Founder

DeFi

Higher

<ul>
 <li><strong>Web3 Antivirus highlighted that stETH and aEthWBTC cryptocurrencies worth over $6.5 million were drained.</strong></li>
 <li><strong>Funds were drained through malicious approvals.</strong></li>
 <li><strong>Another wallet had earlier lost ETH, LINK, DAI, and WBTC because of an address poisoning scam.</strong></li>
</ul>
<p>Cryptocurrencies worth more than $6 million have been drained from a DeFi wallet. A malicious actor was able to transfer stETH and aEthWBTC through illegitimate approvals. A victim had earlier lost their funds via an address poisoning scam. Binance Founder Changpeng Zhao recently underlined how hackers were beginning to approach victims in a creative manner.</p>
<h3 class="wp-block-heading" id="h-defi-wallet-loses-over-6m-worth-cryptocurrencies">DeFi Wallet Loses Over $6M Worth Cryptocurrencies</h3>
<p>According to an X post by Web3 Antivirus, a DeFi Wallet that was operational for 4.5 years was drained through malicious approvals. The user reportedly lost stETH and aEthWBTC worth more than $6.5 million. Stolen stETH alone were around $4 million, with aEthWBTC making up for the rest of the amount.</p>
<div>
 <blockquote class="twitter-tweet">
  <p>We've detected one of the largest wallet drainers in recent months, with total losses now surpassing $6.5M.<br><br>The victim wallet had been active for 4.5 years, trading and investing across DeFi, with significant activity on protocols like Lido and Aave. Despite this long history,… <a href="https://t.co/Zfp9YhRGYj" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/Zfp9YhRGYj</a></p>— Web3 Antivirus (@web3_antivirus) <a href="https://twitter.com/web3_antivirus/status/1968613304756056201?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">September 18, 2025</a>
 </blockquote>
</div>
<p>Malicious approvals happen when users unknowingly grant access to a smart contract by approving a transaction. Web3 Antivirus recommended that users verify permissions before granting them. It added that users should also consider revoking permissions that are no longer required. The incident reported by Web3 Antivirus has highlighted that the only way to stay protected is to prevent a malicious incident in Web3.</p>
<h3 class="wp-block-heading" id="h-web3-antivirus-earlier-reported-address-poisoning-scam">Web3 Antivirus Earlier Reported Address Poisoning Scam</h3>
<p>Web3 Antivirus earlier reported a case of address poisoning scam. It said that a victim was slipped a lookalike address by scammers before multiple malicious transactions were executed. Funds stolen were ETH, LINK, DAI, and WBTC. While Web3 Antivirus did not mention the value of drained funds, it said that assets were lost within minutes.</p>
<div>
 <blockquote class="twitter-tweet">
  <p>This victim's wallet has just been hit hard by a series of address poisoning scams, losing multiple assets within mins. <br><br>Scammers slipped in lookalike addresses and drained funds in <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$ETH</a>, <a href="https://twitter.com/search?q=%24LINK&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$LINK</a>, <a href="https://twitter.com/search?q=%24WBTC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$WBTC</a> and <a href="https://twitter.com/search?q=%24DAI&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$DAI</a>, one transaction after another.<br><br>This is exactly what happens when… <a href="https://t.co/KVNSlH9B9o" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/KVNSlH9B9o</a></p>— Web3 Antivirus (@web3_antivirus) <a href="https://twitter.com/web3_antivirus/status/1968606097486324012?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">September 18, 2025</a>
 </blockquote>
</div>
<p>Web3 Antivirus recommended using pre-sign protection to avoid a scam of this manner. It added that users should simultaneously consider verifying the wallet address. Mechanisms like pre-sign protection alert users before they sign a poisoned address.</p>
<h3 class="wp-block-heading" id="h-binance-founder-changpeng-zhao-also-flagged-hacking-advancements">Binance Founder Changpeng Zhao Also Flagged Hacking Advancements</h3>
<p>Changepeng Zhao, Founder of Binance, recently flagged creative ways in which attackers were gaining a foothold in the crypto market. He <a href="https://thenewscrypto.com/binance-founder-changpeng-zhao-explained-hacking-advancements-crypto-markets-on-edge/" target="_blank" rel="noopener noreferrer nofollow">explained creative hacking advancements</a> by stating that hackers were posing as employers and employees to gain data access. Also known as CZ, Zhao added that hackers pose as users to share customer support requests, which then downloads viruses on a device.</p>
<p>A <a href="https://www.chainalysis.com/blog/2025-crypto-crime-mid-year-update/" target="_blank" rel="noopener noreferrer nofollow">report by Chainalysis</a> has highlighted that more than $2.17 billion worth of funds have been drained by the middle of 2025. A large number of victims hailed from the US, Russia, Germany, Indonesia, Japan, and South Korea. Chainalysis’s report also noted ByBit’s incident, where DPRK drained $1.5 billion worth of funds.</p>
<p><strong>Highlighted Crypto News Today</strong>:</p>
<p><a href="https://thenewscrypto.com/will-avalanche-avax-bulls-scale-higher-or-lose-their-footing/" target="_blank" rel="noopener noreferrer nofollow">Will Avalanche (AVAX) Bulls Scale Higher or Lose Their Footing?</a></p>

Over $6M Worth Cryptocurrencies Drained From DeFi Wallet Through Malicious Approvals

Table of Contents

TheNewsCrypto

Other articles published on Sep 19, 2025

Join our free newsletter for daily crypto updates!