[ND Report] $1 Million Vanishes with a Single Click, the Threat of Crypto Phishing in 2026

On July 9, 2026, the crypto market witnessed the fatal consequences of a single incorrect signature. An incident occurred where a trader had $1 million worth of assets stolen immediately after signing a malicious token approval. This event once again highlighted the dangers of the "approval phishing" technique used by on-chain scammers.

As of 2026, this attack method has established itself as the most effective means of targeting high-net-worth individuals. On-chain scammers earned over $14 billion in profits last year alone, with approval phishing at the center. Experts warn that attackers are further refining social engineering techniques that exploit psychological vulnerabilities rather than technical flaws.

The core of approval phishing is tricking users into granting permission for attackers to control the tokens in their wallets. It primarily involves inducing users to call the 'increaseAllowance' function or exploiting the 'Permit' feature, which transfers authority with just a signature. The moment a user clicks the approval button without fully understanding the transaction's content, the attacker gains the authority to withdraw unlimited assets from that wallet.

On-chain scammers earned over $14 billion in profits last year, and approval phishing remains their primary attack route for targeting high-value assets.

Attackers lure users into connecting their wallets through sophisticatedly disguised websites. Victims mistakenly believe they are using legitimate decentralized finance (DeFi) services, but in reality, malicious scripts are executed to steal assets. These methods are designed to make the risks difficult to recognize within the wallet interface, making it easy for even experienced traders to be deceived.

Changes in the Phishing Landscape and AI Threats in 2026

According to statistics from the first half of 2026, AI-based phishing attacks have surged by 1,380% compared to the previous year, threatening the security ecosystem. The success rate of AI-generated phishing emails reached 82.6%, which is significantly higher than those written by human experts. Additionally, phishing using QR codes increased by 400%, and voice phishing increased by 442%, making multi-channel attacks mainstream.

• Immediately change account passwords on a clean device and adopt stronger authentication methods.
• Remove all unfamiliar browser extensions or applications installed.
• Use on-chain security tools to immediately revoke token approval permissions granted to untrusted contracts.
• Thoroughly review email forwarding rules or account recovery settings for any unauthorized changes.

Behind these attacks are a small number of highly skilled attackers generating massive profits. According to analysis, the most successful single phishing address stole approximately $44.3 million, accounting for about 4.4% of the total approval phishing losses. The fact that the top 10 attack addresses occupy a significant portion of all stolen assets clearly demonstrates the organized nature of this crime.

Cumulative losses from approval phishing are estimated to be approaching approximately $1 billion to date. This suggests that despite advancements in virtual asset security infrastructure, individual user security awareness remains the weakest link. Attackers are further refining social engineering techniques that exploit psychological vulnerabilities rather than technical flaws.

Technical Evolution and Future Outlook

In particular, the spread of device code phishing is raising concerns as it neutralizes existing multi-factor authentication (MFA) systems. As technical barriers to criminal platforms have lowered, an environment has been created where even novice criminals can perform sophisticated attacks. This trend is expected to continue in the second half of 2026, requiring special caution from investors.

Rather than relying on simple authentication procedures, investors should develop the habit of closely checking the contents of every transaction they sign. Additionally, regularly checking the approval status of wallets and immediately revoking unnecessary permissions is the best way to protect assets. It must be kept in mind that security threats are evolving in step with the growth of the virtual asset market.