A cryptocurrency investor lost $3 million in a phishing scam after signing a malicious blockchain transaction without verifying the contract address, highlighting the risk posed by digital asset scams.<\/p>\n
A single wrong click was all it took to drain $3 million worth of USDt (USDT<\/a>) from an investor who failed to verify the contract address before signing the blockchain transaction.<\/p>\n \u201cSomeone fell victim to a phishing attack, signed a malicious transfer, and lost 3.05M $USDT,\u201d according<\/a> to a Wednesday X post from blockchain analytics platform Lookonchain. \u201cStay alert, stay safe. One wrong click can drain your wallet. Never sign a transaction you don\u2019t fully understand.\u201d<\/p>\n Crypto phishing attacks<\/a> are social engineering schemes in which attackers share fraudulent links to steal victims\u2019 sensitive information, such as private keys to cryptocurrency wallets.<\/p>\n Like most investors, the victim probably validated the wallet address by only matching the first and last few characters before transferring the $3 million to the malicious actor. The difference would have been noticeable in the middle characters, often hidden on platforms to improve visual appeal.<\/p>\n Related: <\/strong><\/em>Lazarus Group laundered over $200M in hacked crypto since 2020<\/strong><\/em><\/a><\/p>\n Highlighting the need for more investor due diligence, another victim lost over $900,000 worth of digital assets to a sophisticated phishing attack<\/a> on Sunday, 458 days after unknowingly signing a malicious approval transaction to a wallet-draining scam, Cointelegraph reported.<\/p>\n These amounts pale in comparison to the $71 million lost to a wallet poisoning scam<\/a> in May 2024, which took a surprising turn when the scammer had a change of heart and returned the $71 million<\/a> in two weeks after folding to the growing pressure from global blockchain investigators who revealed the attacker\u2019s potential Hong Kong-based IP address.<\/p>\n Related: <\/strong><\/em>CrediX recovers $4.5M in crypto after successful exploit negotiation<\/strong><\/em><\/a><\/p>\n Hackers are gradually shifting their focus from code to exploiting vulnerabilities in human psychology, which may be easier to bypass than protocol guardrails.\u00a0<\/p>\n Phishing attacks were the most costly attack<\/a> vector for the crypto industry in 2024, netting attackers over $1 billion worth of stolen digital assets across 296 incidents, according<\/a> to CertiK\u2019s annual Web3 security report<\/p>\n Out of the almost 300 phishing attacks in 2024, at least three resulted in over $100 million worth of losses.<\/p>\n \u201cPhishing was the most costly attack vector last year,\u201d a CertiK spokesperson told Cointelegraph. \u201cOur figures are conservative; the actual figure is higher when you consider unreported incidents and other types of phishing scams like pig butchering.\u201d<\/p>\n To counter this growing threat, the security team of Binance, the world\u2019s largest exchange, developed an \u201cantidote\u201d<\/a> against address poisoning scams, which launched an algorithm that detected nearly 15 million poisoned addresses, Cointelegraph reported in May 2024.<\/p>\nCrypto phishing attacks top security concern of 2024<\/h2>\n