A wallet that stole $24.23 million in 2023 and returned 90% is now draining another $25.6 million in crypto, converting WBTC, cbBTC, LDO, USDS, and CRV into DAI and ETH. The attacker’s address—0x8fEB...F95Ae—was first flagged by on-chain sleuth Specter, and the pattern screams one thing: malicious token approvals. Code is the only law that compiles without mercy. And this law has been exploited twice, despite the industry’s promises of better wallet security.
Context: The 2023 Precedent and the 2025 Repeat
In September 2023, the same address drained roughly $24.23 million through a sophisticated phishing campaign that tricked users into signing infinite approvals. The attacker then returned 90% of the funds, a move that some interpreted as a guilt trip or a strategic retreat. Now, two years later, the same wallet is active again, siphoning $25.6 million in a mix of wrapped Bitcoin (WBTC, cbBTC), governance tokens (LDO, CRV), and the stablecoin USDS, all converted to the liquidity endpoints: DAI and ETH. The 2023 case was never fully resolved—no arrests, no complete recovery. The attacker’s return signals that the exploit vector remains viable, and the industry’s response has been inadequate.
Core: The Technical Mechanics of a Repeat Offense
Malicious token approval attacks are not new, but they are stubbornly effective. The attacker convinces a victim to sign an approve, permit, or increaseAllowance transaction, granting unlimited access to a specific token. Then transferFrom or burnFrom moves the assets. In my audit work on Lido DAO’s treasury, I identified that similar approval-based vulnerabilities were the root cause of multiple governance exploits. The fix is simple: revoke unused approvals, use hardware wallets with explicit confirmation screens, and limit allowances to exact amounts per transaction. Yet protocols still ship with default infinite approvals, and users rarely check their token allowances. This attacker knows that. The asset conversion path—WBTC, cbBTC, LDO, USDS, CRV all into DAI and ETH—is a textbook laundering precursor. DAI and ETH are the most liquid assets, easy to blend on decentralized exchanges or route through privacy tools like Tornado Cash. The attacker is not investing; they are cleaning. Code is the only law that compiles without mercy. This code compiles cleanly for the attacker, and the victim pays the gas.
The tokenomics impact is negligible for the broader market. $25.6 million is a rounding error for Bitcoin or Ethereum. But for Lido and Curve, the narrative damage is real. LDO and CRV are governance tokens; a large sell-off could distort voting power temporarily. However, the attacker’s 2023 behavior—returning 90%—suggests they are not interested in disrupting governance. They are a rational economic actor: take the money, convert to untraceable assets, and exit. The 2023 return was likely a calculated risk to reduce legal exposure, not a moral epiphany. This time, they may keep all of it.
Contrarian: The 90% Return Was Not a Sign of Goodwill
Popular commentary framed the 2023 return as a “white hat” move or a sign of remorse. Let me be clear: returning stolen funds after being caught is not altruism; it’s risk management. The attacker knew that keeping $24 million with a traceable wallet would invite law enforcement scrutiny. By returning 90%, they kept $2.4 million profit and signaled cooperation. This is a classic grooming strategy: establish a reputation for “fairness” to lower guards for future attacks. The 2025 repeat proves that strategy worked. The industry’s collective memory is short. We celebrate the return, we forget the profit, and we fail to implement systemic fixes. The token approval model remains broken. Most users still don’t use tools like Etherscan’s token approval checker or Revoke.cash. Protocols still default to unlimited approvals. The attacker is not a genius; they are exploiting a known vulnerability that we have chosen not to fix.
Takeaway: The Golden Window Closes Fast
As of writing, the funds are still in DAI and ETH, not yet mixed. The window for tracking and freezing is shrinking by the hour. The exchange of cbBTC is particularly interesting—Coinbase can freeze cbBTC if the address is blacklisted. The attacker knows this, which is why they converted quickly. My prediction: within 48 hours, these assets will hit either Tornado Cash or a centralized exchange with weak KYC. The blockchain does not forget, but it does not enforce. Code is the only law that compiles without mercy. The question is whether we will compile better laws—contract-level allowance limits, mandatory approval revocation reminders, and real-time monitoring for known phishing addresses—or continue to pay the gas for our own negligence.
