Crypto Whale — $25.6M Repeat Phishing Drain (August 2026)
Summary
On August 12, 2026, an unidentified Ethereum whale wallet was drained of approximately $25.6 million in WBTC, cbBTC, LDO, USDS, and CRV through a phishing attack — the second major exploitation of the same address, which had previously lost $24.2 million to a phishing incident in September 2023. The stolen assets were swapped to approximately 20 million DAI and 3,000 ETH and traced by PeckShield to four distinct attacker-controlled addresses. This page documents the phishing infrastructure and repeat-targeting pattern rather than the victim; the victim is the unnamed whale wallet, not a threat actor.
Connected Entities
1 entities · 10 linked investigationsTimeline(4 events)
2023-09-06
An Ethereum whale wallet (partially identified as 0x13e382...) lost approximately $24.23 million in rETH and stETH after signing malicious increaseAllowance transactions. Funds moved to attacker addresses 0x693b72 and 0x4c10a4, with a portion routed through FixedFloat.
BeinCrypto, Scam Sniffer, CryptoSlate2024-07-01
Approximately ten months after the 2023 theft, the 2023 attacker returned approximately $9.3 million in DAI to the victim in two transfers ($5.23 million and $4.04 million), representing roughly 90% restitution of the 2023 loss.
CryptoPotato, Startup Fortune2026-08-12
The same Ethereum whale wallet was drained of approximately $25.6 million in WBTC, cbBTC, LDO, USDS, and CRV via a phishing attack. Stolen assets were swapped to approximately 20 million DAI and 3,000 ETH. PeckShield traced proceeds to four attacker-controlled addresses. On-chain investigator Specter identified attacker address 0x8fEB...F95Ae.
PeckShield, Crypto Times, Tron Weekly, BeinCrypto2026-08-16
Crypto Times reported the week of August 9–15 as producing over $37 million in confirmed crypto theft across multiple incidents, with the whale phishing drain being the single largest loss of the week.
Crypto TimesDecision Log
- #1publish⛓ pending8/23/2026, 12:09:14 PMhash: 4XKMDdsEdLHqjkZEbYmySPBaUBtVUx3UKRjdJ7KSsvwh
12 of 12 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/23/2026, 12:09:05 PM
last updated: 8/23/2026, 12:28:41 PM
avoid.net — verified advice for a post-truth world