A crypto user lost nearly $1 million after approving a malicious token permission on Ethereum, according to onchain tracking shared by Scam Sniffer. The incident highlights how phishing “token approvals” continue to evolve from one-off scams into repeatable theft workflows.

Scam Sniffer reported that the victim’s loss was 999,999 USDT (USDT) linked to an Ethereum phishing approval. The attacker first attempted to drain funds through multicall requests but failed due to insufficient balance, then immediately succeeded seconds later by executing follow-up transfers that removed the remaining funds.

Key takeaways

• A single “approve” on an Ethereum token can grant an attacker sweeping power, allowing losses to be extracted quickly via automated transfers.
• Scam Sniffer’s report describes multi-step draining: an initial multicall attempt may fail, but subsequent transactions can still empty the wallet.
• Approval-phishing remains a widely used tactic within broader onchain scam ecosystems, including investment fraud.
• Researchers warn that scammers often reuse the same wallet patterns—meaning one uncovered incident can reveal a broader network of activity.
• Address poisoning still compounds the risk, and users should treat copied addresses and pasted contract or wallet data with extra caution.

A nearly $1 million theft triggered by a token approval

The phishing mechanism centers on token approvals that appear routine. In these scams, victims are tricked into signing a transaction that grants a malicious actor permission to spend tokens or route funds from the wallet. The approval itself may be presented as a small step—such as enabling a transfer, interaction, or “verification”—but it can instead grant broad or lasting access that the attacker immediately exploits.

In the reported case, Scam Sniffer said the script recalculated the victim’s remaining balance and then pulled the exact amount left after the first drain attempt. That meant the attacker did not need to guess the wallet’s contents—execution was adjusted in real time to maximize extraction.

On Etherscan, the scam’s activity is reflected across three transactions culminating in the extraction of 999,999 USDT. (See: Etherscan transaction.)

Why approval phishing keeps working

Approval phishing is a recurring pattern rather than a new trick. CertiK data cited in the coverage indicates that in 2025 phishing losses totaled $723 million across 248 incidents. The structure of these scams is consistent: social engineering prompts victims to click “approve,” but the approval hands over spending capability to an attacker-controlled contract.

CertiK’s figures are particularly important because they suggest the problem is not isolated. Approval phishing scales well for criminals: once a victim grants token permissions, the attacker can use that permission to drain balances without requiring ongoing interaction from the victim.

Industry-wide, the scale of phishing losses remains high. The article notes that the crypto sector recorded $366 million in phishing losses in the first half of the year, reinforcing that approval-based permission scams are part of a broader wave of onchain fraud rather than a niche threat.

Scammers reuse wallets and permission patterns

The broader risk is amplified when criminals reuse the same infrastructure and wallet targets. Earlier in the month, a separate incident was reported involving a victim losing $1.65 million after connecting to a fake exchange and signing a malicious contract. In that scenario, the approval gave attackers “unlimited access,” enabling an automated sweeper to drain funds, according to researcher Ryan Coleman.

Chainalysis previously reported that onchain scams pulled in at least $14 billion in 2025, with investment scams remaining a dominant category. In Chainalysis materials on approval phishing, the firm explains that approval-based tactics are one way investment fraud moves from social engineering into automated onchain theft.

Chainalysis also cautioned that criminals reuse the same wallets, leverage legitimate approval features from contracts, and employ consistent cash-out routes across victims. That reuse matters for investors and users because it changes what “one report” can mean: when investigators map recurring permission and withdrawal behaviors, it can expose a wider network of coordinated activity rather than a standalone attacker.

Chainalysis senior investigator Renato Bastos is quoted in the underlying coverage explaining that each uncovered report can reveal a broader network because scammers repeat wallet usage and operational paths. Readers should watch for whether similar approval signatures, contract patterns, or draining methods recur across incidents—those repetitions often indicate systematic campaigns.

Address poisoning adds another layer of risk

Phishing token approvals are not the only mechanism used to steal funds. The coverage also points to address poisoning, where scammers create wallet addresses that look similar to legitimate ones and then send small “dust” amounts to those near-matching addresses. When victims copy and paste the address, the dusted lookalike can cause users to send funds to the attacker rather than the intended recipient.

The risk is especially relevant on ecosystems where manual copy/paste workflows remain common. The article notes that MetaMask launched live address poisoning detection in June. That tool compares each pasted address with addresses the wallet has previously interacted with—designed to flag suspicious new or unexpected addresses that match known patterns for deception.

With both approval phishing and address poisoning in play, the common theme is user interaction: scams manipulate what people think they’re signing or sending. Defenses therefore require slowing down and verifying the exact permission or recipient address before proceeding.

What to watch next

Approval phishing incidents like the reported 999,999 USDT theft tend to spread quickly when criminals refine execution and reuse wallet patterns. Users should be alert to any signature request connected to token approvals, avoid rushing through prompts, and consider detection tools—while security teams and onchain analysts will likely continue tracking recurring draining scripts and shared infrastructure to identify campaigns before they expand further.

European currencies are showing mixed performance as they attempt to stabilise following their recent decline and the release of the Federal Reserve’s latest meeting minutes. The minutes revealed growing concern over persistent inflationary pressures, with several policymakers supporting the possibility of an immediate interest rate increase, while the majority maintained a more cautious approach to further monetary tightening. Overall, the document highlighted ongoing divisions within the Fed over the future path of interest rates but maintained a broadly hawkish backdrop for the US dollar, as further rate hikes have not been ruled out should inflation remain elevated.

Fresh uncertainty has also emerged from renewed tensions in the Middle East. Following the latest escalation between the United States and Iran, investors have once again shifted their focus to the risk of a broader regional conflict and the potential disruption of energy supplies through key shipping routes. Rising geopolitical tensions continue to support demand for safe-haven assets while increasing concerns that higher energy prices could fuel another wave of inflation, further complicating the Federal Reserve’s prospects for policy easing. Against this backdrop, European currencies are attempting to stabilise, although persistent uncertainty continues to limit the scope for a sustained recovery.

EUR/USD

Following its recent decline, EUR/USD has once again tested support around 1.1390 before attempting to stabilise. Buyers have so far managed to keep the pair above its June lows, although the broader technical picture remains fragile. Technical indicators suggest the pair could recover towards the 1.1450–1.1470 region, supported by several bullish reversal patterns on the daily chart. However, if the pair is rejected from that resistance area and fails to establish a foothold above it, downside pressure could return, exposing 1.1330–1.1350 as the next support zone.

Key events for EUR/USD:

• Today, 09:00 (GMT+3): Germany Trade Balance
• Today, 13:00 (GMT+3): Spain Thomson Reuters/Ipsos Primary Consumer Sentiment Index (PCSI)
• Today, 15:30 (GMT+3): US Initial Jobless Claims

GBP/USD

GBP/USD continues to outperform, extending its recovery after rebounding from the 1.3160–1.3200 support zone. Sterling has regained ground towards 1.3400, reflecting continued short-term buying interest. A sustained move above 1.3400 could pave the way for further gains towards 1.3460–1.3500. Conversely, a decisive break below 1.3320 would invalidate the current bullish outlook.

Key events for GBP/USD:

• Today, 13:00 (GMT+3): UK Thomson Reuters/Ipsos Primary Consumer Sentiment Index (PCSI)
• Today, 16:00 (GMT+3): Speech by FOMC member John Williams
• Today, 20:30 (GMT+3): Speech by Dallas Federal Reserve President Lorie Logan

Key Takeaways

European currencies are attempting to regain stability after their recent decline, but the technical outlook remains mixed. EUR/USD is holding above key support near 1.1390, although the risk of renewed downside persists. By contrast, GBP/USD continues to recover and is now testing significant resistance around 1.3400. The next directional move will largely depend on developments in the Middle East, further guidance from the Federal Reserve, and whether buyers can secure sustained breaks above key technical levels.

Trade over 50 forex markets 24 hours a day with FXOpen. Take advantage of low commissions, deep liquidity, and spreads from 0.0 pips (additional fees may apply). Open your FXOpen account now or learn more about trading forex with FXOpen.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.

Blockchain security experts are urging crypto protocols to reaudit their smart contracts as AI tooling is making it easier for hackers to identify vulnerabilities more quickly than ever before. 

“Our data argues for continuous review rather than a one-time audit,” TRM Labs head of policy Ari Redbord told Cointelegraph, adding that “attack techniques are moving faster than a single audit from launch day can account for.”

“An audit built for last year’s attack patterns leaves a protocol exposed to this year’s as bad actors are changing up.”

CertiK reported Monday that hackers stole another $1.32 billion in the first half of 2026 and have adopted increasingly sophisticated strategies in response to strengthened security measures across the industry.

One of those strategies has been to revisit old codebases, CertiK said, adding that the attackers’ efforts have likely been “aided by improved automated tooling for identifying latent vulnerabilities at scale.”

One of the most recent incidents involved privacy-focused blockchain Zcash, where Shielded Labs security engineer Taylor Hornby found a major security vulnerability using a custom auditing agent powered by Anthropic’s Claude Opus 4.8. The bug has since been patched.

The security vulnerability, which existed for four years, could have enabled undetectable counterfeiting inside the Orchard shielded pool, one of the network’s key privacy features.

“The window of maximum vulnerability does not close after launch,” CertiK warned. “Projects operating legacy infrastructure should treat reauditing as a recurring operational requirement rather than a one-time exercise conducted at deployment.”

In December, Anthropic conducted a study finding that AI agents found $4.6 million worth of exploitable vulnerabilities in smart contracts. Meanwhile, there is more than $72.3 billion worth of crypto locked across hundreds of DeFi protocols, giving hackers plenty of incentive to exploit vulnerable smart contracts.

SlowMist’s estimate of total crypto losses from blockchain hacks. Source: SlowMist

Defunct crypto protocols targeted

On June 14, hackers exploited a smart contract vulnerability to steal $2.1 million from the Aztec Connect, which had been shut down since March 2023.

Five days later, a smart contract on the decentralized exchange mySwap was exploited for $300,000, even after the mySwap user interface had been closed to new liquidity deposits for more than six months.

A more fortunate event took place in May, when a white hat, known as “0xflorent,” helped recover 1,003 Ether (ETH) worth over $1.72 million from 48 investors involved in the Hong Coin (HONG) initial coin offering in 2016.

Related: ‘All DeFi unsafe’ claim sparks AI security debate after April hack surge 

The ICO failed to launch after missing its funding target, and the funds remained locked in the smart contract due to a bug in the auto-refund function. 

Reaudits only part of the equation, TRM says

The work doesn’t stop with hardening the codebase and infrastructure, Redbord said, explaining that the broader industry and regulators need to continue finding ways to mitigate malicious cyberactivity from North Korea and disrupt Chinese money laundering networks:

“Protocols can lock their doors, but someone still has to go after the actor breaking in.”

Features: DeFi hacks shake institutional confidence as risks outpace yields 

Key Takeaways

• CEO Seb Audet confirmed Zapper will cease all operations on Aug. 3, 2026
• At its height, the platform served 2 million active monthly users and facilitated $13 billion in transactions
• The company secured $15 million in Series A funding in 2021 from investors including Mark Cuban and Sound Ventures
• Zapper’s closure reflects a broader trend of crypto platform exits throughout 2026
• While crypto VC funding increased, deal volume has plummeted nine-fold over 10 consecutive quarters

Zapper, a prominent decentralized finance portfolio management tool, is shutting down permanently. Co-founder and CEO Seb Audet announced Wednesday that the platform will completely cease operations on Aug. 3, 2026, bringing an end to its nearly seven-year journey in the DeFi space.

In his announcement, Audet revealed the team had “evaluated a number of different options” before concluding that “an orderly wind down is the best course of action.” When pressed about the rationale behind the decision, he offered a straightforward explanation: “At the end of the day, the market decides.”

Rapid Rise in DeFi’s Early Days

Launched in 2019, Zapper made an immediate impact by winning Kyber’s DeFi Hackathon during its inaugural year. This early success propelled the startup to raise $1.5 million in seed capital by early 2020.

The momentum continued through May 2021, when Framework Ventures led a $15 million Series A investment round. Notable backers included Mark Cuban and Sound Ventures, the investment firm co-founded by actor Ashton Kutcher.

During its prime operating period, Zapper attracted 2 million monthly active users. The platform successfully processed over $13 billion worth of transactions across its lifespan.

The service enabled users to link their cryptocurrency wallets to oversee DeFi holdings, track liquidity pool positions, coordinate yield farming activities, and receive alerts about potential airdrops.

Zapper later expanded its capabilities to include decentralized exchange aggregation, non-fungible token functionality, and community features such as a Farcaster integration.

Growing Trend of Industry Exits

Zapper’s shutdown is far from an isolated incident. Numerous cryptocurrency platforms have announced closures throughout 2026.

TapTools, an analytics platform serving the Cardano ecosystem, terminated operations in June. Bitcoin DeFi protocol Botanix followed suit just one week later, similarly citing insufficient market demand.

The closure wave has touched multiple sectors: NFT marketplaces Nifty Gateway and Rodeo have shuttered, SBI’s cryptocurrency division has wound down, and decentralized email service Dmail has closed its doors.

Even Cosmos ecosystem wallet Leap has joined the exodus, contributing to what has emerged as a persistent pattern of closures throughout the cryptocurrency industry.

In April 2025, Zapper experienced a damaging social engineering breach. Malicious actors compromised the platform’s domain and diverted users to a fraudulent phishing site. This security incident proved to be a blow from which the platform struggled to recover.

Though cryptocurrency venture capital funding climbed 57.6% year-over-year to reach $4.21 billion in Q2 2026, RootData reports that deal volume has contracted nine-fold over the past 10 quarters. Investment capital is becoming increasingly concentrated among fewer projects.

Audet reflected on the platform’s founding vision of democratizing DeFi access. “I do believe we helped make the onchain economy easier to use for a considerable number of people,” he stated.

All Zapper infrastructure, including its website, mobile applications, and application programming interface, will be deactivated on Aug. 3.

The whole thing stands on shaky ground, however. CASHCAT carries a market value of about $105 million against roughly $6.6 million of liquidity in its Uniswap pool, meaning it may not absorb even a fraction of the holders trying to leave at once.

The token is down about 12% over 24 hours and roughly a quarter off the intraday peak near $145 million it touched on Wednesday, and sell volume has edged past buy volume, $29.1 million against $28.9 million, across more than 30,000 transactions from about 6,800 traders.

Robinhood did not create the token. CASHCAT’s own website describes it as “fan fiction with a ticker,” a project built by outsiders around the cat-with-cash logo the company used in its earliest days before rebranding. The utility, the site says, “is cat.”

Interestingly, on July 2, the day after the chain went live, Robinhood’s chief executive Vlad Tenev told CNBC that memecoins were largely a dead end, as ‘assets without utility do not serve a lasting purpose,’ and that tokenized real-world assets were the durable direction for crypto.

However, days later on July 7, as CASHCAT climbed, he posted on X that while the company is building its chain to be the best for real-world assets, “it works great for memes too.” He also followed the token’s account.

The Bank of Japan (BOJ) may raise its benchmark interest rate rapidly this year, as the yen slides, eventually pushing it above 2%.

That’s the latest warning from a former Bank of Japan official Tsutomu Watanabe, an economics professor at the University of Tokyo who left the central bank in 1999, according to Bloomberg.

As of now, the official rate is at 1%, the result of recent hikes, and the 10-year benchmark government bond yield hovers above 2.8%, the highest in at least three decades, according to data source TradingView.

Meanwhile, the Japanese yen continues to slide despite recent hikes and hardening Japanese government bond yields. It has depreciated by 60% to 162.36 per U.S. dollar since early 2021, a major decline for one of the most traded currencies in the world. Also, it has dropped 3% so far this year.

Faster potential interest rate hikes by the BOJ may put a floor under the yen, or potentially lift it higher. The question then is whether it will help bitcoin BTC$62,890.39 or work against it.

US Democratic Senator Ron Wyden has urged Senate leaders to ensure that crypto developer protections stay in the crypto market structure legislation that lawmakers are looking to pass ahead of the midterms.

Wyden told Senate Minority Leader John Thune and Senate Majority Leader Charles Schumer to preserve a section of the CLARITY Act known as the Blockchain Regulatory Certainty Act (BRCA), according to a letter shared by Crypto in America podcast co-founder Eleanor Terrett on Wednesday.

“Developers who make and release software that allows people to manage their own digital assets — and, critically, where the developer does not control user assets — should not be treated as money transmitters solely because they create or publish software,” Wyden wrote.

The letter comes after certain groups and lawmakers opposed the BRCA. A group of law enforcement organizations and a coalition of Catholic organizations last month argued it could create gaps in the oversight of illicit activity.

Meanwhile, crypto groups have urged the Senate to keep the section intact, arguing that developers of non-custodial technology can’t control user funds and should not be treated as financial intermediaries.

Negotiations over provisions in the bill are ongoing. Senate leaders are pushing for the bill to be passed this month, and will want to bring to the floor a bill that has wide support to avoid prolonged debate.

BRCA needed for US to remain competitive: Wyden

In his letter, Wyden argued that treating crypto developers as money transmitters “punishes technological innovation and advancement in strategically important areas at a time when the United States must remain globally competitive.”

He added that the BRCA reflects guidance from the Financial Crimes Enforcement Network and gives legal certainty for developers of open-source and non-custodial projects “to continue building and developing the decentralized finance ecosystem right here in the United States.”

“Smart policy will empower law enforcement to do its job and facilitate innovation at the same time,” Wyden wrote. “As the Senate continues its consideration of the Clarity Act, I urge you to include the Blockchain Regulatory Certainty Act in any legislative package.”

Related: Gaming groups urge Congress to ban prediction markets sports betting in CLARITY Act

The Senate has other provisions in the CLARITY Act that are at issue before it can go to a floor vote, with some lawmakers calling for tighter ethics provisions on government officials’ involvement in crypto after US President Donald Trump revealed he made $1.4 billion from his crypto interests last year.

Lawmakers who back the bill want to pass it before this Congress is out to avoid having to reintroduce it into a new Congress next year.

However, the timeline for the bill to pass before the midterm elections in November is tightening, as Congress will also take a monthlong recess in August.

That tight timeline saw Galaxy Digital recently cut its odds of the CLARITY Act becoming law this year to 50%, saying that the Senate is running out of time to move on the bill before its August recess.

Features: Crypto lobby spending on Republicans far outpaces Democratic support 

Key Takeaways

• A cryptocurrency wallet associated with SpaceX transferred only $88 in Bitcoin following a half-year period of no activity
• The aerospace company maintains ownership of 18,712 BTC valued at approximately $1.16 billion
• Shares of SPCX finished Tuesday’s session down 6.83%, trading beneath its initial public offering price
• The equity has declined over 25% from recent peaks even with Nasdaq-100 membership
• JPMorgan projects that approximately $4.3 billion in passive investment flows could result from the index addition

A cryptocurrency wallet associated with Elon Musk’s aerospace venture SpaceX executed a Bitcoin transaction for the first time in half a year, sparking discussion among digital asset observers. Simultaneously, the company’s publicly traded shares have retreated more than 25% from their recent peak levels, despite securing a spot in the prestigious Nasdaq-100 index.

Space Exploration Technologies Corp., SPCX

SpaceX-Linked Wallet Executes Minimal BTC Transfer

Blockchain tracking service Arkham Intelligence reported that a wallet tied to SpaceX conducted a transaction involving just $88 in Bitcoin on July 8. This marked the conclusion of a six-month period during which the wallet remained completely dormant.

The modest transaction amount didn’t prevent market observers from weighing in with various theories. Historically, SpaceX’s cryptocurrency wallets have exhibited extended periods of inactivity before executing more substantial movements.

Data from Arkham indicates that SpaceX continues to maintain approximately 18,712 Bitcoin in its holdings, representing a market value of roughly $1.16 billion. The destination wallet in this transaction now contains 614 Bitcoin, worth approximately $38 million.

The previous significant movement from SpaceX wallets involved over 1,016 Bitcoin valued at close to $100 million at the time. Arkham’s analysis also revealed that outbound transfers from SpaceX to unidentified wallets rose during the cryptocurrency market downturn that occurred on October 10 of the previous year.

This activity emerges amid a broader trend of major corporate Bitcoin holders reducing positions. Strategy recently liquidated approximately $216 million in Bitcoin holdings. Additional companies including MARA Holdings, Nakamoto Holdings, and Sequans Communications have similarly announced Bitcoin disposals in recent weeks.

Bitcoin’s price stood above the $62,000 threshold on Tuesday but experienced a nearly 2% decline during the trading session. The decrease followed renewed military confrontations between the United States and Iran, with President Trump expressing skepticism regarding the durability of any potential cease-fire agreement.

SPCX Shares Slip Below Debut Price Amid Nasdaq-100 Inclusion

SPCX concluded Tuesday at $149.47, representing a 6.83% decline, with the intraday bottom reaching $148.86. The stock has now surrendered over 25% of its value from the highs recorded roughly one month earlier and has fallen beneath the price level established during its initial public offering.

SpaceX secured its position in the Nasdaq-100 index prior to Monday’s opening bell on July 7. The exchange operator granted an expedited inclusion based on updated guidelines that enable recently listed companies of substantial size to achieve index eligibility more rapidly than previous protocols allowed.

Analysts at JPMorgan calculate that the index membership will compel passive investment vehicles and exchange-traded funds to acquire approximately $4.3 billion in SPCX shares as they execute portfolio adjustments to mirror the Nasdaq-100 composition.

Notwithstanding the anticipated institutional purchasing pressure, market participants have persisted in realizing gains following the equity’s dramatic appreciation after its market introduction.

Major investment banks have expressed optimistic outlooks. Morgan Stanley, Goldman Sachs, and Citigroup have each initiated research coverage on SpaceX with elevated price objectives. Morgan Stanley established a $300 target price, representing the most aggressive projection among the three institutions.

Pre-market activity on Wednesday indicated shares climbing 0.49%.

Tokenized stock transfers rose 105% over the past month to $8.41 billion, according to RWA.xyz data cited in market reports. The jump shows faster activity in on-chain equity markets as crypto platforms and traditional finance firms expand tokenized stock products.

Tokenized stocks. Source: RWA.xyz

The sector’s distributed value also climbed 43% to $2.16 billion. The number of holders rose 17% to more than 409,000, showing that growth came from both transfer activity and user participation.

Figure recorded the fastest growth among major platforms, with distributed value rising 935% over 30 days. Securitize rose 332%, while xStocks gained about 62% during the same period.

Ondo remained the largest tokenized stock platform by distributed value at about $846 million. xStocks followed with about $708 million, while Securitize and Figure held about $306 million and $239 million.

DTCC brings Wall Street into tokenization

DTCC said it has brought more than 50 firms into an industry working group to help develop DTC’s tokenization service. The group supports testing around tokenized securities and other digital asset use cases.

A related report said DTCC plans tokenized securities pilots before an October 2026 launch. The service follows a December 2025 SEC no-action letter tied to tokenization of select DTC-custodied assets.

The approval covers a defined group of highly liquid assets. These include Russell 1000 stocks, major index ETFs and U.S. Treasury bills, notes and bonds.

The service will run under a three-year framework. DTC participants may use the system to test tokenized record-keeping and transfers on approved blockchain networks, while traditional custody controls remain in place.

Crypto exchanges push tokenized equities

The rise in tokenized stock transfers also follows new exchange-led offerings. Kraken, Bybit and Bitget Wallet used xStocks infrastructure during the SpaceX market cycle, giving users access to tokenized pre-IPO exposure.

A recent analysis said crypto platforms already owned much of the SpaceX tokenized stock trade. Demand reportedly exceeded available allocation, showing strong user interest in blockchain-based equity products.

Securitize also moved into public-market tokenization. The company issued tokenized versions of its own shares on Solana and Avalanche after listing on the New York Stock Exchange.

These moves show that tokenized stocks are no longer limited to small tests. They now include private-market access, public-company shares and infrastructure built by both crypto-native firms and regulated market players.

On-chain stocks gain wider market attention

Tokenized equities outpaced other parts of the real-world asset market over the past month. Tokenized U.S. Treasuries, still the largest RWA segment, stayed mostly flat, while the broader RWA market grew about 4% to $33.5 billion.

A separate guide explains how tokenized stocks work and why equities are moving on-chain. It notes that tokenized shares can represent legal or synthetic exposure, depending on product structure and jurisdiction.

Broader RWA growth adds context to the latest stock activity. A May report said tokenized real-world assets had grown to about $34 billion, with Treasuries and Ethereum-based products leading the market.

The next stage will depend on regulation, liquidity and investor access. DTCC’s pilot may give Wall Street a controlled route into tokenized securities, while crypto exchanges continue to move faster with user-facing products.