Phishing Attack via ChatGPT Results in $2.1 Million Loss for Crypto Investor

Coinspot

Phishing Attack via ChatGPT Results in $2.1 Million Loss for Crypto Investor

First seen 6 Sep 2026, 02:48 UTC • •67.5

Article Content

1 / 4

Browse articles

ThreatCluster •September 6, 2026 at 18:35 UTC

•A crypto investor lost $2.1 million due to a phishing link from ChatGPT.
•The attack involved an unlimited approval transaction that allowed rapid fund transfer.
•Blockchain analysis revealed a complex movement of stolen assets across wallets.

A crypto investor, known as Alex, lost $2.1 million in FXRP after receiving a phishing link from ChatGPT while seeking to swap sFLR for WFLR tokens. The link led to a fraudulent website where Alex connected his wallet and approved an unlimited transaction, allowing the attacker to drain 1.9 million FXRP within seconds. Blockchain investigator VAL tracked the stolen funds, revealing a complex trail involving DAI and ETH transfers. After the incident, the phishing link ceased to appear in ChatGPT responses. Alex has warned others about recovery scammers targeting victims of crypto theft. This incident highlights the critical need for caution when engaging in cryptocurrency transactions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 47d ago How this analysis works

Timeline

2026-09-03

Phishing incident reported

Alex reported losing $2.1 million in FXRP after following a phishing link from ChatGPT.

2026-09-05

Details of the attack published

Coinspot detailed the phishing method and the subsequent loss of funds, including blockchain tracking efforts.

2026-09-05

Phishing link removed from ChatGPT responses

Following the incident, the phishing link stopped appearing in ChatGPT replies, indicating a response to the reported issue.

More articles in this cluster (3)

Threat Graph

7 entities, 6 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Phishing
T1566.002 - Spearphishing Link

Organization (2)

Ethereum
Google

Affected Platform (2)

ChatGPT
OpenOcean

Tool (1)

Tornado Cash

Relationships

Phishing targets ChatGPT
Phishing targets OpenOcean
T1566.002 - Spearphishing Link targets ChatGPT
T1566.002 - Spearphishing Link targets OpenOcean
Tornado Cash related to Ethereum
Tornado Cash related to Google

Following this threat?

Track Ethereum in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Korean-speaking Hackers Target PHP Vulnerabilities in Global Campaign A cybersecurity report from Cyfirma reveals that attackers, possibly linked to North Korea's Lazarus group, are preparing to exploit critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities allow unauthenticated remote code execution, posing a significant threat to government…