The logic held; the incentives were broken. On August 13, 2025, a wallet address that had been dormant for nearly two years suddenly lit up. The same wallet that drained $24.23 million in September 2023 through a malicious token approval attack—then returned 90% of the funds after public pressure—was now moving again. I traced the hash to the wallet. The new haul: WBTC, cbBTC, LDO, USDS, and CRV, worth approximately $25.6 million. Every single asset was converted to DAI and ETH within hours. The attacker had returned, and the pattern was identical. Code does not lie, but it can be misled.
This is not a new attacker. It is the same entity, using the same playbook, targeting the same class of victims. The 2023 incident was extensively documented: the address 0x8fEB...F95Ae exploited a permit-based phishing scheme, stealing tokens from users who had signed infinite approvals. After the theft, the attacker returned 90% of the assets, claiming it was a “white hat” operation. But the 10% retention—roughly $2.4 million—was kept. Now, two years later, the attacker has struck again, converting a fresh $25.6 million into DAI and ETH. The question is not whether the attacker is a repeat offender, but why the industry has failed to learn from the first incident.
Context: The Historical Pattern
The 2023 attack was a textbook case of malicious token approval: the attacker created a fake front-end or phishing link that tricked users into signing an approve or permit transaction for a malicious contract. Once the approval was granted, the attacker could call transferFrom to drain the victim's wallet. The attacker then converted the stolen assets—mostly ETH, USDC, and other ERC-20 tokens—into DAI and sent them through a series of mixers. After public scrutiny, the attacker returned 90% of the funds, likely to avoid legal consequences and maintain the illusion of a “responsible disclosure.” The remaining 10% was never recovered.
The new attack, occurring in August 2025, mirrors this structure. The stolen assets include WBTC (wrapped Bitcoin from BitGo), cbBTC (Coinbase’s wrapped Bitcoin, launched in September 2024), Lido’s LDO governance token, Sky’s USDS stablecoin, and Curve’s CRV token. The attacker converted all of these into DAI and ETH within a single day. The conversion path is revealing: WBTC and cbBTC were swapped on decentralized exchanges, likely through Uniswap or Curve pools, while LDO, CRV, and USDS were also traded. The final destination is a wallet holding only DAI and ETH. The attacker has not yet moved the funds to Tornado Cash, but the window is closing.
Core: Systematic Teardown of the Attack Vector
Let me dissect the technical details. The attacker’s method relies on the fact that most users leave infinite approvals on their tokens. A single phishing transaction can grant the attacker permission to transfer any amount of a specific token. The 2023 attack exploited this, and the 2025 attack does the same. The key difference is the asset composition: the stolen tokens now include cbBTC, a relatively new asset that relies on Coinbase’s centralized custody. By converting cbBTC to DAI, the attacker avoids the risk of Coinbase freezing the asset. Similarly, WBTC can be frozen by BitGo if the address is flagged. The attacker’s choice to convert to DAI and ETH is a deliberate attempt to avoid censorship.
Based on my audit experience in 2017, I have seen this pattern before. The attacker is not a sophisticated hacker; they are a sophisticated social engineer. The code is not the vulnerability—the user’s trust is. The approval mechanism is a feature, but it becomes a weapon when users are tricked. The attacker’s wallet now holds roughly $25.6 million in DAI and ETH. The next step is almost certainly a mixer or a centralized exchange. If the attacker uses Tornado Cash, the funds become untraceable. The on-chain surveillance community has flagged the address, but the attacker is likely monitoring the same channels.
Tokenomic Implications: The Real Damage
The market impact of the stolen assets is minor. $25.6 million is a rounding error in the $2 trillion crypto market. However, the tokenomic consequences are more subtle. The attacker’s conversion of CRV and LDO could create temporary sell pressure. Curve’s governance token, CRV, has a circulating supply of roughly 1.9 billion. A $10 million sell order could push the price down by 2-3% in a low-liquidity environment. Lido’s LDO is similarly vulnerable. The attacker’s decision to sell these tokens immediately suggests they have no interest in governance participation. The yield was not profit; it was liquidity.
But the larger tokenomic issue is trust. The 2023 attack was a warning. The fact that the same wallet could execute a similar attack two years later indicates that the industry has not learned. Infinite approvals remain the default. wallet providers like MetaMask and Ledger have introduced approval revocation tools, but adoption is slow. The attacker’s return is a systemic failure of UX and security design.
Contrarian: What the Bulls Got Right
There is a contrarian angle here. The attacker’s return actually validates the “white hat” narrative from 2023. If the attacker had intended to keep all the funds, they would not have returned 90% the first time. By returning the majority, they established a reputation as a “vigilante” or “ethical hacker,” which might have reduced the scrutiny on their wallet. This allowed them to strike again with a different set of victims. The bulls might argue that the attacker’s behavior is rational: exploit a flawed system, return enough to avoid legal action, and keep a small profit. The math does not lie; the incentives were aligned for a repeat offense.
However, this logic ignores the fact that the attacker is still a thief. The 10% retention from the first attack was a calculated risk. The 2025 attack shows that the attacker is not a one-time opportunist but a professional predator. The contrarian view also misses the broader systemic issue: the industry’s reliance on permissionless approvals creates a constant attack surface. Until the default UX changes, these attacks will continue.
Takeaway: The Accountability Call
The attacker’s wallet is still holding DAI and ETH. The gold window is closing. If the funds enter Tornado Cash within the next 48 hours, the trail will go cold. The on-chain community must act now. But the real takeaway is for protocol developers and wallet providers. Infinite approvals are a liability. The 2023 attack was a warning; the 2025 attack is a confirmation. The industry must move toward granular, time-limited approvals and mandatory revocation prompts. The code is law, but the law must be rewritten. The attacker’s ghost will return, but the next time, the victims may not be anonymous wallets—they could be the protocols themselves.