Cover art/illustration via CryptoSlate. Image includes combined content which may include AI-generated content.
An unidentified crypto investor has lost over $3 million in a highly coordinated phishing attack after unknowingly authorizing a malicious contract.
He explained that the breach originated from two consecutive transactions in which the victim approved transfers to an address that mimicked their intended recipient.
The attacker crafted the fraudulent contract so that its first and last characters mirrored the legitimate one, making it difficult to detect.
Xian added that the exploit took advantage of the Safe Multi Send mechanism, disguising the abnormal approval inside what appeared to be a routine authorization.
He wrote:
“This abnormal authorization was hard to detect because it wasn’t a standard approve.”
According to Scam Sniffer, the attacker had prepared the ground well in advance. They deployed a fake but Etherscan-verified contract nearly two weeks earlier, programming it with multiple “batch payment” functions to look legitimate.
On the day of the exploit, the malicious approval was executed through the Request Finance app interface, giving the attacker access to the victim’s funds.
In response, Request Finance acknowledged that a malicious actor had deployed a counterfeit version of its Batch Payment contract. The company noted that only one customer was affected and stressed that the vulnerability has since been patched.
Still, Scam Sniffer highlighted broader concerns about the phishing incident.
The blockchain security firm warned that similar exploits could stem from several vectors, including app vulnerabilities, malware or browser extensions modifying transactions, compromised front-ends, or DNS hijacking.
More importantly, the use of verified contracts and near-identical addresses illustrates how attackers are refining their methods to bypass user scrutiny.
