Crypto investor lost $2.1 million due to phishing in ChatGPT

A crypto investor writing in Russian asked ChatGPT where to convert cryptocurrency and received a link to a scam website. After connecting his wallet and signing a dangerous transaction, $2.1 million in assets were withdrawn.

How the Investor Ended Up on a Phishing Site

A user under the nickname Alex was looking for a way to exchange sFLR tokens for WFLR. He asked ChatGPT, and the chatbot suggested a link that the investor took for a legitimate exchange platform.

On the site, Alex connected his crypto wallet and confirmed a transaction with unlimited approval. This type of permission gives a third-party address overly broad rights to manage funds if the user does not check the transaction details.

Within seconds, the attacker used the transferFrom function and withdrew 1.9 million FXRP from the wallet. At the time of the theft, the amount was estimated at $2.1 million.

What Was Tracked on the Blockchain

After the incident, Alex published the transaction data and wallet addresses in X, through which the stolen funds may have passed. He asked the community to help track the further movement of the assets.

A blockchain analyst working under the pseudonym VAL noted a transfer of 50 ETH to Tornado Cash. The funds left a wallet that had previously received 120,000 DAI.

The same address also received money from other users. 380,000 DAI remained in the wallet, while 310,000 DAI had already been distributed between two other addresses.

Further investigation showed that 700,000 DAI had arrived at this wallet two months earlier. The funds came in 13 transactions: senders first exchanged FLR for DAI via OpenOcean and then transferred the coins further.

Asset Trails and User Risks

According to VAL, the wallet had been active since April. It received various amounts of FLR, some funds went to other addresses, and some were transferred to other networks. Later, the assets were converted to DAI and then to ETH. A total of 889 ETH was sent to one of the associated wallets, and those funds still remain there.

After the $2.1 million theft, the phishing link stopped appearing in ChatGPT replies. The wallet associated with the theft no longer received FLR from outside, but the movement of already stolen funds continued.

This story once again shows that cryptocurrency requires the same level of attention as a large bank transaction. Before signing approvals, it is worth doing a quick check:

Check the website address.

Check the wallet access conditions.

Check authentication and login confirmation.

Be especially careful with large transactions.

In cryptocurrency, an unsafe link can be just as dangerous as the transaction itself.

In cryptocurrency, an unsafe link can be just as dangerous as the transaction itself.

The main risks for a crypto investor are not limited to phishing:

Volatility: determine in advance the amount you are willing to risk, and do not build your entire portfolio around one token.

Phishing: open services from bookmarks or manually enter the address, and check the domain and access rights before signing.

Regulatory risks: consider the rules of your jurisdiction when choosing a platform, wallet, and asset.

Unlimited approvals: set limits, regularly check wallet permissions, and revoke unnecessary access.

What Crypto Investors Should Remember

A crypto investor is someone who invests money in digital assets: for example, buying tokens, holding them in a wallet, or using different strategies to earn income. The motivation is usually simple: price growth, access to new projects, capital diversification, or additional yield.

For beginners, it is safer to start with a clear plan: choose a small amount, learn the first asset, create a wallet, check the exchange, and enable account protection before the first purchase.

HODL: buy and hold the asset for a long time; advantage — less hassle, disadvantage — need to withstand drawdowns.

Trading: make trades more often; advantage — more flexibility, disadvantage — higher risk of mistakes and losses from volatility.

Staking: use assets to earn yield in a network or service; advantage — possible extra income, disadvantage — dependence on network, platform, and lock-up period rules.

Earning in cryptocurrency is not guaranteed. The result depends on the asset price, liquidity, fees, entry timing, wallet security, and overall market volatility.

Hot wallets are convenient for storing small amounts, but it is especially important to protect them from phishing.

Large amounts are better separated from daily operations and stored with stricter access rules.

Choose a crypto exchange based on reputation, fees, account protection, liquidity, and clear withdrawal processes.

In a market where investments are often spread across different networks and assets, users are used to tracking their portfolio by familiar benchmarks:

Bitcoin: an asset usually tracked as a market benchmark.

Ethereum: a network and asset tracked when evaluating a portfolio.

Token liquidity: often checked via Binance or CoinMarketCap.

But even useful services do not replace basic checks: any token on the blockchain can become a phishing target, and from an accounting perspective, such an asset requires especially careful control.

A similar case occurred in August: Hyperliquid clients lost $550,000 after clicking on fake Google ads that led to a phishing site.