Audit log

Every state-changing event for Crypto Whale — $25.6M Repeat Phishing Drain (August 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-23 12:09:14Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   4XKMDdsEdLHq…J7KSsvwhcopysha256 → base58

   verifying row…

   canonical bytes (16545 B) ▸

   {"actor":"system:backfill","investigation_id":"d2e83b50-26b3-4b94-bf76-3e25e8acd59c","kind":"publish","page_slug":"crypto-whale-25-6m-repeat-phishing-drain-august-2026","published_at":"2026-08-23T12:09:14.128Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Crypto Whale — $25.6M Repeat Phishing Drain (August 2026)","sections":[{"content":"On August 12, 2026, on-chain security firm PeckShield reported that an unidentified crypto whale lost approximately $25.6 million in a phishing attack on an Ethereum wallet. The stolen assets comprised wrapped Bitcoin (aWBTC, approximately $6.3 million; WBTC direct holdings, approximately $4.7 million), cbBTC, Lido DAO (LDO), USDS stablecoin, and Curve DAO Token (CRV). Following the theft, the attacker consolidated the proceeds by swapping all seized tokens into approximately 20 million DAI and 3,000 ETH. PeckShield traced these proceeds to four separate wallet addresses. On-chain investigator Specter identified an attacker address abbreviated as 0x8fEB...F95Ae as responsible for the 2026 theft. No funds from this incident had been returned as of reporting. The attack occurred during a week (August 9–15, 2026) in which confirmed crypto losses across multiple separate incidents exceeded $37 million in total.","heading":"Incident Overview — August 12, 2026","severity":"critical","sources":[{"credibility":2,"name":"Crypto Whale Loses $25.6M Again as Weekly Hacks Cross $37M — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"},{"credibility":2,"name":"Phishing Attack Drains Crypto Whale Wallet Of Another $25.6M — Tron Weekly","type":"news_article","url":"https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/"},{"credibility":2,"name":"Crypto Whale Drained Of $25.6M In Second Major Phishing Attack — Crypto Adventure","type":"news_article","url":"https://cryptoadventure.com/crypto-whale-drained-of-25-6m-in-second-major-phishing-attack/"},{"credibility":2,"name":"Phishing attack drains $25.6 million from crypto whale, second loss tied to same wallet — Coin Turk","type":"news_article","url":"https://en.coin-turk.com/phishing-attack-drains-25-6-million-from-crypto-whale-second-loss-tied-to-same-wallet/"}]},{"content":"The 2023 attack on the same wallet was executed via malicious token approval phishing, specifically exploiting the ERC-20 increaseAllowance function. Web3 security firm Scam Sniffer reported at the time that the victim unknowingly signed increaseAllowance transactions that granted the attacker permission to transfer tokens from the victim's address using Ethereum's transferFrom mechanism. The malicious address involved in 2023 had previously been flagged and was associated with multiple crypto phishing websites. Scam Sniffer attributed the 2023 theft to the phishing kit it tracks as MS Drainer. The specific technical vector exploited in the August 2026 attack has not been publicly confirmed in available reporting; sources describe it as a phishing attack consistent with the malicious approval methodology used in 2023, but no new technical breakdown has been published. The attack did not require the victim to disclose a seed phrase; instead, it relied on tricking the victim into signing a transaction that granted the attacker token-spending authorization.","heading":"Phishing Methodology","severity":"critical","sources":[{"credibility":2,"name":"Whale Loses $24M in Massive Crypto Phishing Attack — BeinCrypto (2023 incident, methodology)","type":"news_article","url":"https://beincrypto.com/crypto-phishing-victim-scam/"},{"credibility":2,"name":"Crypto whale loses over $24M staked Ethereum to phishing — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/crypto-whale-loses-over-24m-staked-ethereum-to-phishing-as-verified-x-scams-surge/"},{"credibility":2,"name":"A Crypto Whale Lost $25.6 Million To The Same Phishing Trick Twice — Startup Fortune","type":"news_article","url":"https://startupfortune.com/a-crypto-whale-lost-256-million-to-the-same-phishing-trick-twice/"}]},{"content":"On September 6, 2023, the same Ethereum wallet (partially identified in reporting as address beginning with 0x13e382) lost approximately $24.23 million to a phishing attack. The stolen assets at that time consisted of approximately 4,851 Rocket Pool ETH (rETH) and 9,579.2 Lido Staked ETH (stETH), which the attacker swapped for approximately 13,785 ETH and 1.64 million DAI. The attacker distributed stolen funds between two addresses (0x693b72 and 0x4c10a4) and moved a portion through the FixedFloat exchange. Approximately ten months after the 2023 theft, in July 2024, the attacker returned nearly $9.3 million in DAI to the victim in two transfers ($5.23 million and $4.04 million), representing roughly 90% partial restitution — an unusual outcome in phishing cases. No equivalent return occurred following the August 2026 incident. The victim's on-chain profile at the time of the 2023 attack included significant DeFi activity: WBTC/USDT liquidity provision on Uniswap V3 exceeding $1.6 million, and engagement with Aave, 1inch, Curve, and other protocols.","heading":"Prior Incident — September 2023 Attack and Partial Recovery","severity":"high","sources":[{"credibility":2,"name":"Whale Loses $24M in Massive Crypto Phishing Attack — BeinCrypto","type":"news_article","url":"https://beincrypto.com/crypto-phishing-victim-scam/"},{"credibility":2,"name":"High-Profile Whale Loses Over $24M in Crypto Phishing Attack — CryptoPotato","type":"news_article","url":"https://cryptopotato.com/high-profile-whale-loses-over-24m-in-crypto-phishing-attack-report/"},{"credibility":2,"name":"Crypto Whale Loses $25.6 Million 2 Years After $24 Million Phishing Attack — Yahoo Finance / BeinCrypto","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/crypto-whale-loses-25-6-020144548.html"},{"credibility":2,"name":"Victim Loses $24 Million Staked ETH In One Of Biggest Ever Phishing Thefts From An Individual — Inside Bitcoin","type":"news_article","url":"https://insidebitcoins.com/news/victim-loses-24-million-staked-eth-in-one-of-biggest-ever-phishing-thefts-from-an-individual"}]},{"content":"The two incidents — September 2023 and August 2026, approximately three years apart — represent a documented repeat-targeting pattern in which the same wallet was compromised using the same general phishing vector on two separate occasions. Combined losses across both incidents total approximately $49.8 million. The 2026 attack differed from the 2023 attack in at least one observable respect: the stolen asset composition shifted from primarily liquid staking tokens (rETH, stETH) to a diversified DeFi portfolio spanning wrapped Bitcoin variants, LDO, USDS, and CRV, suggesting the wallet's holdings had evolved while its operational security posture remained vulnerable to approval-based phishing. Reporting from CryptoAdventure cites on-chain investigator Specter as having identified the repeat pattern. The exact mechanism by which the attacker targeted the same wallet a second time has not been publicly confirmed. Possible explanations cited in coverage include persistent attacker intelligence on historically exploited high-value addresses or automated scanning of addresses previously associated with phishing activity. No law enforcement action or asset freeze has been reported in connection with either incident.","heading":"Repeat-Targeting Pattern","severity":"high","sources":[{"credibility":2,"name":"Crypto Whale Drained Of $25.6M In Second Major Phishing Attack — Crypto Adventure","type":"news_article","url":"https://cryptoadventure.com/crypto-whale-drained-of-25-6m-in-second-major-phishing-attack/"},{"credibility":2,"name":"A Crypto Whale Lost $25.6 Million To The Same Phishing Trick Twice — Startup Fortune","type":"news_article","url":"https://startupfortune.com/a-crypto-whale-lost-256-million-to-the-same-phishing-trick-twice/"},{"credibility":2,"name":"Phishing attack drains $25.6 million from crypto whale, second loss tied to same wallet — Coin Turk","type":"news_article","url":"https://en.coin-turk.com/phishing-attack-drains-25-6-million-from-crypto-whale-second-loss-tied-to-same-wallet/"}]},{"content":"Following the August 2026 theft, PeckShield tracked the stolen assets — converted to approximately 20 million DAI and 3,000 ETH — to four separate wallet addresses. Specific addresses for these four destination wallets have not been disclosed in available reporting. The 2026 attacker address has been partially identified by on-chain investigator Specter as 0x8fEB...F95Ae; no further expansion of this address has appeared in indexed reporting. As of available reporting, no funds from the August 2026 theft had been returned, frozen by an exchange, or intercepted. In the 2023 incident, the attacker moved a portion of stolen funds through FixedFloat exchange and later returned approximately $9.3 million in DAI in July 2024; no comparable exchange routing or return has been confirmed for the 2026 incident.","heading":"Fund Disposition and On-Chain Tracing","severity":"high","sources":[{"credibility":2,"name":"Phishing Attack Drains Crypto Whale Wallet Of Another $25.6M — Tron Weekly","type":"news_article","url":"https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/"},{"credibility":2,"name":"Crypto Whale Loses $25.6M Again as Weekly Hacks Cross $37M — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"},{"credibility":2,"name":"Crypto Whale Drained Of $25.6M In Second Major Phishing Attack — Crypto Adventure","type":"news_article","url":"https://cryptoadventure.com/crypto-whale-drained-of-25-6m-in-second-major-phishing-attack/"}]},{"content":"The August 12, 2026 incident occurred within a week (August 9–15) in which multiple crypto theft incidents were reported, with confirmed losses exceeding $37 million in aggregate. That same week included a $7.9 million breach of the Coinsbuy exchange (August 9), a $3.2 million unauthorized mint on Harmony Protocol (August 11–12), a $200,000 Coreum-XRPL bridge drain (August 9), and a $136,000 flash loan exploit on the USM Protocol (August 10). CertiK's report for H1 2026 noted that Web3 losses reached $1.31 billion across 344 incidents in the first half of the year, with wallet compromises and infrastructure breaches identified as the primary attack surface. AMBCrypto reported that 2026 cumulative on-chain exploit losses had exceeded $1.2 billion as of mid-August, including approximately $107 million linked to physical coercion attacks, though the whale phishing incident is distinct from that category.","heading":"Broader 2026 Threat Context","severity":"medium","sources":[{"credibility":2,"name":"Crypto Whale Loses $25.6M Again as Weekly Hacks Cross $37M — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"},{"credibility":2,"name":"Crypto whale drained $25.6M as physical attacks spread: 2026 losses top $1.2B — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/crypto-whale-drained-25-6m-as-physical-attacks-spread-2026-losses-top-1-2b/"}]}],"sources_used":[{"credibility":2,"name":"Crypto Whale Loses $25.6M Again as Weekly Hacks Cross $37M — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"},{"credibility":2,"name":"Phishing Attack Drains Crypto Whale Wallet Of Another $25.6M — Tron Weekly","type":"news_article","url":"https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/"},{"credibility":2,"name":"Crypto Whale Loses $25.6 Million 2 Years After $24 Million Phishing Attack — BeinCrypto / Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/crypto-whale-loses-25-6-020144548.html"},{"credibility":2,"name":"A Crypto Whale Lost $25.6 Million To The Same Phishing Trick Twice — Startup Fortune","type":"news_article","url":"https://startupfortune.com/a-crypto-whale-lost-256-million-to-the-same-phishing-trick-twice/"},{"credibility":2,"name":"Phishing attack drains $25.6 million from crypto whale, second loss tied to same wallet — Coin Turk","type":"news_article","url":"https://en.coin-turk.com/phishing-attack-drains-25-6-million-from-crypto-whale-second-loss-tied-to-same-wallet/"},{"credibility":2,"name":"Crypto Whale Drained Of $25.6M In Second Major Phishing Attack — Crypto Adventure","type":"news_article","url":"https://cryptoadventure.com/crypto-whale-drained-of-25-6m-in-second-major-phishing-attack/"},{"credibility":2,"name":"Crypto whale drained $25.6M as physical attacks spread: 2026 losses top $1.2B — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/crypto-whale-drained-25-6m-as-physical-attacks-spread-2026-losses-top-1-2b/"},{"credibility":2,"name":"Whale Loses $24M in Massive Crypto Phishing Attack (2023 incident) — BeinCrypto","type":"news_article","url":"https://beincrypto.com/crypto-phishing-victim-scam/"},{"credibility":2,"name":"High-Profile Whale Loses Over $24M in Crypto Phishing Attack — CryptoPotato","type":"news_article","url":"https://cryptopotato.com/high-profile-whale-loses-over-24m-in-crypto-phishing-attack-report/"},{"credibility":2,"name":"Crypto whale loses over $24M staked Ethereum to phishing — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/crypto-whale-loses-over-24m-staked-ethereum-to-phishing-as-verified-x-scams-surge/"},{"credibility":2,"name":"Victim Loses $24 Million Staked ETH In One Of Biggest Ever Phishing Thefts From An Individual — Inside Bitcoin","type":"news_article","url":"https://insidebitcoins.com/news/victim-loses-24-million-staked-eth-in-one-of-biggest-ever-phishing-thefts-from-an-individual"},{"credibility":2,"name":"Crypto Whale Loses $25.6 Million in Targeted Wallet Hack — CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/b7cde-crypto-whale-loses-25-6-million-hack"}],"summary":"On August 12, 2026, an unidentified Ethereum whale wallet was drained of approximately $25.6 million in WBTC, cbBTC, LDO, USDS, and CRV through a phishing attack — the second major exploitation of the same address, which had previously lost $24.2 million to a phishing incident in September 2023. The stolen assets were swapped to approximately 20 million DAI and 3,000 ETH and traced by PeckShield to four distinct attacker-controlled addresses. This page documents the phishing infrastructure and repeat-targeting pattern rather than the victim; the victim is the unnamed whale wallet, not a threat actor.","timeline":[{"date":"2023-09-06","event":"An Ethereum whale wallet (partially identified as 0x13e382...) lost approximately $24.23 million in rETH and stETH after signing malicious increaseAllowance transactions. Funds moved to attacker addresses 0x693b72 and 0x4c10a4, with a portion routed through FixedFloat.","source":"BeinCrypto, Scam Sniffer, CryptoSlate","source_url":"https://beincrypto.com/crypto-phishing-victim-scam/"},{"date":"2024-07-01","event":"Approximately ten months after the 2023 theft, the 2023 attacker returned approximately $9.3 million in DAI to the victim in two transfers ($5.23 million and $4.04 million), representing roughly 90% restitution of the 2023 loss.","source":"CryptoPotato, Startup Fortune","source_url":"https://startupfortune.com/a-crypto-whale-lost-256-million-to-the-same-phishing-trick-twice/"},{"date":"2026-08-12","event":"The same Ethereum whale wallet was drained of approximately $25.6 million in WBTC, cbBTC, LDO, USDS, and CRV via a phishing attack. Stolen assets were swapped to approximately 20 million DAI and 3,000 ETH. PeckShield traced proceeds to four attacker-controlled addresses. On-chain investigator Specter identified attacker address 0x8fEB...F95Ae.","source":"PeckShield, Crypto Times, Tron Weekly, BeinCrypto","source_url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"},{"date":"2026-08-16","event":"Crypto Times reported the week of August 9–15 as producing over $37 million in confirmed crypto theft across multiple incidents, with the whale phishing drain being the single largest loss of the week.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 29b684fd-dc52-45d8-89ca-a005c2e80bfccopy