for this specific dApp." The approval model is blunt and unforgiving.
Protocols like Aave, Lido, and Curve benefit from the complexity—they need approvals to function. But they've done little to make the approval process transparent. When you interact with a lending protocol, you might be signing multiple approvals at once, and the UI often fails to show exactly what you're approving. The whale's aWBTC loss is a perfect example: the user likely thought they were approving WBTC, but the approval was for the aToken wrapper.
And then there's the 2023 precedent. The attacker returned 90% of the stolen funds after the first incident. That's a bizarre twist. Maybe the attacker was a white-hat who got spooked. Maybe it was a warning shot. But it created a dangerous narrative: "If you get hacked, you might get your money back." That false sense of security likely made the whale complacent. They didn't change their security practices because the first loss was "almost" recovered.
Liquidity isn't the problem here—it's the solution. The attacker converted everything to DAI and ETH precisely because those are the most liquid, least trackable assets. But the real liquidity crisis is in security awareness. The market has a massive liquidity of trust, but a drought of verification.
Takeaway: The Consent Layer We Forgot to Build
So where do we go from here? We need to rethink the entire authorization paradigm. We need granular, time-bound, session-based approvals. We need wallets that simulate transactions and warn users about phishing patterns. We need protocols to adopt EIP-4524 (the approval manager) or similar standards that allow users to set spending limits and revoke permissions easily.
But more than that, we need a cultural shift. Freedom isn't the absence of rules, it's the presence of consent. In DeFi, we've focused on permissionless access—anyone can interact with any protocol. But we forgot to give users the tools to consent meaningfully. A click on a pop-up isn't consent. It's a gamble.
The whale lost $50 million. You might lose $500. But the failure mode is the same. Until we build a proper consent layer, we'll keep seeing this headline again and again. The question isn't if it will happen—it's when will you be next?