Crypto Thief Tricks 1,486 People Into Handing Over $95M With One Click

CryptoBilis emptied people’s crypto wallets after one bad approval, stealing $95.35 million from 1,486 victims, with about $30.44 million still tracked and $10 million frozen.

Key Takeaways

• The CryptoBilis drainer stole $95.35 million from 1,486 addresses between Oct. 7 and Oct. 9
• Arkham posted the figures and linked tagged addresses showing funds still under the drainer’s control
• About $30.44 million remains in tagged wallets while another $10 million has been frozen
• The drainer used malicious signing flows that trick users into approving transactions to empty their wallets

Arkham posted the figures on Thursday morning, and linked tagged addresses showing funds still under the drainer’s control. Blockchain forensics firms track token flows by clustering addresses that appear controlled by the same actor.

That work matters after a theft because exchanges, issuers and investigators need wallet labels before they can freeze or intercept assets.

Arkham’s breakdown adds important detail to a case that first looked like a single wallet-security failure. The post says the attacker drained funds from 1,486 addresses over three days, which points to a broad compromise pattern rather than one isolated loss.

Arkham also said the actor is still moving funds, a sign that tracing and freezing efforts are active but incomplete.

A wallet drainer is malware or a malicious signing flow that tricks users into approving transactions that empty their own wallets. In cryptocurrency, that usually means the victim signs away token transfer rights, often without seeing the real destination.

Because the blockchain treats that approval as valid, recovery becomes harder than in bank fraud, where institutions can reverse transfers.

The frozen $10 million matters because it shows at least part of the asset trail ran through venues with blacklist or compliance controls. Stablecoin issuers and centralized exchanges can sometimes stop funds if they receive timely alerts and the stolen assets hit accounts they control.

They cannot reverse every transaction on the base chain itself.

How The Theft Spread Across 1,486 Wallets

The size of the victim count points to a distribution channel that reached many users at once. That can happen through fake wallet prompts, malicious browser extensions or cloned interfaces that imitate trusted signing requests.

A drainer operator needs scale, not just one wealthy target, because many mid-sized thefts add up fast.

Arkham also showed that tagged addresses still hold a large balance. On-chain tagging is not a court ruling, but it gives exchanges and security teams a working map.

Those labels often become the first operational tool for triage, especially when funds split across many chains or intermediaries.

The episode follows a year in which drainers shifted from crude phishing links to polished transaction flows that resemble normal wallet use. Victims no longer need to hand over seed phrases for attackers to cause damage.

One bad signature can be enough.

Also Read: Microsoft’s OpenAI Bet Erases $4B Hit And Lifts Profit

From One Bad Signature To Frozen Funds in cryptobilis

Earlier attack waves often centered on seed phrase theft, where the attacker gained permanent control of a wallet. The newer drainer model is narrower but faster.

It abuses token approvals or transaction authorizations that users believe are harmless, then drains assets immediately after confirmation.

That distinction matters for investigators. If the compromise came from signed approvals, responders must trace each token path and revoke permissions where possible, not just tell users to move wallets.

The burden shifts from password reset logic to forensic triage.

What Exchanges And Users Watch Next

The next phase is whether more of the $30.44 million reaches venues that can act on alerts. If stablecoins were part of the stolen mix, issuer blacklists could limit the attacker’s options.

If the funds stay in native assets and move through decentralized swaps, recovery odds fall.

Security teams will also look for shared indicators across the 1,486 affected addresses. If those wallets interacted with the same site, app or signing prompt, the priority becomes containment as much as recovery.

How Wallet Approvals Let Drainers Empty Accounts

When a user connects a wallet to a site like MetaMask or Ledger Live, the site can ask for different permissions.

Some prompts only prove wallet ownership. Others let a smart contract move tokens later without another full confirmation.

In Ethereum (ETH)-style networks, that token approval can be much more dangerous than it looks on screen.

In a case like CryptoBilis, the attacker may not “hack” the blockchain at all. The attacker gets users to sign a valid message or transaction, then uses the granted permission to transfer assets out.

Firms like Arkham and exchanges then trace destination wallets, not broken code, because the chain recorded the transfers as authorized.

That is why wallet UX, spender warnings and fast address tagging matter more than many users realize.

Read Next: Blockchain.com Gives TRON Fans A New Way To Bet On TRX