Delayed Crypto Heist: Hacker Waits Over a Year to Strike and Steal $908K

It’s a harsh reminder that in the world of crypto, even a transaction signed over a year ago can come back to haunt you. On August 2, a crypto user lost $908,551 worth of USDC in a wallet-draining attack that was quietly set in motion 458 days earlier, according to on-chain data shared by Scam Sniffer.

A long-delayed strike

The incident traces back to April 30, 2024, when the victim unknowingly signed a malicious ERC-20 token approval. Security analysts believe the approval may have been triggered by a phishing site or a fake airdrop campaign.

This action granted a scammer-controlled wallet, identified on-chain as “0x67E5Ae” and linked to the known pink-drainer.eth address, ongoing access to the victim’s funds.

For more than a year, the compromised wallet remained largely inactive and held little value. That changed on July 2, when the user deposited $762,397 in USDC from a MetaMask wallet, followed shortly by another $146,154 from a Kraken account.

The attacker appeared to monitor the address for weeks, waiting until the balance was high enough before executing a single, swift transaction on August 2, draining the wallet entirely at 4:57 a.m. UTC.

Growing concerns over approval-based attacks

Phishing approval scams like this one exploit a fundamental feature of ERC-20 tokens: once a wallet grants permission for a third party to access its funds, that approval remains valid until manually revoked.

Security experts, including Scam Sniffer, are once again urging users to regularly review and revoke unused approvals to avoid potential losses. Tools such as Etherscan’s Token Approval Checker can help users identify risky allowances, though revoking them incurs a small gas fee.

This latest case adds to an alarming trend of rising crypto-related exploits. According to industry trackers, over $142 million was stolen in July alone across at least 17 attacks, with incidents ranging from phishing scams to major exchange exploits.

The delayed nature of this theft highlights how attackers often take a “wait-and-watch” approach, striking only when it’s financially worthwhile.

Other Related Read/Listens

• Telegram’s Founder Back in the Hot Seat: French Authorities Probe App’s Alleged Dark Side
• Inside the Bitcoin Laundering Plot That Landed Kuaishou Staff in Jail
• She Took $90K for Crypto, Now She's on Trial for Her Mother’s Death