Audit log

Every state-changing event for Crypto Whale Repeat Phishing — $25.6M Drain August 2026: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-18 12:14:38Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   CrdfqBYhjqoj…fKjaRkEvcopysha256 → base58

   verifying row…

   canonical bytes (20205 B) ▸

   {"actor":"system:backfill","investigation_id":"1cc3092d-1f82-46ee-9145-3795a464c995","kind":"publish","page_slug":"crypto-whale-repeat-phishing-25-6m-drain-august-2026","published_at":"2026-08-18T12:14:38.096Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Crypto Whale Repeat Phishing — $25.6M Drain August 2026","sections":[{"content":"On August 12, 2026, an unidentified crypto whale suffered a $25.6 million wallet drain attributed to a phishing attack. According to on-chain analyst Specter and blockchain security firm PeckShield, the attacker obtained malicious token approvals from the victim — reportedly through a phishing link — that enabled unauthorized transferFrom calls across multiple ERC-20 token contracts. The stolen assets included approximately $6.3 million in aWBTC (Aave-wrapped Bitcoin), $4.7 million in WBTC, $5.1 million in DAI, $2.6 million in ETH, and smaller balances of cbBTC, USDS, LDO (Lido DAO), and CRV (Curve DAO). The attacker swiftly converted the basket into approximately 20 million DAI and 3,000 ETH, then distributed the proceeds across four newly created attacker-controlled addresses to complicate recovery. CertiK independently confirmed approximately $25 million leaving the victim address. The partial attacker address traced by Specter is reported as 0x8fEB...F95Ae. The victim's wallet address has not been fully disclosed in publicly available reporting.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"Phishing Attack Drains Crypto Whale Wallet Of Another $25.6M — Tron Weekly","type":"news_article","url":"https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/"},{"credibility":2,"name":"Crypto Whale Loses $25.6M Again as Weekly Hacks Cross $37M — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"},{"credibility":2,"name":"Crypto Whale Drained Of $25.6M In Second Major Phishing Attack — Crypto Adventure","type":"news_article","url":"https://cryptoadventure.com/crypto-whale-drained-of-25-6m-in-second-major-phishing-attack/"},{"credibility":2,"name":"Phishing attack drains $25.6 million from crypto whale, second loss tied to same wallet — Coin Turk","type":"news_article","url":"https://en.coin-turk.com/phishing-attack-drains-25-6-million-from-crypto-whale-second-loss-tied-to-same-wallet/"}]},{"content":"PeckShield's on-chain analysis identified the following composition of the $25.6 million drain: aWBTC (Aave-wrapped Bitcoin) at approximately $6.3 million; DAI stablecoin at approximately $5.1 million; WBTC (Wrapped Bitcoin) at approximately $4.7 million; ETH at approximately $2.6 million; and smaller amounts of cbBTC (Core Bitcoin), USDS (MakerDAO stablecoin), LDO (Lido DAO governance token), and CRV (Curve DAO governance token). All non-stablecoin assets were liquidated by the attacker into DAI and ETH within a short window following the drain. The converted proceeds — approximately 20 million DAI and 3,000 ETH — were then distributed across four separate addresses, a pattern consistent with post-exploit laundering preparation.","heading":"Stolen Asset Breakdown","severity":"critical","sources":[{"credibility":2,"name":"Crypto Whale Loses $25.6M Again as Weekly Hacks Cross $37M — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"},{"credibility":2,"name":"Phishing Attack Drains Crypto Whale Wallet Of Another $25.6M — Tron Weekly","type":"news_article","url":"https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/"}]},{"content":"The 2026 attack is reported to have followed the same general vector as the 2023 incident: the victim was induced — allegedly via a phishing link — to sign malicious token-approval transactions (specifically ERC-20 increaseAllowance or approve calls), granting the attacker the right to call transferFrom on the victim's behalf and drain approved token balances. The 2023 attack explicitly involved \"increaseAllowance\" transaction signatures, according to contemporaneous reporting by Scam Sniffer and CoinPaper. Whether the 2026 attack used the identical function or a related approval mechanism has not been confirmed in available sources as of the investigation date. The ERC-20 token approval model, which allows unlimited spending permissions, is a known and recurring attack surface; once a victim signs an approval, revocation requires an additional on-chain transaction, and many users fail to audit or revoke prior approvals. The 2023 phishing infrastructure associated with this wallet's prior incident included at least ten spoofed websites — among them airdrop-trustpad.io, coindroplet.io, icomarks.net, and trustpad.business — operated by a group linked to multiple phishing campaigns. Whether the same infrastructure or operators were involved in the 2026 incident has not been publicly confirmed.","heading":"Attack Mechanism: Malicious Token Approvals via Phishing","severity":"critical","sources":[{"credibility":2,"name":"Crypto Whale Loses $25.6 Million 2 Years After $24 Million Phishing Attack — BeInCrypto (via Yahoo Finance)","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/crypto-whale-loses-25-6-020144548.html"},{"credibility":2,"name":"Phishing scammer steals over $24 million from a crypto whale — CoinPaper (2023 incident)","type":"news_article","url":"https://coinpaper.com/2264/crypto-whale-loses-over-24-million-in-a-phishing-scam"},{"credibility":2,"name":"Crypto whale loses over $24M staked Ethereum to phishing — CryptoSlate (2023 incident)","type":"news_article","url":"https://cryptoslate.com/crypto-whale-loses-over-24m-staked-ethereum-to-phishing-as-verified-x-scams-surge/"}]},{"content":"The wallet targeted in August 2026 was previously drained on September 6, 2023, in a phishing attack that cost approximately $24.2 million. In that incident, the victim signed malicious increaseAllowance transactions that enabled an attacker to withdraw approximately 4,851 Rocket Pool ETH (rETH) and 9,579.2 Lido Staked ETH (stETH). The phisher subsequently swapped the tokens for roughly 13,785 ETH and 1.64 million DAI. Contemporaneous analysis by Scam Sniffer, Meta Sleuth, and MistTrack attributed the 2023 attack to a phishing operator running at least ten spoofed websites. In an unusual development, the 2023 attacker voluntarily returned approximately 90% of the stolen funds — approximately $21.8 million — leaving the victim with a net loss substantially below the gross amount taken. Partial proceeds from the 2023 attack were tracked to the FixedFloat exchange. The victim address in 2023 reporting carries the partial identifier 0x13e38.","heading":"Prior Incident: September 2023 $24.2M Drain","severity":"high","sources":[{"credibility":2,"name":"Phishing scammer steals over $24 million from a crypto whale — CoinPaper","type":"news_article","url":"https://coinpaper.com/2264/crypto-whale-loses-over-24-million-in-a-phishing-scam"},{"credibility":2,"name":"Crypto whale loses over $24M staked Ethereum to phishing — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/crypto-whale-loses-over-24m-staked-ethereum-to-phishing-as-verified-x-scams-surge/"},{"credibility":2,"name":"High-Profile Whale Loses Over $24M in Crypto Phishing Attack — CryptoPotato","type":"news_article","url":"https://cryptopotato.com/high-profile-whale-loses-over-24m-in-crypto-phishing-attack-report/"},{"credibility":2,"name":"Crypto whale losses over $24m in phishing scam — Crypto.news","type":"news_article","url":"https://crypto.news/crypto-whale-losses-over-24m-in-phishing-scam/"}]},{"content":"The same Ethereum wallet address has now been the victim of two major phishing attacks within approximately three years, with a combined gross loss of approximately $49.8 million. The repeat targeting of the same address is notable: it suggests either that the wallet holder failed to revoke token approvals or implement enhanced operational security following the 2023 incident, or that the attacker — or a separate attacker with knowledge of the prior incident — specifically re-targeted the address knowing it held significant assets. The 2026 attack occurred despite the existence of a resolved prior incident involving the same wallet, raising questions about whether the victim took remedial steps after 2023. No analyst has publicly confirmed whether the 2026 attacker is the same individual or group responsible for the 2023 attack. As of mid-August 2026, no funds from the 2026 incident had been returned, contrasting sharply with the 2023 attacker's partial restitution.","heading":"Repeat Targeting and Cumulative Exposure","severity":"high","sources":[{"credibility":3,"name":"A Crypto Whale Lost $25.6 Million To The Same Phishing Trick Twice — Startup Fortune","type":"news_article","url":"https://startupfortune.com/a-crypto-whale-lost-256-million-to-the-same-phishing-trick-twice/"},{"credibility":3,"name":"Crypto Whale Loses $25.6 Million in Second Phishing Attack on Same Wallet — BigGo Finance","type":"news_article","url":"https://finance.biggo.com/news/51a47b35-732c-42cc-8422-0fc7bfcecfaa"},{"credibility":2,"name":"Crypto Whale Loses $25.6M Again as Weekly Hacks Cross $37M — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"}]},{"content":"The August 12, 2026 whale drain occurred within a broader week of crypto security incidents. According to Crypto Times reporting, total confirmed losses for the week of August 9–15, 2026 exceeded $37 million. Other incidents during that window included a $7.9 million cross-chain hot-wallet compromise at Coinsbuy (August 9), an approximately $3.2 million realized loss from an unauthorized minting event on Harmony Protocol (August 11–12), and smaller exploits on the Coreum-XRPL bridge and USM Protocol. CertiK's Hack3d report for the first half of 2026 placed total Web3 losses at approximately $1.31 billion across 344 incidents, with adjusted losses of approximately $1.2 billion after accounting for frozen and recovered funds. AMBCrypto reported 2026 year-to-date on-chain exploit losses exceeding $1.2 billion through mid-August.","heading":"Broader Weekly Losses and 2026 Context","severity":"medium","sources":[{"credibility":2,"name":"Crypto Whale Loses $25.6M Again as Weekly Hacks Cross $37M — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"},{"credibility":2,"name":"Crypto whale drained $25.6M as physical attacks spread: 2026 losses top $1.2B — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/crypto-whale-drained-25-6m-as-physical-attacks-spread-2026-losses-top-1-2b/"}]},{"content":"On-chain analyst Specter first flagged the August 12, 2026 drain and traced stolen proceeds to an attacker address with the partial identifier 0x8fEB...F95Ae. Blockchain security firm PeckShield independently confirmed the asset breakdown, identifying the four attacker-controlled destination addresses holding approximately 20 million DAI and 3,000 ETH post-swap. CertiK independently confirmed the approximate scale of funds leaving the victim address. No law enforcement agency or regulatory body had publicly announced an investigation into the 2026 incident as of the investigation date. No ZachXBT attribution was found in available sources for the 2026 attack specifically. The 2023 incident was analyzed by Scam Sniffer, Meta Sleuth, and MistTrack, who identified the phishing infrastructure; no public confirmation has linked those analysts or their findings to the 2026 attacker.","heading":"Analyst Attribution and On-Chain Forensics","severity":"medium","sources":[{"credibility":2,"name":"Phishing Attack Drains Crypto Whale Wallet Of Another $25.6M — Tron Weekly","type":"news_article","url":"https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/"},{"credibility":2,"name":"Crypto Whale Drained Of $25.6M In Second Major Phishing Attack — Crypto Adventure","type":"news_article","url":"https://cryptoadventure.com/crypto-whale-drained-of-25-6m-in-second-major-phishing-attack/"},{"credibility":2,"name":"Crypto Whale Loses $25.6 Million In Targeted Wallet Hack — CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/b7cde-crypto-whale-loses-25-6-million-hack"}]},{"content":"As of mid-August 2026, no portion of the $25.6 million stolen in the 2026 attack had been returned or frozen, according to multiple reporting sources. This is a material contrast to the 2023 incident, in which the attacker voluntarily returned approximately 90% of stolen funds. There is no public indication that the 2026 attacker has made contact with the victim or made any restitution offer. The victim's identity remains unknown; no wallet revocation, exchange freeze, or law enforcement coordination has been reported. The attacker's use of four destination addresses and rapid conversion to liquid assets (DAI and ETH) is consistent with laundering preparation, though no exchange freeze or asset seizure had been publicly confirmed at the time of this investigation.","heading":"Recovery Status and Remediation","severity":"high","sources":[{"credibility":2,"name":"Phishing attack drains $25.6 million from crypto whale, second loss tied to same wallet — Coin Turk","type":"news_article","url":"https://en.coin-turk.com/phishing-attack-drains-25-6-million-from-crypto-whale-second-loss-tied-to-same-wallet/"},{"credibility":2,"name":"Crypto Whale Loses $25.6 Million 2 Years After $24 Million Phishing Attack — BeInCrypto (Yahoo Finance)","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/crypto-whale-loses-25-6-020144548.html"}]}],"sources_used":[{"credibility":2,"name":"Crypto Whale Loses $25.6M Again as Weekly Hacks Cross $37M — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"},{"credibility":2,"name":"Crypto Whale Loses $25.6 Million 2 Years After $24 Million Phishing Attack — BeInCrypto (via Yahoo Finance)","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/crypto-whale-loses-25-6-020144548.html"},{"credibility":2,"name":"Phishing Attack Drains Crypto Whale Wallet Of Another $25.6M — Tron Weekly","type":"news_article","url":"https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/"},{"credibility":2,"name":"Phishing attack drains $25.6 million from crypto whale, second loss tied to same wallet — Coin Turk","type":"news_article","url":"https://en.coin-turk.com/phishing-attack-drains-25-6-million-from-crypto-whale-second-loss-tied-to-same-wallet/"},{"credibility":2,"name":"Crypto Whale Drained Of $25.6M In Second Major Phishing Attack — Crypto Adventure","type":"news_article","url":"https://cryptoadventure.com/crypto-whale-drained-of-25-6m-in-second-major-phishing-attack/"},{"credibility":2,"name":"Crypto whale drained $25.6M as physical attacks spread: 2026 losses top $1.2B — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/crypto-whale-drained-25-6m-as-physical-attacks-spread-2026-losses-top-1-2b/"},{"credibility":3,"name":"A Crypto Whale Lost $25.6 Million To The Same Phishing Trick Twice — Startup Fortune","type":"news_article","url":"https://startupfortune.com/a-crypto-whale-lost-256-million-to-the-same-phishing-trick-twice/"},{"credibility":2,"name":"Crypto Whale Loses $25.6 Million In Targeted Wallet Hack — CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/b7cde-crypto-whale-loses-25-6-million-hack"},{"credibility":2,"name":"Phishing scammer steals over $24 million from a crypto whale — CoinPaper (2023 incident)","type":"news_article","url":"https://coinpaper.com/2264/crypto-whale-loses-over-24-million-in-a-phishing-scam"},{"credibility":2,"name":"Crypto whale loses over $24M staked Ethereum to phishing — CryptoSlate (2023 incident)","type":"news_article","url":"https://cryptoslate.com/crypto-whale-loses-over-24m-staked-ethereum-to-phishing-as-verified-x-scams-surge/"},{"credibility":2,"name":"High-Profile Whale Loses Over $24M in Crypto Phishing Attack — CryptoPotato (2023 incident)","type":"news_article","url":"https://cryptopotato.com/high-profile-whale-loses-over-24m-in-crypto-phishing-attack-report/"},{"credibility":2,"name":"Crypto whale losses over $24m in phishing scam — Crypto.news (2023 incident)","type":"news_article","url":"https://crypto.news/crypto-whale-losses-over-24m-in-phishing-scam/"},{"credibility":3,"name":"Crypto Whale Loses $25.6 Million in Second Phishing Attack on Same Wallet — BigGo Finance","type":"news_article","url":"https://finance.biggo.com/news/51a47b35-732c-42cc-8422-0fc7bfcecfaa"}],"summary":"On August 12, 2026, an unidentified Ethereum whale lost approximately $25.6 million in WBTC, cbBTC, aWBTC, DAI, ETH, LDO, USDS, and CRV to a phishing attack that induced the victim to authorize malicious token-approval transactions. The same wallet had previously lost $24.2 million in a nearly identical phishing scheme in September 2023, of which approximately 90% was returned; no funds from the 2026 attack had been recovered as of mid-August 2026. The combined gross exposure across both incidents is approximately $49.8 million, making this one of the most consequential repeat-targeting cases in Ethereum's history.","timeline":[{"date":"2023-09-06","event":"The same Ethereum wallet (partial ID: 0x13e38) lost approximately $24.2 million in rETH and stETH after the victim signed malicious increaseAllowance transactions. The 2023 attacker swapped assets into approximately 13,785 ETH and 1.64 million DAI.","source":"CoinPaper / CryptoSlate","source_url":"https://coinpaper.com/2264/crypto-whale-loses-over-24-million-in-a-phishing-scam"},{"date":"2023-09","event":"The 2023 attacker voluntarily returned approximately 90% of stolen funds — approximately $21.8 million — to the victim's wallet. Partial proceeds were traced to FixedFloat exchange.","source":"CryptoPotato / Crypto.news","source_url":"https://cryptopotato.com/high-profile-whale-loses-over-24m-in-crypto-phishing-attack-report/"},{"date":"2026-08-12","event":"The same Ethereum whale wallet was drained of $25.6 million in a second phishing attack. Stolen assets included aWBTC ($6.3M), DAI ($5.1M), WBTC ($4.7M), ETH ($2.6M), and smaller amounts of cbBTC, USDS, LDO, and CRV. On-chain analyst Specter flagged the drain; attacker address partial ID reported as 0x8fEB...F95Ae.","source":"Crypto Times / Tron Weekly / Coin Turk","source_url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"},{"date":"2026-08-12","event":"PeckShield confirmed the attacker converted all stolen assets into approximately 20 million DAI and 3,000 ETH, distributed across four separate attacker-controlled addresses.","source":"Tron Weekly / Crypto Adventure","source_url":"https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/"},{"date":"2026-08-13","event":"CertiK independently confirmed approximately $25 million in outflows from the victim address. Multiple crypto news outlets published coverage of the incident.","source":"Crypto Adventure","source_url":"https://cryptoadventure.com/crypto-whale-drained-of-25-6m-in-second-major-phishing-attack/"},{"date":"2026-08-15","event":"No funds from the 2026 attack had been returned as of mid-week. Weekly crypto losses for August 9–15, 2026 confirmed to exceed $37 million across multiple incidents.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/"},{"date":"2026-08-16","event":"Crypto Times and AMBCrypto publish comprehensive weekly security roundups contextualizing the whale drain within broader 2026 losses exceeding $1.2 billion year-to-date.","source":"AMBCrypto","source_url":"https://ambcrypto.com/crypto-whale-drained-25-6m-as-physical-attacks-spread-2026-losses-top-1-2b/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4c5a046f-15e3-4f18-9c37-4e50187dbe8acopy